Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-4356

Special Characters in application password will break SSO authentication

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Not a bug
    • Icon: Low Low
    • None
    • 2.8
    • None
    • None

      When an application is configured in Crowd with SSO with a password that includes special characters such as \, the application authentication will fail. So far I've tested and confirmed that the characters !@#$%&*() do not seem to break the application authentication, however, using them may result in the behavior described in https://jira.atlassian.com/browse/CWD-4243

      The Crowd logs contain the following during the failed authentication:

      2015-05-12 12:57:42,956 http-bio-8095-exec-25 INFO [plugin.rest.filter.BasicApplicationAuthenticationFilter] Invalid authentication for application with name 'jira641'

      Steps to Reproduce:

      1. Setup Crowd with SSO enabled
      2. Setup JIRA to use Crowd (with SSO enabled). Use an application password like pass\word
      3. Attempt to log into JIRA and observe login failure

            [CWD-4356] Special Characters in application password will break SSO authentication

            Deleted Account (Inactive) added a comment -

            I can verify that $ is a legal character and does not need to be escaped for Crowd to accept it.

            Deleted Account (Inactive) added a comment - I can verify that $ is a legal character and does not need to be escaped for Crowd to accept it.

            joe added a comment -

            The crowd.properties file is a Java properties file (http://docs.oracle.com/javase/7/docs/api/java/util/Properties.html), so backslashes need to be escaped.

            That is, for a password of a\b, you would write:

            application.password                    a\\b

            That seems to be the issue here, so I'm going to resolve this. Please reopen if that's an incorrect assumption.

            joe added a comment - The crowd.properties file is a Java properties file ( http://docs.oracle.com/javase/7/docs/api/java/util/Properties.html ), so backslashes need to be escaped. That is, for a password of a\b , you would write: application.password a\\b That seems to be the issue here, so I'm going to resolve this. Please reopen if that's an incorrect assumption.

              Unassigned Unassigned
              ddiblasio David Di Blasio
              Affected customers:
              0 This affects my team
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: