natalia-s-ivanova commented on PR #819:
URL: https://github.com/apache/tomcat/pull/819#issuecomment-2668518211

   > 2. If user/password auth is attempted when `authentication="GSSAPI"` then 
remove the environment properties that configured GSSAPI, perform user/password 
authentication and then restore the GSSAPI environment properties. We already 
do the inverse when performing SPNEGO authentication.
   
   We also had a similar quick fix of it for such kind of application, still 
not sure that this such kind of fix should be in general code:
   
   ```
   public class MixedSpnegoLdapJNDIRealm extends JNDIRealm {
       protected boolean checkCredentials(DirContext context, User user, String 
credentials) throws NamingException {
           boolean validated;
           if (userPassword == null) {
               Hashtable<?, ?> preservedEnvironment = context.getEnvironment();
               context.removeFromEnvironment(SECURITY_AUTHENTICATION);
               validated = bindAsUser(context, user, credentials);
               context.addToEnvironment(SECURITY_AUTHENTICATION, 
preservedEnvironment.get(SECURITY_AUTHENTICATION));
           } else {
               validated = compareCredentials(context, user, credentials);
           }
   
   ....
           return validated;
       }
   }
   ```
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

Reply via email to