Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Rollback: Don't save AdminToken user token in CTS in server mode (access denied cross-node api calls) #716

Merged
merged 1 commit into from
Jan 30, 2024
Merged

Rollback: Don't save AdminToken user token in CTS in server mode (access denied cross-node api calls) #716

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 19 additions & 29 deletions openam-core/src/main/java/com/sun/identity/security/AdminTokenAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,12 +39,9 @@
import com.sun.identity.authentication.internal.AuthPrincipal;
import com.sun.identity.common.ShutdownManager;
import com.sun.identity.shared.debug.Debug;
import org.forgerock.util.thread.listener.ShutdownListener;

import java.security.PrivilegedAction;
import java.util.concurrent.Executors;
import java.util.concurrent.ScheduledExecutorService;
import java.util.concurrent.TimeUnit;


/**
* The class is used to perform privileged operations using
Expand All @@ -65,11 +62,9 @@
* <code>com.iplanet.am.service.secret</code> in
* <code>AMConfig.properties</code>. If so, we will generate single sign on
* token based on the user name and secret.
*
* Note: Java security permissions check for OpenAM can be enabled
* by setting the property <code>com.sun.identity.security.checkcaller</code> to
* true in <code>AMConfig.properties</code> file.
*
* </PRE>
*
*
Expand All @@ -93,7 +88,7 @@ public class AdminTokenAction implements PrivilegedAction<SSOToken> {
/**
* Singleton instance.
*/
private static AdminTokenAction instance;
private static volatile AdminTokenAction instance;

private final SSOTokenManager tokenManager;
private SSOToken appSSOToken;
Expand Down Expand Up @@ -127,12 +122,7 @@ public static AdminTokenAction getInstance() {
*/
private AdminTokenAction() throws SSOException {
tokenManager = SSOTokenManager.getInstance();
ShutdownManager.getInstance().addApplicationSSOTokenDestroyer(new ShutdownListener() {
@Override
public void shutdown() {
AdminTokenAction.reset();
}
});
ShutdownManager.getInstance().addApplicationSSOTokenDestroyer(AdminTokenAction::reset);
validateSession = SystemProperties.getAsBoolean(VALIDATE_SESSION);
}

Expand All @@ -144,15 +134,10 @@ public void shutdown() {
public void authenticationInitialized() {
authInitialized = true;
// Generate the DPro's SSOToken
if (SystemProperties.isServerMode()) { //use in server first internalAppSSOToken (without CTS)
appSSOToken = internalAppSSOToken;
}else {
appSSOToken = getSSOToken();
}
appSSOToken = getSSOToken();
if (debug.messageEnabled()) {
debug.message("AdminTokenAction:authenticationInit " +
"called. AppSSOToken className=" + (String)
((appSSOToken == null) ? "null" :
"called. AppSSOToken className=" + ((appSSOToken == null) ? "null" :
appSSOToken.getClass().getName()));
}
}
Expand Down Expand Up @@ -196,7 +181,7 @@ private void resetInstance() {
* @see java.security.PrivilegedAction#run()
*/
public SSOToken run() {
SSOToken answer = null;
SSOToken answer;
// Check if we have a valid cached SSOToken
if (appSSOToken != null) {
if(tokenManager.isValidToken(appSSOToken)) {
Expand Down Expand Up @@ -229,16 +214,21 @@ public SSOToken run() {
internalAppSSOToken=null;
}
}
answer = getSSOToken();
if (answer != null) {
if (!SystemProperties.isServerMode() || authInitialized) {
appSSOToken = answer;
synchronized (this) {
if (appSSOToken==null) {
answer = getSSOToken();
if (answer != null) {
if (!SystemProperties.isServerMode() || authInitialized) {
appSSOToken = answer;
}
return answer;
} else if (debug.messageEnabled()) {
debug.message("AdminTokenAction::run Unable to get SSOToken from serverconfig.xml");
}
}else {
return appSSOToken;
}
return answer;
} else if (debug.messageEnabled()) {
debug.message("AdminTokenAction::run Unable to get SSOToken from serverconfig.xml");
}

// Check for configured Application Token Provider in AMConfig.properties
String appTokenProviderName = SystemProperties.get(ADMIN_TOKEN_PROVIDER);
if (appTokenProviderName != null) {
Expand Down
Loading