Workaround Krb5LoginModule printing to System.out when tryFirstPass is

enabled

diff --git a/org.argeo.cms/src/org/argeo/cms/auth/SpnegoLoginModule.java b/org.argeo.cms/src/org/argeo/cms/auth/SpnegoLoginModule.java
index a01daf6e0adef7228725ef66833a99d62d66aabb..e5f367d23f1e77cdba3ed26fe806006e8b06a00e 100644 (file)
--- a/org.argeo.cms/src/org/argeo/cms/auth/SpnegoLoginModule.java
+++ b/org.argeo.cms/src/org/argeo/cms/auth/SpnegoLoginModule.java
@@ -36,8 +36,15 @@ public class SpnegoLoginModule implements LoginModule {
        @Override
        public boolean login() throws LoginException {
                byte[] spnegoToken = (byte[]) sharedState.get(CmsAuthUtils.SHARED_STATE_SPNEGO_TOKEN);
-               if (spnegoToken == null)
+               if (spnegoToken == null) {
+                       if (!sharedState.containsKey(CmsAuthUtils.SHARED_STATE_NAME)) {
+                               // workaround: set shared state name to empty
+                               // in order to avoid Krb5LoginModule printing to System.out
+                               // TODO ask upstream to only log in debug mode
+                               sharedState.put(CmsAuthUtils.SHARED_STATE_NAME, "");
+                       }
                        return false;
+               }
                gssContext = checkToken(spnegoToken);
                if (gssContext == null)
                        return false;

diff --git a/org.argeo.cms/src/org/argeo/cms/internal/runtime/jaas-ipa.cfg b/org.argeo.cms/src/org/argeo/cms/internal/runtime/jaas-ipa.cfg
index be902ea6f9d9ce9ea96ce634cc03898b21bb0a01..51db582c69c091bdd7aa79036ff21005b0a9c7e8 100644 (file)
--- a/org.argeo.cms/src/org/argeo/cms/internal/runtime/jaas-ipa.cfg
+++ b/org.argeo.cms/src/org/argeo/cms/internal/runtime/jaas-ipa.cfg
@@ -2,6 +2,7 @@ USER {
     org.argeo.cms.auth.RemoteSessionLoginModule sufficient;
     org.argeo.cms.auth.SpnegoLoginModule optional;
     com.sun.security.auth.module.Krb5LoginModule optional
+     tryFirstPass=true
      storeKey=true;
     org.argeo.cms.auth.UserAdminLoginModule required;
 };