natalia-s-ivanova commented on PR #819: URL: https://github.com/apache/tomcat/pull/819#issuecomment-2668518211
> 2. If user/password auth is attempted when `authentication="GSSAPI"` then remove the environment properties that configured GSSAPI, perform user/password authentication and then restore the GSSAPI environment properties. We already do the inverse when performing SPNEGO authentication. We also had a similar quick fix of it for such kind of application, still not sure that this such kind of fix should be in general code: ``` public class MixedSpnegoLdapJNDIRealm extends JNDIRealm { protected boolean checkCredentials(DirContext context, User user, String credentials) throws NamingException { boolean validated; if (userPassword == null) { Hashtable<?, ?> preservedEnvironment = context.getEnvironment(); context.removeFromEnvironment(SECURITY_AUTHENTICATION); validated = bindAsUser(context, user, credentials); context.addToEnvironment(SECURITY_AUTHENTICATION, preservedEnvironment.get(SECURITY_AUTHENTICATION)); } else { validated = compareCredentials(context, user, credentials); } .... return validated; } } ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org