Uploaded image for project: 'PicketBox '
  1. PicketBox
  2. SECURITY-22

Concurrency bug in JaasSecurityManager

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • Icon: Major Major
    • 2.0.GA
    • 1.x
    • JBossSX
    • None

      JaasSecurityManager$DomainInfo.destroy calls logout() when cached entry expires, even while it is used by another thread.

      Suppose we have two threads:

      Thread 1:
      1. 'User1' authentication
      2. 'User1' is added to auth cache
      3. Doing some lengthy operation
      4. Checking roles of User1 - WILL FAIL, another thread has called logout()!

      Thread 2 (when Thread1 is doing 'some lengthy operation' ):
      1. 'User1' logs in.
      2. Auth cache entry has expired.
      3. Calling .logout() on stale entry

              anil.saldhana Anil Saldanha (Inactive)
              cyberax_jira Alex Besogonov (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

                Created:
                Updated:
                Resolved: