Source:
<code>protected Principal doAuthenticate(CachableUserIdentificationInfo cachableUserIdent, HttpServletRequest httpRequest) { LoginContext loginContext; try { CallbackHandler handler = service.getCallbackHandler(cachableUserIdent.getUserInfo()); loginContext = new LoginContext(securityDomain, handler); if (isLoginSynchronized()) { synchronized (NuxeoAuthenticationFilter.class) { loginContext.login(); } } else { loginContext.login(); } Principal principal = (Principal) loginContext.getSubject().getPrincipals().toArray()[0]; cachableUserIdent.setPrincipal(principal); cachableUserIdent.setAlreadyAuthenticated(true); cachableUserIdent.getUserInfo().setUserName(principal.getName()); logAuthenticationAttempt(cachableUserIdent.getUserInfo(), true); } catch (LoginException e) { log.info(String.format("Login failed for %s on request %s", cachableUserIdent.getUserInfo().getUserName(), httpRequest.getRequestURI())); log.debug(e, e); logAuthenticationAttempt(cachableUserIdent.getUserInfo(), false); Throwable cause = e.getCause(); if (cause instanceof DirectoryException) { Throwable rootCause = ExceptionUtils.getRootCause(cause); if (rootCause instanceof NamingException && rootCause.getMessage().contains("LDAP response read timed out") || rootCause instanceof SocketException) { <START> log.debug(String.format( <END> "Exception root cause is either a NamingException with \"LDAP response read timed out\"" + " or a SocketException, setting the status code to %d," + " more relevant than an illegitimate 401.", HttpServletResponse.SC_GATEWAY_TIMEOUT)); httpRequest.setAttribute(LOGIN_STATUS_CODE, HttpServletResponse.SC_GATEWAY_TIMEOUT); } return DIRECTORY_ERROR_PRINCIPAL; } return null; } httpRequest.setAttribute(LOGINCONTEXT_KEY, loginContext); cachableUserIdent.setLoginContext(loginContext); boolean createSession = needSessionSaving(cachableUserIdent.getUserInfo()); HttpSession session = httpRequest.getSession(createSession); if (session != null) { session.setAttribute(USERIDENT_KEY, cachableUserIdent); } service.onAuthenticatedSessionCreated(httpRequest, session, cachableUserIdent); return cachableUserIdent.getPrincipal(); }</code><technical_language>add a isDebugEnabled() ? prevent CPU consumption in case of attack</technical_language>

Target:
protected Principal doAuthenticate(CachableUserIdentificationInfo cachableUserIdent, HttpServletRequest httpRequest) { LoginContext loginContext; try { CallbackHandler handler = service.getCallbackHandler(cachableUserIdent.getUserInfo()); loginContext = new LoginContext(securityDomain, handler); if (isLoginSynchronized()) { synchronized (NuxeoAuthenticationFilter.class) { loginContext.login(); } } else { loginContext.login(); } Principal principal = (Principal) loginContext.getSubject().getPrincipals().toArray()[0]; cachableUserIdent.setPrincipal(principal); cachableUserIdent.setAlreadyAuthenticated(true); cachableUserIdent.getUserInfo().setUserName(principal.getName()); logAuthenticationAttempt(cachableUserIdent.getUserInfo(), true); } catch (LoginException e) { if (log.isInfoEnabled()) { log.info(String.format("Login failed for %s on request %s", cachableUserIdent.getUserInfo().getUserName(), httpRequest.getRequestURI())); } log.debug(e, e); logAuthenticationAttempt(cachableUserIdent.getUserInfo(), false); Throwable cause = e.getCause(); if (cause instanceof DirectoryException) { Throwable rootCause = ExceptionUtils.getRootCause(cause); if (rootCause instanceof NamingException && rootCause.getMessage().contains("LDAP response read timed out") || rootCause instanceof SocketException) { if (log.isDebugEnabled()) { log.debug(String.format( "Exception root cause is either a NamingException with \"LDAP response read timed out\"" + " or a SocketException, setting the status code to %d," + " more relevant than an illegitimate 401.", HttpServletResponse.SC_GATEWAY_TIMEOUT)); } httpRequest.setAttribute(LOGIN_STATUS_CODE, HttpServletResponse.SC_GATEWAY_TIMEOUT); } return DIRECTORY_ERROR_PRINCIPAL; } return null; } httpRequest.setAttribute(LOGINCONTEXT_KEY, loginContext); cachableUserIdent.setLoginContext(loginContext); boolean createSession = needSessionSaving(cachableUserIdent.getUserInfo()); HttpSession session = httpRequest.getSession(createSession); if (session != null) { session.setAttribute(USERIDENT_KEY, cachableUserIdent); } service.onAuthenticatedSessionCreated(httpRequest, session, cachableUserIdent); return cachableUserIdent.getPrincipal(); }