Project: Tomcat
Bug 40150 Incorrect User/Role classnames are silently ignored.
Reported: 2006-08-01 08:52:32 | Status: resolved fixed

org.apache.catalina.realm.JAASRealm does not verify any of the class names that are set through setRoleClassNames() and setUserClassNames(). If an incorrect class name (e.g. a typo) is configured in context.xml, this is unnoticed by JAASRealm. The result is that during authentication, when the subject's principals are checked against the configured class names, the principals are not recognised, and therefore not added to the subject. The fact an incorrect configured class name is currently not detected and logged makes it very hard to find the source of the problem. It can be easily fixed by checking the class names in the two methods mentioned above. The class must exist, and it must implement java.security.Principal, which is currently not enforced/checked by the code.

Files changed in fix:
java/org/apache/catalina/realm/JAASRealm.java