Are the auto login returned values not validated?

[Adam Victor Nazareth Brandizzi，修改在11 年前。]

Hello, all.

For various reasons, I had to implement a custom login. I did it through a portlet which adds a user id and an unencrypted password to the shared session, and a auto login hook which gets the user id and the password and returns them. The auto login class is below:

public class MyAutoLogin implements AutoLogin {
	public String[] login(HttpServletRequest request,
			HttpServletResponse response) throws AutoLoginException {
		HttpSession session = request.getSession();
		
		String userId = (String) session.getAttribute("myUserid");
		String senha = (String) session.getAttribute("myPassword");
		String[] dados = new String[] { userId, senha, Boolean.FALSE.toString()};
		
		session.removeAttribute("myUserid");
		session.removeAttribute("myPassword");
		return dados;
	}
}

What I've found surprising is that the login succeeds even if the password is wrong. So, I suppose I should do the dirty work of authenticating my user (e.g. using UserLocalServiceUtil.authenticateUserById(). My doubts are:

• Is this right? Should the login be successful even when the password is wrong?
• if so, what is the purpose of returning both the user Id and the password?

I am actually asking it mostly for curiosity about the internals of Liferay and to know the consequences of using auto login.

Thanks in advance!

[Hitoshi Ozawa，修改在11 年前。]

Just want to make sure, have you set the following property in portal-ext.properties to set to use your MyAutoLogin?

auto.login.hooks=MyAutoLogin

[Adam Victor Nazareth Brandizzi，修改在11 年前。]

Hitoshi Ozawa:

Just want to make sure, have you set the following property in portal-ext.properties to set to use your MyAutoLogin?

auto.login.hooks=MyAutoLogin

No, but the portlet is packaged with a hook that does it. Anyway, the user is authenticated without problem, the Auto login is executed, I can even put breakpoints on it and the execution stops at it.

What I found amazing is that the user is logged in even when the returned array contains an invalid/non matching password. So, why do return it on the first place? Why not return only the user Id?

Anyway, thanks for the attention!

[Adam Victor Nazareth Brandizzi，修改在11 年前。]

I got it!

The autologin should return the password (as well as whether it it is encrypted or not) because some other, external services can use it! See this comment at AutoLoginFilter source code:

// Not having access to the unencrypted password
// will not allow you to connect to external
// resources that require it (mail server)