SEC-618: Authentication details object should be copied to successful Authentication before ConcurrentSessionController.checkAuthenticationAllowed is called

[spring-projects-issues]

Luke Taylor(Migrated from SEC-618) said:

If concurrent session control is used with an authentication provider which doesn’t copy the authentication details object to the successful authentication (e.g. CasAuthenticationProvider) then the check with the concurrent session controller on whether access is allowed takes place before the copyDetails method of AbstractAuthenticationManager is called. This isn’t a problem with classes which extend AbstractUserDetailsAuthenticationProvider, as it copies the authentication details object itself.

The copyDetails method should probably be pulled down into ProviderManager and called before checkAuthenticationAllowed() is called. This will ensure that the details object is available even if the provider doesn’t set it.

It’s also not clear that we really need an AbstractAuthenticationManager at all, given how little there is in there.

[spring-projects-issues]

Luke Taylor said:

I’ve made the suggested change on both trunk and 1.0.x branches.