Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-28 06:42:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-662: Add check for a null authentication object returned by provider and skip passing it to session controller.

Browse Source
This commit is contained in:
Luke Taylor 2008-02-04 19:27:12 +00:00
parent 9be3f20faa
commit 3f1ab233dc
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
core/src/main/java/org/springframework/security/providers/ProviderManager.java
View File

@ -86,7 +86,7 @@ import java.util.Properties;
* <p> * <p>
* The exception to this process is when a provider throws an {@link AccountStatusException} or if the configured * The exception to this process is when a provider throws an {@link AccountStatusException} or if the configured
* concurrent session controller throws a {@link ConcurrentLoginException}. In both these cases, no further providers * concurrent session controller throws a {@link ConcurrentLoginException}. In both these cases, no further providers
* in the list will be queried. * in the list will be queried.
* *
* <p> * <p>
* If a valid <code>Authentication</code> is returned by an <code>AuthenticationProvider</code>, the * If a valid <code>Authentication</code> is returned by an <code>AuthenticationProvider</code>, the
@ -207,15 +207,18 @@ public class ProviderManager extends AbstractAuthenticationManager implements In
try { try {
result = provider.authenticate(authentication); result = provider.authenticate(authentication);
copyDetails(authentication, result);
sessionController.checkAuthenticationAllowed(result); if (result != null) {
copyDetails(authentication, result);
sessionController.checkAuthenticationAllowed(result);
}
} catch (AuthenticationException ae) { } catch (AuthenticationException ae) {
lastException = ae; lastException = ae;
result = null; result = null;
} }
// SEC-546: Avoid polling additional providers if auth failure is due to invalid account status or // SEC-546: Avoid polling additional providers if auth failure is due to invalid account status or
// disallowed concurrent login. // disallowed concurrent login.
if (lastException instanceof AccountStatusException || lastException instanceof ConcurrentLoginException) { if (lastException instanceof AccountStatusException || lastException instanceof ConcurrentLoginException) {
break; break;
} }