-
Bug
-
Resolution: Won't Do
-
Major
-
1.x
-
None
JaasSecurityManager$DomainInfo.destroy calls logout() when cached entry expires, even while it is used by another thread.
Suppose we have two threads:
Thread 1:
1. 'User1' authentication
2. 'User1' is added to auth cache
3. Doing some lengthy operation
4. Checking roles of User1 - WILL FAIL, another thread has called logout()!
Thread 2 (when Thread1 is doing 'some lengthy operation' ):
1. 'User1' logs in.
2. Auth cache entry has expired.
3. Calling .logout() on stale entry