SEC-618: Authentication details object should be copied to successful Authentication before ConcurrentSessionController.checkAuthenticationAllowed is called #879
Labels
in: core
An issue in spring-security-core
type: bug
A general bug
type: jira
An issue that was migrated from JIRA
Milestone
Luke Taylor(Migrated from SEC-618) said:
If concurrent session control is used with an authentication provider which doesn’t copy the authentication details object to the successful authentication (e.g. CasAuthenticationProvider) then the check with the concurrent session controller on whether access is allowed takes place before the copyDetails method of AbstractAuthenticationManager is called. This isn’t a problem with classes which extend AbstractUserDetailsAuthenticationProvider, as it copies the authentication details object itself.
The copyDetails method should probably be pulled down into ProviderManager and called before checkAuthenticationAllowed() is called. This will ensure that the details object is available even if the provider doesn’t set it.
It’s also not clear that we really need an AbstractAuthenticationManager at all, given how little there is in there.
The text was updated successfully, but these errors were encountered: