{"action":"created","issue":{"url":"https://api.github.com/repos/peholmst/vaadin4spring/issues/255","labels_url":"https://api.github.com/repos/peholmst/vaadin4spring/issues/255/labels{/name}","comments_url":"https://api.github.com/repos/peholmst/vaadin4spring/issues/255/comments","events_url":"https://api.github.com/repos/peholmst/vaadin4spring/issues/255/events","html_url":"https://github.com/peholmst/vaadin4spring/issues/255","id":105719187,"number":255,"title":"VaadinSharedSecurity ignored sessionAuthenticationStrategy failures","user":{"login":"gokhanoner","id":6715308,"avatar_url":"https://avatars.githubusercontent.com/u/6715308?v=3","gravatar_id":"","url":"https://api.github.com/users/gokhanoner","html_url":"https://github.com/gokhanoner","followers_url":"https://api.github.com/users/gokhanoner/followers","following_url":"https://api.github.com/users/gokhanoner/following{/other_user}","gists_url":"https://api.github.com/users/gokhanoner/gists{/gist_id}","starred_url":"https://api.github.com/users/gokhanoner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gokhanoner/subscriptions","organizations_url":"https://api.github.com/users/gokhanoner/orgs","repos_url":"https://api.github.com/users/gokhanoner/repos","events_url":"https://api.github.com/users/gokhanoner/events{/privacy}","received_events_url":"https://api.github.com/users/gokhanoner/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/peholmst/vaadin4spring/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/peholmst/vaadin4spring/labels/security","name":"security","color":"006b75"}],"state":"open","locked":false,"assignee":{"login":"peholmst","id":193337,"avatar_url":"https://avatars.githubusercontent.com/u/193337?v=3","gravatar_id":"","url":"https://api.github.com/users/peholmst","html_url":"https://github.com/peholmst","followers_url":"https://api.github.com/users/peholmst/followers","following_url":"https://api.github.com/users/peholmst/following{/other_user}","gists_url":"https://api.github.com/users/peholmst/gists{/gist_id}","starred_url":"https://api.github.com/users/peholmst/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/peholmst/subscriptions","organizations_url":"https://api.github.com/users/peholmst/orgs","repos_url":"https://api.github.com/users/peholmst/repos","events_url":"https://api.github.com/users/peholmst/events{/privacy}","received_events_url":"https://api.github.com/users/peholmst/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/peholmst/vaadin4spring/milestones/10","html_url":"https://github.com/peholmst/vaadin4spring/milestones/0.0.7.RELEASE","labels_url":"https://api.github.com/repos/peholmst/vaadin4spring/milestones/10/labels","id":1312466,"number":10,"title":"0.0.7.RELEASE","description":"","creator":{"login":"peholmst","id":193337,"avatar_url":"https://avatars.githubusercontent.com/u/193337?v=3","gravatar_id":"","url":"https://api.github.com/users/peholmst","html_url":"https://github.com/peholmst","followers_url":"https://api.github.com/users/peholmst/followers","following_url":"https://api.github.com/users/peholmst/following{/other_user}","gists_url":"https://api.github.com/users/peholmst/gists{/gist_id}","starred_url":"https://api.github.com/users/peholmst/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/peholmst/subscriptions","organizations_url":"https://api.github.com/users/peholmst/orgs","repos_url":"https://api.github.com/users/peholmst/repos","events_url":"https://api.github.com/users/peholmst/events{/privacy}","received_events_url":"https://api.github.com/users/peholmst/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":0,"state":"open","created_at":"2015-09-18T08:43:32Z","updated_at":"2015-10-05T19:55:21Z","due_on":null,"closed_at":null},"comments":9,"created_at":"2015-09-10T02:12:39Z","updated_at":"2015-10-05T19:55:21Z","closed_at":null,"body":"While using ConcurrentSessionControlAuthenticationStrategy or other, authentication can fail after successful authentication due to max. session count etc. But VaadinSharedSecurity assign authentication to context after Manager authentication, to after ```sessionAuthenticationStrategy```.\r\n\r\nI get max. session error on login page, but if I remove the login link, it access to the page, because authentication is already set to context.\r\n\r\n\r\n        try {\r\n            logger.debug(\"Attempting authentication of {}, rememberMe = {}\", authentication, rememberMe);\r\n            final Authentication fullyAuthenticated = getAuthenticationManager().authenticate(authentication);\r\n            context.setAuthentication(fullyAuthenticated);\r\n            if (rememberMe) {\r\n                if (hasRememberMeServices()) {\r\n                    logger.debug(\"Invoking RememberMeServices\");\r\n                    getRememberMeServices().loginSuccess(request, response, authentication);\r\n                } else {\r\n                    throw new IllegalStateException(\"Requested RememberMe authentication but no RememberBeServices are available\");\r\n                }\r\n            }\r\n            logger.debug(\"Invoking session authentication strategy\");\r\n            sessionAuthenticationStrategy.onAuthentication(fullyAuthenticated, request, response);\r\n            logger.debug(\"Invoking authentication success handler\");\r\n            vaadinAuthenticationSuccessHandler.onAuthenticationSuccess(fullyAuthenticated);\r\n            return authentication;\r\n        } catch (AuthenticationException e) {\r\n            logger.debug(\"Authentication failed\");\r\n            context = SecurityContextHolder.createEmptyContext();\r\n            if (hasRememberMeServices()) {\r\n                logger.debug(\"Invoking RememberMeServices\");\r\n                getRememberMeServices().loginFail(request, response);\r\n            }\r\n            throw e;\r\n        }\r\nso\r\n - ```context.setAuthentication(fullyAuthenticated);``` and rememeberMe check needs to be moved after ```sessionAuthenticationStrategy```check\r\n- catch should set authentication to null, instead of setting context to null.\r\n\r\nPlease see ```AbstractAuthenticationProcessingFilter``` implementation, spring-security call this normally.\r\n"},"comment":{"url":"https://api.github.com/repos/peholmst/vaadin4spring/issues/comments/145649683","html_url":"https://github.com/peholmst/vaadin4spring/issues/255#issuecomment-145649683","issue_url":"https://api.github.com/repos/peholmst/vaadin4spring/issues/255","id":145649683,"user":{"login":"peholmst","id":193337,"avatar_url":"https://avatars.githubusercontent.com/u/193337?v=3","gravatar_id":"","url":"https://api.github.com/users/peholmst","html_url":"https://github.com/peholmst","followers_url":"https://api.github.com/users/peholmst/followers","following_url":"https://api.github.com/users/peholmst/following{/other_user}","gists_url":"https://api.github.com/users/peholmst/gists{/gist_id}","starred_url":"https://api.github.com/users/peholmst/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/peholmst/subscriptions","organizations_url":"https://api.github.com/users/peholmst/orgs","repos_url":"https://api.github.com/users/peholmst/repos","events_url":"https://api.github.com/users/peholmst/events{/privacy}","received_events_url":"https://api.github.com/users/peholmst/received_events","type":"User","site_admin":false},"created_at":"2015-10-05T19:55:21Z","updated_at":"2015-10-05T19:55:21Z","body":"Reopening since there should be a more long term solution to this problem."}}