Add authorizations to JCR

[lgpl/argeo-commons.git] / security / plugins / org.argeo.security.equinox / src / main / java / org / argeo / security / equinox / SpringLoginModule.java

diff --git a/security/plugins/org.argeo.security.equinox/src/main/java/org/argeo/security/equinox/SpringLoginModule.java b/security/plugins/org.argeo.security.equinox/src/main/java/org/argeo/security/equinox/SpringLoginModule.java
index c25be6afbdf46b845adc37c083065a3c2d095be5..716cb6d855afa8eb5a2486d2657b278daa4a6077 100644 (file)
--- a/security/plugins/org.argeo.security.equinox/src/main/java/org/argeo/security/equinox/SpringLoginModule.java
+++ b/security/plugins/org.argeo.security.equinox/src/main/java/org/argeo/security/equinox/SpringLoginModule.java
@@ -53,6 +53,16 @@ public class SpringLoginModule extends SecurityContextLoginModule {
                if (SecurityContextHolder.getContext().getAuthentication() != null)
                        return super.login();
 
+               // reset all principals and credentials
+               if (log.isTraceEnabled())
+                       log.trace("Resetting all principals and credentials of " + subject);
+               if (subject.getPrincipals() != null)
+                       subject.getPrincipals().clear();
+               if (subject.getPrivateCredentials() != null)
+                       subject.getPrivateCredentials().clear();
+               if (subject.getPublicCredentials() != null)
+                       subject.getPublicCredentials().clear();
+
                // ask for username and password
                Callback label = new TextOutputCallback(TextOutputCallback.INFORMATION,
                                "Required login");
@@ -109,8 +119,8 @@ public class SpringLoginModule extends SecurityContextLoginModule {
 
        @Override
        public boolean logout() throws LoginException {
-//             if (log.isDebugEnabled())
-//                     log.debug("logout subject=" + subject);
+               // if (log.isDebugEnabled())
+               // log.debug("logout subject=" + subject);
                return super.logout();
        }