| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
| |
|
| |
|
|
|
|
|
| |
Only the "auth success" and "auth failed" messages remain at info. That's
consistent with AbstractAuthenticationListener
|
|
|
|
|
|
|
| |
This mirrors the behavior in core: *if* a listener sets a response (on success or failure),
then the other listeners are not called. But if a response is *not* set
(which is sometimes the case for success, like in BasicAuthenticationListener),
then the other listeners are called, and can even fail.
|
|
|
|
|
|
|
|
|
|
| |
This solution is a copy of what AbstractAuthenticationListener does. Scenario:
1) Login
2) Go back to the log in page
3) Put in a bad user/pass
You *should* still be logged in after a failed attempt. This commit gives that behavior.
|
| |
|
| |
|
| |
|
|
|
|
| |
LogicException thanks to @iltar
|
|
|
|
| |
redundant
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
an interface
The reason is that the GuardAuthenticationProvider *must* respond to *all* tokens
created by the system - both "pre auth" and "post auth" tokens. The reason is that
if a "post auth" token becomes not authenticated (e.g. because the user changes between
requests), then it may be passed to the provider system. If no providers respond (which
was the case before this commit), then AuthenticationProviderManager throws an exception.
The next commit will properly handle these "post auth" + "no-longer-authenticated" tokens,
which should cause a log out.
|
|
authentication system
|