Project: Tomcat
Bug 46011 Cannot access to Principal via Subject.getSubject(AccessController.getContext())
Reported: 2008-10-15 02:56:56 | Status: resolved fixed

Cannot access to Principal via Subject.getSubject(AccessController.getContext()). Problem is that in method internalDoFilter of ApplicationFilterChain in call of filter chain the code determinate the Principal but don't use it: if( Globals.IS_SECURITY_ENABLED ) { final ServletRequest req = request; final ServletResponse res = response; Principal principal = ((HttpServletRequest) req).getUserPrincipal(); Object[] args = new Object[]{req, res, this}; SecurityUtil.doAsPrivilege ("doFilter", filter, classType, args); args = null; } else { In this manner a SecurityUtil.doAsPrivilege will be called with Principal == null and method execute create a Subject with no Principals. Then call a Subject.doAsPrivileged(subject, pea, null); and this do not propagate Principals. I obtain a Subject without Principals calling Subject.getSubject(AccessController.getContext()). In attachment we send our solution

Files changed in fix:
java/org/apache/catalina/core/ApplicationFilterChain.java java/org/apache/catalina/security/SecurityUtil.java