Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-662: Add check for a null authentication object returned by provider and skip passing it to session controller.

This commit is contained in:
Luke Taylor 2008-02-04 19:27:12 +00:00
parent 9be3f20faa
commit 3f1ab233dc
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
core/src/main/java/org/springframework/security/providers/ProviderManager.java
View File

@ -86,7 +86,7 @@ import java.util.Properties;
* <p>
* The exception to this process is when a provider throws an {@link AccountStatusException} or if the configured
* concurrent session controller throws a {@link ConcurrentLoginException}. In both these cases, no further providers
* in the list will be queried.
* in the list will be queried.
*
* <p>
* If a valid <code>Authentication</code> is returned by an <code>AuthenticationProvider</code>, the
@ -207,15 +207,18 @@ public class ProviderManager extends AbstractAuthenticationManager implements In
try {
result = provider.authenticate(authentication);
copyDetails(authentication, result);
sessionController.checkAuthenticationAllowed(result);
if (result != null) {
copyDetails(authentication, result);
sessionController.checkAuthenticationAllowed(result);
}
} catch (AuthenticationException ae) {
lastException = ae;
result = null;
}
// SEC-546: Avoid polling additional providers if auth failure is due to invalid account status or
// disallowed concurrent login.
// disallowed concurrent login.
if (lastException instanceof AccountStatusException || lastException instanceof ConcurrentLoginException) {
break;
}