Skip to content

[Security] [Bug] AuthenticationManager is never run by AnonymousAuthenticationListener #10651

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
cakper opened this issue Apr 8, 2014 · 1 comment
Closed

[Security] [Bug] AuthenticationManager is never run by AnonymousAuthenticationListener #10651

cakper opened this issue Apr 8, 2014 · 1 comment
Labels
Security

Comments

@cakper
Copy link

cakper commented Apr 8, 2014

AnonymousAuthenticationProvider contains authenticate method that verifies wether populated AnonymousToken has the same key as current firewall, which is correct but never run.

To fix that we need in method AnonymousAuthenticationListener::handle add call to AuthenticationManager::authenticate and catch Exception that method may throw.

I've got a fix already and could send a PR if you think that's the right approach.
@jakzal jakzal added the Security label Apr 8, 2014
@cakper cakper mentioned this issue Apr 11, 2014
Merged
@cakper
Copy link
Author

cakper commented Apr 11, 2014

If we don'r add this fixed all Anonymous tokens are shared between firewalls because token is not authenticated, so whether we should remove key from AnonymousToken or add this fix and verify token.

@jakzal jakzal mentioned this issue May 28, 2014
Closed
@fabpot fabpot closed this as completed Sep 25, 2014
fabpot added a commit that referenced this issue Sep 25, 2014
@fabpot
feature #10694 [Security] Call AuthenticationManager in AnonymousAuth…
cc396ff 
…enticationListener (Kacper Gunia)

This PR was merged into the 2.6-dev branch.

Discussion
----------

[Security] Call AuthenticationManager in AnonymousAuthenticationListener

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | yes
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #10651
| License       | MIT
| Doc PR        | -

Commits
-------

78fa5e2 Call AuthenticationManager in AnonymousAuthenticationListener
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@fabpot @jakzal @cakper