From b15475ab3d14d71b3206f3ab4803ef720df7974a Mon Sep 17 00:00:00 2001 From: Luke Taylor Date: Sat, 25 Jun 2011 23:09:56 +0100 Subject: [PATCH] SEC-1771: Change TokenBasedRememberMeServices to obtain password from UserDetailsService if necessary. --- .../rememberme/TokenBasedRememberMeServices.java | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/web/src/main/java/org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.java b/web/src/main/java/org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.java index 750aab297f..c8f9224087 100644 --- a/web/src/main/java/org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.java +++ b/web/src/main/java/org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.java @@ -157,10 +157,21 @@ public class TokenBasedRememberMeServices extends AbstractRememberMeServices { // If unable to find a username and password, just abort as TokenBasedRememberMeServices is // unable to construct a valid token in this case. - if (!StringUtils.hasLength(username) || !StringUtils.hasLength(password)) { + if (!StringUtils.hasLength(username)) { + logger.debug("Unable to retrieve username"); return; } + if (!StringUtils.hasLength(password)) { + UserDetails user = getUserDetailsService().loadUserByUsername(username); + password = user.getPassword(); + + if (!StringUtils.hasLength(password)) { + logger.debug("Unable to obtain password for user: " + username); + return; + } + } + int tokenLifetime = calculateLoginLifetime(request, successfulAuthentication); long expiryTime = System.currentTimeMillis(); // SEC-949