RFR: 8215916: The failure reason of an optional JAAS LoginModule is not logged

Jayashree Huttanagoudar duke at openjdk.org
Wed Jun 22 14:15:40 UTC 2022


On Wed, 22 Jun 2022 13:52:13 GMT, Weijun Wang <weijun at openjdk.org> wrote:

>> src/java.base/share/classes/javax/security/auth/login/LoginContext.java line 887:
>> 
>>> 885:                             (new java.io.PrintWriter(sw));
>>> 886:                     sw.flush();
>>> 887:                     le = new LoginException(sw.toString());
>> 
>> @wangweij might have more to say, but I think you just want to dump this information using `debug.println` if debug is enabled.
>
> I have the same suggestion as Sean. In JAAS, login could succeed even if one optional LoginModule failed, and in this case the reason for that failure is lost (even with your current fix). Logging it somewhere might help developer understand why it happened.

Thanks you both for taking a look at this PR.
I will investigate further for suitable suggested changes.
Could you please suggest me how I can quickly check whether the changes I made are reflecting properly as expected ?

-------------

PR: https://git.openjdk.org/jdk/pull/9159



More information about the security-dev mailing list