Details
-
Improvement
-
Status: Closed
-
Normal
-
Resolution: Fixed
-
None
-
None
-
None
Description
With HSTTWO-2229, the following was added in SecurityValve#checkAccess()
method:
if (requestContext.isCmsRequest())
{ if (requestContext.getResolvedMount().getMount().getVirtualHost().getVirtualHosts().isChannelMngrSiteAuthenticationSkipped()) { log.debug("Overriding authentication requirement because cms request"); return; }}
But, basically #checkAccess() method is responsible for authorization (by
throwing security exception when disallowed), not authentication.
That's how it has been implemented.
HSTTWO-2229 seems about skipping authentication when
the request is from cms and the property is set.
So, the skipping code should be located outside #checkAccess() (Probably rather in the beginning of #invoke()).
Attachments
Issue Links
- is a result of
-
HSTTWO-2229 Viewing authenticated pages via the channel manager should optionally bypass the JAAS authentication
- Closed