[jira] [Created] (TOMEE-4682) SecurityContext.authenticate() does not persist the session (bypasses HttpServletRequest.authenticate())

[Jonathan Gallimore (Jira)]

Jonathan Gallimore created TOMEE-4682:
-----------------------------------------

             Summary: SecurityContext.authenticate() does not persist the 
session (bypasses HttpServletRequest.authenticate())
                 Key: TOMEE-4682
                 URL: https://issues.apache.org/jira/browse/TOMEE-4682
             Project: TomEE
          Issue Type: Bug
    Affects Versions: 10.2.0, 11.0.0-M1
            Reporter: Jonathan Gallimore
            Assignee: Jonathan Gallimore
             Fix For: 11.0.0, 10.3.0


TomEESecurityContext.authenticate() invokes JASPIC directly via 
ServerAuthContext.validateRequest() instead of delegating to 
HttpServletRequest.authenticate(). This means the Servlet Container processing, 
including the jakarta.servlet.http.registerSession handling that 
@AutoApplySession relies on is not invoked.

Consequently a caller authenticated by calling the 
SecurityContext.authenticate() API is not persisted to the HTTP session and is 
anonymous on the following request.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)