Hello Mike,
I checked the last Java 17 Sources, the illegalStateException is still there:
https://github.com/openjdk/jdk/blob/jdk-17%2B35/src/java.security.jgss/share/classes/sun/security/jgss/GSSCredentialImpl.java
public int getRemainingLifetime() throws GSSException {
if (destroyed) {
throw new IllegalStateException("This credential is " +
"no longer valid");
}
...
Latest Java 18 Code looks the same.
I agree, that there are better ways to tell the caller about the invalid
Kerberos ticket status.
IllegalStateException is a runtime exception whereas the method only declares a
checked GSSException which is maybe not the best way to design this method.
If somebody has good connections to the Java developers, maybe he/she can
trigger an improvement. Unfortunately it might break the compatibility
to other tools if a checked exception is used.
Btw: you are right, the authentication is done via Kerberos. For role
assignment, LDAP is used in combination in our case.
Thanks!
Thomas
-----Ursprüngliche Nachricht-----
Von: Michael B Allen <[email protected]>
Gesendet: Dienstag, 23. November 2021 17:32
An: Tomcat Users List <[email protected]>
Betreff: Re: Authentication with Browser stopped working / missing exception
handling in getRemainingLifetime
On Mon, Nov 22, 2021 at 2:39 AM Thomas Hoffmann (Speed4Trade GmbH)
<[email protected]> wrote:
> Would it be better to also catch IllegalStateException and instead of
> checking left == 0 to change it to left <= 0 ?
I would argue that this is a bug in JGSS. JGSS has been a comedy of errors over
the years. I thought it had mostly stabilized over the last 5-10 years but this
is a good example of the sort of bad behavior from that lib. Throwing an
IllegalStateException there is a bad API choice. I have to wonder if that was
not the designers intention. The getRemainingLifetime API documentation does
not say anything about it throwing an IllegalStateException when your cred
expires. You might want to try the latest JRE if you're using something old. Or
maybe there's something screwy about the cred and it's tripping up an
unexpected code path. I assume you mean Kerberos and not LDAP BTW.
But I think the only real short term solution for now would be to catch the
IllegalStateException and just set left = 0.
Mike
--
Michael B Allen
Java Active Directory Integration
http://www.ioplex.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
