jakartaee / jakartaee/authentication

TCK Challenge: ServletProfileSPITest#CheckMsgInfoKey

Open
#219 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
27
Forks
34
PR merge metrics
No merged PRs in 30d

Description

There is one definite issue and one possible issue with this test.

1. Hard-coded requirement for Jakarta Authorization support.
```
boolean bIs115Compatible = false;

// ONLY if we are Jakarta Authorization compatible, we want to make an additional key test
if (bIs115Compatible) {
...
```
That boolean value needs to be externally configurable.

Once that has been addressed, there is a possible second issue with the alternative code branch

2. The `CallerPrincipalCallback` check expects the user name to be set to `j2ee` but the user name isn't set until `PasswordValidationCallback` is called which happens after `CallerPrincipalCallback`. I do not see how the test can pass in its current form.

It is quite possible that the second issue is a problem with my understanding rather than the TCK. If, so any pointers to where I am going wrong would be appreciated.

Contributor guide

Open the contributing guide

Research direction

Start with ServletProfileSPITest#CheckMsgInfoKey and inspect how the Jakarta Authorization compatibility boolean is set and how CallerPrincipalCallback and PasswordValidationCallback are ordered. Done means making the compatibility requirement externally configurable and resolving whether the expected username check is valid in the alternative branch.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.