Critical The ClientLoginModule is the JAAS login module used on distribution others than JBoss.
Memory leak on tomcat distribution:
The LoginStackCleaner filter must be used to reset the ogin stack after each HTTP request - but it is not declared in tomcat distribution.
Security Hole (on tomcat distribution):
When using Open ULRs (see extension point org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService#openUrl) and creating core sessions will use the context of the last user logged in the current thread (thread local variable) because the filter is not registered to clear the thread local login stack.
Also, e must enforce the a session creation - and throw an exception if someone want to create a new session but no security context exists (not logged in).
The same should be done in webengine context to avoid creating a session if current principal is null.
Here is a list of modifications that needs to be done:
1. In LocalSession.createSession - add a check on principal and throw an exception if it is null.
2. AbstractWebContext.initializeBindings - add a check on principal to avoid binding a coresession if the principal is null.
3. Create a new project nuxeo-platform-login-default that deploy the login stack cleanup filter and the clientloginmodule web propagator. Remove config/authentication-config.xml file from tomcat distribution (and jetty one) - since it will be put in the new project.
