jackrabbit-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From ang...@apache.org
Subject svn commit: r1336017 - /jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authentication/AbstractLoginModule.java
Date Wed, 09 May 2012 09:20:15 GMT
Author: angela
Date: Wed May  9 09:20:15 2012
New Revision: 1336017

URL: http://svn.apache.org/viewvc?rev=1336017&view=rev
Log:
JCR-3293 : AbstractLoginModule: get rid of trust_credentials_attribute (step 1: deprecation)

Modified:
    jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authentication/AbstractLoginModule.java

Modified: jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authentication/AbstractLoginModule.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authentication/AbstractLoginModule.java?rev=1336017&r1=1336016&r2=1336017&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authentication/AbstractLoginModule.java
(original)
+++ jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authentication/AbstractLoginModule.java
Wed May  9 09:20:15 2012
@@ -72,6 +72,9 @@ public abstract class AbstractLoginModul
      * login.
      *
      * @see #isPreAuthenticated(Credentials)
+     * @deprecated For security reasons this configuration option has been
+     * deprecated and will no longer be supported in a subsequent release.
+     * See also <a href="https://issues.apache.org/jira/browse/JCR-3293">JCR-3293</a>
      */
     private static final String PRE_AUTHENTICATED_ATTRIBUTE_OPTION = "trust_credentials_attribute";
 
@@ -87,6 +90,9 @@ public abstract class AbstractLoginModul
      * has already been authenticated outside of this LoginModule.
      *
      * @see #getPreAuthAttributeName()
+     * @deprecated For security reasons the support for the preAuth attribute
+     * has been deprecated and will no longer be available in a subsequent release.
+     * See also <a href="https://issues.apache.org/jira/browse/JCR-3293">JCR-3293</a>
      */
     private String preAuthAttributeName;
 
@@ -747,6 +753,9 @@ public abstract class AbstractLoginModul
      * returns <code>null</code>.
      *
      * @see #isPreAuthenticated(Credentials)
+     * @deprecated For security reasons the support for the preAuth attribute
+     * has been deprecated and will no longer be available in a subsequent release.
+     * See also <a href="https://issues.apache.org/jira/browse/JCR-3293">JCR-3293</a>
      */
     protected final String getPreAuthAttributeName() {
         return preAuthAttributeName;
@@ -768,11 +777,20 @@ public abstract class AbstractLoginModul
      * @param creds The Credentials to check
      *
      * @see #getPreAuthAttributeName()
+     * @deprecated For security reasons the support for the preAuth attribute
+     * has been deprecated and will no longer be available in a subsequent release.
+     * See also <a href="https://issues.apache.org/jira/browse/JCR-3293">JCR-3293</a>
      */
     protected boolean isPreAuthenticated(final Credentials creds) {
         final String preAuthAttrName = getPreAuthAttributeName();
-        return preAuthAttrName != null
+        boolean isPreAuth = preAuthAttrName != null
             && (creds instanceof SimpleCredentials)
             && ((SimpleCredentials) creds).getAttribute(preAuthAttrName) != null;
+        if (isPreAuth) {
+            log.warn("Usage of deprecated 'trust_credentials_attribute' option. " +
+                    "Please note that for security reasons this feature will not" +
+                    "be supported in future releases.");
+        }
+        return isPreAuth;
     }
 }



Mime
View raw message