SEC-453: CasAuthenticationHandler does not log root cause of AuthenticationException.

[spring-projects-issues]

Mat Lowery(Migrated from SEC-453) said:

Excerpt from org.acegisecurity.adapters.cas3.CasAuthenticationHandler’s authenticateUsernamePasswordInternal() method:
-— excerpt begin -—
try {
this.authenticationManager.authenticate(authenticationRequest);
} catch (final org.acegisecurity.AuthenticationException e) {
if (log.isDebugEnabled()) {
log.debug("Authentication request for " + credentials.getUsername() + "failed: " + e.toString());
}

return false;

}
-—- excerpt end -—-

Problems (both with the log.debug() call):
- The log.debug call does not print the stack trace. This could be solved by changing the log.debug() call to:
log.debug("Authentication request for " + credentials.getUsername() + "failed: ", e);
- There needs to be a space between the credentials.getUsername() and the word “failed”.

[spring-projects-issues]

Ben Alex said:

Fixed in SVN commit 1852.