Uploaded image for project: 'Continuum'
  1. Continuum
  2. CONTINUUM-1723

wrong password use and chaching during add maven2 project

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Critical
    • Resolution: Cannot Reproduce
    • 1.1
    • None
    • None
    • linux system, plexus server, (maestro1.5.1 bundle)

    Description

      When adding a maven2 project, if the provided pom.xml url (first field of form) requires user / pass authentification and you type in the wrong password or wrong username, continuum caches it and will always use it for the rest of his life. As a result it's impossible to get the pom.xml, even if you type correct password in field.

      Steps to reproduce

      1. go to continuum server
      2. Type url of a pom.xml that requires server "basic" authentification
      3. Type in any user/pass for that url that is incorrect (eg: foo:bar)
      4. Click add
      5. Pages show up form again telling "there was a problem getting the pom.xml"
      6. Type in correct user/password
      7. Click add
      8. Pages show up again telling same problem
      9. logout, login, try again with correct user/password
      10. Still impossible
      11. Logout , close your browser, clean your cookies and everything
      12. Login, try again with correct user/password
      13. Still impossible
      14. shutdown continuum server and it's JVM, restart it
      15. Login, try again with correct user/password
      16. Success!
      17. Try to add a second project, with another url on same http server, with incorrect user/pass
      18. Success!

      As a conclusion, continuum caches somewhere the first user / pass, even if incorrect, and will reuse it everytime you access this server. This is a problem in an environment where multiple teams share a common continuum server, a common svn server (with different access rights at different project nodes) and have rights to add projects. The first team member to add a project will have have his user/password right forced to every other users trying to add project.

      The only solution i found so far is, after adding a project, to shutdown the jvm hosting continuum and restart it.

      Behind the scene:

      sniffing of protocol show clearly that continuum, when "getting" the pom mentionned in add project, always uses the same basic authentification, whatever the user type in in user/pass boxes. It's always the first attempt that get used

      Attachments

        Activity

          People

            olamy Olivier Lamy
            delbd David Delbecq
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: