Uploaded image for project: 'PicketBox '
  1. PicketBox
  2. SECURITY-22

Concurrency bug in JaasSecurityManager

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • Icon: Major Major
    • 2.0.GA
    • 1.x
    • JBossSX
    • None

      JaasSecurityManager$DomainInfo.destroy calls logout() when cached entry expires, even while it is used by another thread.

      Suppose we have two threads:

      Thread 1:
      1. 'User1' authentication
      2. 'User1' is added to auth cache
      3. Doing some lengthy operation
      4. Checking roles of User1 - WILL FAIL, another thread has called logout()!

      Thread 2 (when Thread1 is doing 'some lengthy operation' ):
      1. 'User1' logs in.
      2. Auth cache entry has expired.
      3. Calling .logout() on stale entry

            anil.saldhana Anil Saldanha (Inactive)
            cyberax_jira Alex Besogonov (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved: