(shiro) branch main updated: bugfix(matcher): prevent accidental matches for simulated credentials in multi-realm setup, causing errors printed on the console whene they should not be. (#2856)

[lprimak]

This is an automated email from the ASF dual-hosted git repository.

lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro.git


The following commit(s) were added to refs/heads/main by this push:
     new 85f9774b9 bugfix(matcher): prevent accidental matches for simulated 
credentials in multi-realm setup, causing errors printed on the console whene 
they should not be. (#2856)
85f9774b9 is described below

commit 85f9774b908dcfa4df7f60552e5f12346ff0bbd4
Author: Lenny Primak <le...@flowlogix.com>
AuthorDate: Sun Aug 16 12:46:16 2026 -0500

    bugfix(matcher): prevent accidental matches for simulated credentials in 
multi-realm setup, causing errors printed on the console whene they should not 
be. (#2856)
---
 .../shiro/authc/credential/AllowAllCredentialsMatcher.java     | 10 +++++++---
 .../shiro/authc/credential/AllowAllCredentialsMatcherTest.java |  9 +++++++--
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git 
a/core/src/main/java/org/apache/shiro/authc/credential/AllowAllCredentialsMatcher.java
 
b/core/src/main/java/org/apache/shiro/authc/credential/AllowAllCredentialsMatcher.java
index d14dcd402..ad1e5019d 100644
--- 
a/core/src/main/java/org/apache/shiro/authc/credential/AllowAllCredentialsMatcher.java
+++ 
b/core/src/main/java/org/apache/shiro/authc/credential/AllowAllCredentialsMatcher.java
@@ -31,20 +31,24 @@ import org.apache.shiro.authc.SimpleAuthenticationInfo;
  * @since 0.2
  */
 public class AllowAllCredentialsMatcher implements CredentialsMatcher {
+    private static final SimpleAuthenticationInfo SIMULATED_CREDENTIALS =
+            new SimpleAuthenticationInfo("user", "password", "realm");
 
     /**
      * Returns <code>true</code> <em>always</em> no matter what the method 
arguments are.
+     * Exception is made for the simulated credentials returned by {@link 
#createSimulatedCredentials()} which will
+     * always return <code>false</code> to avoid accidental matches when 
multiple realms are configured
      *
      * @param token the token submitted for authentication.
      * @param info  the account being verified for access
-     * @return <code>true</code> <em>always</em>.
+     * @return <code>true</code> <em>always</em>. (except for simulated 
credentials)
      */
     public boolean doCredentialsMatch(AuthenticationToken token, 
AuthenticationInfo info) {
-        return true;
+        return info != SIMULATED_CREDENTIALS;
     }
 
     @Override
     public Optional<AuthenticationInfo> createSimulatedCredentials() {
-        return Optional.of(new SimpleAuthenticationInfo("user", "password", 
"realm"));
+        return Optional.of(SIMULATED_CREDENTIALS);
     }
 }
diff --git 
a/core/src/test/java/org/apache/shiro/authc/credential/AllowAllCredentialsMatcherTest.java
 
b/core/src/test/java/org/apache/shiro/authc/credential/AllowAllCredentialsMatcherTest.java
index dd3c51586..b2b30cb8b 100644
--- 
a/core/src/test/java/org/apache/shiro/authc/credential/AllowAllCredentialsMatcherTest.java
+++ 
b/core/src/test/java/org/apache/shiro/authc/credential/AllowAllCredentialsMatcherTest.java
@@ -27,10 +27,15 @@ import static org.assertj.core.api.Assertions.assertThat;
  * @since Jun 10, 2008 4:35:27 PM
  */
 public class AllowAllCredentialsMatcherTest {
-
     @Test
-    void testBasic() {
+    void basic() {
         assertThat(new AllowAllCredentialsMatcher().doCredentialsMatch(null, 
null)).isTrue();
     }
 
+    @Test
+    void multiRealm() {
+        var matcher = new AllowAllCredentialsMatcher();
+        assertThat(matcher.doCredentialsMatch(null, 
matcher.createSimulatedCredentials().get()))
+                .withFailMessage("Simulated credentials should not 
match").isFalse();
+    }
 }