This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push: new 808e0cb Improve robustness for expired credentials 808e0cb is described below commit 808e0cb47bc428404e58775606bbe933193340f4 Author: Mark Thomas <ma...@apache.org> AuthorDate: Mon Nov 22 17:38:53 2021 +0000 Improve robustness for expired credentials --- java/org/apache/catalina/connector/Request.java | 6 ++++-- webapps/docs/changelog.xml | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/java/org/apache/catalina/connector/Request.java b/java/org/apache/catalina/connector/Request.java index bc02c77..d591bcf 100644 --- a/java/org/apache/catalina/connector/Request.java +++ b/java/org/apache/catalina/connector/Request.java @@ -2600,11 +2600,13 @@ public class Request implements HttpServletRequest { int left = -1; try { left = gssCredential.getRemainingLifetime(); - } catch (GSSException e) { + } catch (GSSException | IllegalStateException e) { log.warn(sm.getString("coyoteRequest.gssLifetimeFail", userPrincipal.getName()), e); } - if (left == 0) { + // zero is expired. + // Should never be less than zero but handle those values too + if (left <= 0) { // GSS credential has expired. Need to re-authenticate. try { logout(); diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml index 861409b..6a16393 100644 --- a/webapps/docs/changelog.xml +++ b/webapps/docs/changelog.xml @@ -119,6 +119,10 @@ <code>web.xml</code> file, a <code>web-fragment.xml</code> file nor annotated with <code>WebListener</code>. (markt) </fix> + <fix> + Make SPNEGO authentication more robust for the case where the provided + credential has expired. (markt) + </fix> </changelog> </subsection> <subsection name="Coyote"> --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org