getCurrentUser not returning currentUser

[Howard Chen]

Chris,

We also encountered similar problem as what you described.
We are using WL 5.1SP8 on HPUX box with a cluster of 2.
Judging from the log file, it seems that a user input
a record on Friday and then left, when he come in in the
next Monday and continue the work, the userId obtained
through Security.getCurrentUser() is not his.
Have you found a solution to your problem? If so,
would you mind sharing it? Thanks.

Regards,
Howard

"Christopher Conner" <c.co...@citr.com> wrote:
>
>I have a servlet implementation.
>In the POST method of the Servlet, I want to get the current user.
>when I call Security.getCurrentUser() I sometimes get a username of somebody
>else on the system.
>In the example below, I know I am portal-novice,
>I pull it right out of the the request.
>
>certs = (X509[]) request.getAttribute( "javax.net.ssl.peer_certificates"
>);
>JDK11Certificate jdk11cert = new JDK11Certificate( certs[0] );
>String subjectName = jdk11cert.getPrincipal().getName();
>
>but when I ask Security who I am I get portal-expert.
>I then try to create a new Context with the following code:
>
>Hashtable ht = new Hashtable();
> ht.put(Context.INITIAL_CONTEXT_FACTORY, "weblogic.jndi.WLInitialContextFactory");
> ht.put(Context.SECURITY_PRINCIPAL, subjectName);
> initialContext = new InitialContext(ht);
>
>But when I call getCurrentUser again I still get the user portal-expert
>
>Tue Dec 05 19:58:08 MST 2000:<D> <CachingRealm> getUser("portal-expert")
>Tue Dec 05 19:58:08 MST 2000:<D> <CachingRealm> user: delegate HAS portal-expert
>12/5/00 7:58 PM:com.hp.edot.servlet.ProcessServlet:4:BEFORE: Security.getCurrentUser()
>= portal-expert
>12/5/00 7:58 PM:com.hp.edot.servlet.ProcessServlet:4:SubjectName = portal-novice
>{Here is where above code happens}
>Tue Dec 05 19:58:08 MST 2000:<D> <CachingRealm> getUser("portal-expert")
>Tue Dec 05 19:58:08 MST 2000:<D> <CachingRealm> user: delegate HAS portal-expert
>12/5/00 7:58 PM:com.hp.edot.servlet.ProcessServlet:4:AFTER: Security.getCurrentUser()
>= portal-expert
>
>How do I get Security.getCurrentUser to correctly return the proper user
>I have noticed that if I turn all Caching off I always get the right
>user
>If I turn on auth and acl caching, I get the above situation.
>The behaviour doesn't always give me the wrong user.
>It might to be tied to how long it has been since the last user was authorized.
>
>If I turn user cache on, a null pointer exception is thrown.
>
>Tue Dec 05 20:19:51 MST 2000:<I> <WebLogicServer> WebLogic Server started
>Tue Dec 05 20:20:31 MST 2000:<D> <CachingRealm> authenticate("guest")
>Tue Dec 05 20:20:31 MST 2000:<D> <CachingRealm> user: delegate HAS guest
>Tue Dec 05 20:20:31 MST 2000:<D> <CachingRealm> auth: delegate PASSES
>guest
>Tue Dec 05 20:20:31 MST 2000:<I> <NT Performance Pack> Allocating: '2'
>NT reader threads
>Tue Dec 05 20:20:32 MST 2000:<D> <CachingRealm> getAcl("weblogic.url")
>Tue Dec 05 20:20:32 MST 2000:<D> <CachingRealm> acl: UNACL weblogic.url
>Tue Dec 05 20:20:32 MST 2000:<D> <CachingRealm> getAcl("weblogic.servlet.portal",
>'.')
>Tue Dec 05 20:20:32 MST 2000:<D> <CachingRealm> getAcl("weblogic.servlet.portal")
>Tue Dec 05 20:20:32 MST 2000:<D> <CachingRealm> acl: delegate HAS weblogic.servlet.portal
>Tue Dec 05 20:20:32 MST 2000:<D> <CachingRealm> authenticate("null")
>Tue Dec 05 20:20:32 MST 2000:<E> <ServletContextManager> Servlet request
>terminiated with RuntimeException
>java.lang.NullPointerException
> at weblogic.security.acl.TTLCache.hash(TTLCache.java:348)
> at weblogic.security.acl.TTLCache.findEntry(TTLCache.java:480)
> at weblogic.security.acl.TTLCache.get(TTLCache.java:340)
> at weblogic.security.acl.CachingRealm.getUserEntry(CachingRealm.java:1100)
> at weblogic.security.acl.CachingRealm.authenticate(CachingRealm.java:1206)
> at weblogic.security.acl.CachingRealm.getUser(CachingRealm.java:1178)
> at weblogic.security.acl.Realm.authenticate(Realm.java:181)
> at weblogic.security.acl.Realm.getAuthenticatedName(Realm.java:199)
> at weblogic.security.acl.internal.Security.authenticate(Security.java:81)
> at weblogic.servlet.internal.ServletContextImpl.checkAuthenticate(ServletContextImpl.java:1617)
> at weblogic.servlet.internal.ServletContextImpl.checkABasic(ServletContextImpl.java:1699)
> at weblogic.servlet.internal.ServletContextImpl.checkA(ServletContextImpl.java:1662)
> at weblogic.servlet.internal.ServletContextImpl.checkAccess(ServletContextImpl.java:1546)
> at weblogic.servlet.internal.ServletContextImpl.invokeServlet(ServletContextImpl.java:738)
> at weblogic.servlet.internal.ServletContextImpl.invokeServlet(ServletContextImpl.java:707)
> at weblogic.servlet.internal.ServletContextManager.invokeServlet(ServletContextManager.java:251)
> at weblogic.socket.MuxableSocketHTTP.invokeServlet(MuxableSocketHTTP.java:369)
> at weblogic.socket.MuxableSocketHTTP.execute(MuxableSocketHTTP.java:269)
> at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:135)
>
>I guess my real question is when/how is the currentUser set/authorized?
>Is there code/settings I must make to have this happen?
>Why would a null pointer exception get thown when user cache is turned
>on.
>
>