sonatype/nexus-oss — pull request #900 by adreghiciu (2014-12-05 08:24:41+00:00)
Title: Handle concurrent updates while hashing passwords

There could be situations when same user is authenticated at the same and needs password rehashing or that a user is updated (by some admin) while he is authenticated and needs rehashing. In that case, before we added MVCC to security, password rehashing was overwriting changes with possible old data.
The most probably case to happen was for anonymous password due to concurrent access to UI (as can be seen bellow).

The fix will re-read the user & re-update in case of such a concurrent update.

```
2014-12-04 18:35:21,826-0800 ERROR [pool-9-thread-1] *UNKNOWN org.sonatype.security.realms.AuthenticatingRealmImpl - Unable to update hash for user anonymous
java.util.ConcurrentModificationException: User anonymous updated in the meantime
at org.sonatype.nexus.security.source.OrientSecurityModelConfigurationSource$OrientSecurityModelConfiguration.updateUser(OrientSecurityModelConfigurationSource.java:283) [org.sonatype.nexus.core:3.0.0.SNAPSHOT]
at org.sonatype.security.realms.tools.DefaultConfigurationManager.updateUser(DefaultConfigurationManager.java:373) [org.sonatype.nexus.core:3.0.0.SNAPSHOT]
at org.sonatype.security.realms.tools.DefaultConfigurationManager.updateUser(DefaultConfigurationManager.java:360) [org.sonatype.nexus.core:3.0.0.SNAPSHOT]
at org.sonatype.security.realms.tools.DefaultConfigurationManager.updateUser(DefaultConfigurationManager.java:353) [org.sonatype.nexus.core:3.0.0.SNAPSHOT]
at org.sonatype.security.realms.AuthenticatingRealmImpl.reHashPassword(AuthenticatingRealmImpl.java:124) [org.sonatype.nexus.core:3.0.0.SNAPSHOT]
at org.sonatype.security.realms.AuthenticatingRealmImpl.doGetAuthenticationInfo(AuthenticatingRealmImpl.java:98) [org.sonatype.nexus.core:3.0.0.SNAPSHOT]
at org.apache.shiro.realm.AuthenticatingRealm.getAuthenticationInfo(AuthenticatingRealm.java:568) [org.apache.shiro.core:1.2.3]
at org.sonatype.security.authentication.FirstSuccessfulModularRealmAuthenticator.doMultiRealmAuthentication(FirstSuccessfulModularRealmAuthenticator.java:55) [org.sonatype.nexus.core:3.0.0.SNAPSHOT]
at org.apache.shiro.authc.pam.ModularRealmAuthenticator.doAuthenticate(ModularRealmAuthenticator.java:269) [org.apache.shiro.core:1.2.3]
at org.apache.shiro.authc.AbstractAuthenticator.authenticate(AbstractAuthenticator.java:198) [org.apache.shiro.core:1.2.3]
at org.apache.shiro.mgt.AuthenticatingSecurityManager.authenticate(AuthenticatingSecurityManager.java:106) [org.apache.shiro.core:1.2.3]
at org.apache.shiro.mgt.DefaultSecurityManager.login(DefaultSecurityManager.java:270) [org.apache.shiro.core:1.2.3]
at org.apache.shiro.nexus.NexusWebSecurityManager.login(NexusWebSecurityManager.java:52) [org.sonatype.nexus.core:3.0.0.SNAPSHOT]
at org.apache.shiro.subject.support.DelegatingSubject.login(DelegatingSubject.java:256) [org.apache.shiro.core:1.2.3]
at org.sonatype.security.DefaultSecuritySystem.login(DefaultSecuritySystem.java:141) [org.sonatype.nexus.core:3.0.0.SNAPSHOT]
```