Description Christian Damus 2013-10-29 11:43:38 EDT

Git master as of commit bd2c813 at least.

The SecurityExtension is intended to set up a SecurityManager for each repository that has a <securityManager> element in its configuration XML.  However, when the descriptions of the security managers in different repositories look similar, the result is that the IPluginContainer.INSTANCE creates only a single SecurityManager and the SecurityExtension attempts to assign it to all of the repositories.

This causes problems because a SecurityManager is designed to be paired with a single repository.  The setRepository(...) method does:

  * assign the reference to the repository
  * if the realm was not previously initialized,
    connect a JVM transport session to the repository
    and initialize the realm

Let's say I have two repositories in my server that all create a security manager in the default configuration:

   <securityManager
      type="default"
      description="/security:annotation:home(/home)"/>

The SecurityExtension triggers creation of this SecurityManager in the shared container  when processing the first repository and sets the repository into the security manager, which proceeds to connect to it and initialize the realm.

On the second repository, the SecurityExtension retrieves the *same* SecurityManager instance from the container and sets another repository into it.  The SecurityManager updates its repository reference but finds it already has a realm from the other repository, so does nothing further.  Now the SecurityManager has a realm from one repository and things it is providing security for another.

This doesn't work.  We need to ensure that the container has a distinct SecurityManager for every repository that needs one.  I suggest qualifying the security manager's description in the container with the name of the repository.