[java-identity-provider] branch maint-5.1 updated: IDP-2347 - HTPasswordCredentialValidator reload isn't seeing changes

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch maint-5.1
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=20dd06741c8af8eb9aea7f6739df504e08024d7a

The following commit(s) were added to refs/heads/maint-5.1 by this push:
     new 20dd06741 IDP-2347 - HTPasswordCredentialValidator reload isn't seeing changes
20dd06741 is described below

commit 20dd06741c8af8eb9aea7f6739df504e08024d7a
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Mar 24 15:45:50 2025 -0400

    IDP-2347 - HTPasswordCredentialValidator reload isn't seeing changes
    
    https://shibboleth.atlassian.net/browse/IDP-2347
    
    Moved and synchronized reload and fetch logic to the earlier step.
    Fixed internal tracking of file mod time.
---
 .../authn/impl/HTPasswdCredentialValidator.java    | 39 ++++++++++++----------
 1 file changed, 21 insertions(+), 18 deletions(-)

diff --git a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/HTPasswdCredentialValidator.java b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/HTPasswdCredentialValidator.java
index 9621068f2..dda41586c 100644
--- a/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/HTPasswdCredentialValidator.java
+++ b/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/HTPasswdCredentialValidator.java
@@ -21,7 +21,6 @@ import java.security.NoSuchAlgorithmException;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Scanner;
-import java.util.concurrent.ConcurrentHashMap;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
@@ -78,7 +77,7 @@ public class HTPasswdCredentialValidator extends AbstractUsernamePasswordCredent
     /** Constructor. */
     public HTPasswdCredentialValidator() {
         lastModified = 0;
-        credentialMap = new ConcurrentHashMap<>();
+        credentialMap = new HashMap<>();
     }
     
     /**
@@ -128,10 +127,11 @@ public class HTPasswdCredentialValidator extends AbstractUsernamePasswordCredent
             @Nonnull final UsernamePasswordContext usernamePasswordContext,
             @Nullable final WarningHandler warningHandler,
             @Nullable final ErrorHandler errorHandler) throws Exception {
-        
+
         final String username = usernamePasswordContext.getTransformedUsername();
+        assert username != null;
         
-        final String passwd = credentialMap.get(username);
+        final String passwd = getCredential(username);
         if (passwd == null) {
             log.debug("{} Username '{}' not found in password resource", getLogPrefix(), username);
             final LoginException e = new LoginException(AuthnEventIds.UNKNOWN_USERNAME); 
@@ -170,9 +170,7 @@ public class HTPasswdCredentialValidator extends AbstractUsernamePasswordCredent
      */
     private boolean authenticate(@Nonnull final UsernamePasswordContext usernamePasswordContext,
             @Nonnull final String storedPassword) {
-        
-        refreshCredentials();
-        
+                
         // test Apache MD5 variant encrypted password
         if (storedPassword.startsWith("$apr1$")) {
             if (storedPassword.equals(Md5Crypt.apr1Crypt(usernamePasswordContext.getPassword(), storedPassword))) {
@@ -191,26 +189,31 @@ public class HTPasswdCredentialValidator extends AbstractUsernamePasswordCredent
     }
 
     /**
-     * Check for file refresh.
+     * Check for file refresh and return the matching password.
+     * 
+     * @param username record to fetch
+     * 
+     * @return matching password or null 
      */
-    private void refreshCredentials() {
+    @Nullable private synchronized String getCredential(@Nonnull final String username) {
         final Resource resource = htPasswdResource;
 
-        if (resource == null) {
-            // Nothing to do.
-            return;
-        }
-        
         try {
-            if (resource.isFile() && resource.exists() && resource.lastModified() > lastModified) {
-                try (final InputStream is = resource.getInputStream()) {
-                    credentialMap.clear();
-                    credentialMap.putAll(readCredentials(is));
+            if (resource != null && resource.isFile() && resource.exists()) {
+                final long modTime = resource.lastModified();
+                if (modTime > lastModified) {
+                    try (final InputStream is = resource.getInputStream()) {
+                        credentialMap.clear();
+                        credentialMap.putAll(readCredentials(is));
+                    }
+                    lastModified = modTime;
                 }
             }
         } catch (final IOException e) {
             log.error("{} Error reloading credentials", getLogPrefix(), e);
         }
+        
+        return credentialMap.get(username);
     }
     
     /**

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.