[tomcat] branch main updated: Improve robustness for expired credentials

[markt]

This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/main by this push:
     new 808e0cb  Improve robustness for expired credentials
808e0cb is described below

commit 808e0cb47bc428404e58775606bbe933193340f4
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Mon Nov 22 17:38:53 2021 +0000

    Improve robustness for expired credentials
---
 java/org/apache/catalina/connector/Request.java | 6 ++++--
 webapps/docs/changelog.xml                      | 4 ++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/java/org/apache/catalina/connector/Request.java 
b/java/org/apache/catalina/connector/Request.java
index bc02c77..d591bcf 100644
--- a/java/org/apache/catalina/connector/Request.java
+++ b/java/org/apache/catalina/connector/Request.java
@@ -2600,11 +2600,13 @@ public class Request implements HttpServletRequest {
                 int left = -1;
                 try {
                     left = gssCredential.getRemainingLifetime();
-                } catch (GSSException e) {
+                } catch (GSSException | IllegalStateException e) {
                     log.warn(sm.getString("coyoteRequest.gssLifetimeFail",
                             userPrincipal.getName()), e);
                 }
-                if (left == 0) {
+                // zero is expired.
+                // Should never be less than zero but handle those values too
+                if (left <= 0) {
                     // GSS credential has expired. Need to re-authenticate.
                     try {
                         logout();
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 861409b..6a16393 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -119,6 +119,10 @@
         <code>web.xml</code> file, a <code>web-fragment.xml</code> file nor
         annotated with <code>WebListener</code>. (markt)
       </fix>
+      <fix>
+        Make SPNEGO authentication more robust for the case where the provided
+        credential has expired. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org