{"action":"created","issue":{"url":"https://api.github.com/repos/OpenLiberty/open-liberty/issues/3275","repository_url":"https://api.github.com/repos/OpenLiberty/open-liberty","labels_url":"https://api.github.com/repos/OpenLiberty/open-liberty/issues/3275/labels{/name}","comments_url":"https://api.github.com/repos/OpenLiberty/open-liberty/issues/3275/comments","events_url":"https://api.github.com/repos/OpenLiberty/open-liberty/issues/3275/events","html_url":"https://github.com/OpenLiberty/open-liberty/issues/3275","id":317373044,"number":3275,"title":"JWT SSO: Re-accessing resource with LTPA cookie allows access when it shouldn't","user":{"login":"ayoho","id":25798451,"avatar_url":"https://avatars2.githubusercontent.com/u/25798451?v=4","gravatar_id":"","url":"https://api.github.com/users/ayoho","html_url":"https://github.com/ayoho","followers_url":"https://api.github.com/users/ayoho/followers","following_url":"https://api.github.com/users/ayoho/following{/other_user}","gists_url":"https://api.github.com/users/ayoho/gists{/gist_id}","starred_url":"https://api.github.com/users/ayoho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ayoho/subscriptions","organizations_url":"https://api.github.com/users/ayoho/orgs","repos_url":"https://api.github.com/users/ayoho/repos","events_url":"https://api.github.com/users/ayoho/events{/privacy}","received_events_url":"https://api.github.com/users/ayoho/received_events","type":"User","site_admin":false},"labels":[{"id":693734934,"url":"https://api.github.com/repos/OpenLiberty/open-liberty/labels/bug","name":"bug","color":"ee0701","default":true},{"id":709726750,"url":"https://api.github.com/repos/OpenLiberty/open-liberty/labels/team:Security%20SSO","name":"team:Security SSO","color":"c2e0c6","default":false}],"state":"closed","locked":false,"assignee":{"login":"brutif","id":26486297,"avatar_url":"https://avatars0.githubusercontent.com/u/26486297?v=4","gravatar_id":"","url":"https://api.github.com/users/brutif","html_url":"https://github.com/brutif","followers_url":"https://api.github.com/users/brutif/followers","following_url":"https://api.github.com/users/brutif/following{/other_user}","gists_url":"https://api.github.com/users/brutif/gists{/gist_id}","starred_url":"https://api.github.com/users/brutif/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brutif/subscriptions","organizations_url":"https://api.github.com/users/brutif/orgs","repos_url":"https://api.github.com/users/brutif/repos","events_url":"https://api.github.com/users/brutif/events{/privacy}","received_events_url":"https://api.github.com/users/brutif/received_events","type":"User","site_admin":false},"assignees":[{"login":"brutif","id":26486297,"avatar_url":"https://avatars0.githubusercontent.com/u/26486297?v=4","gravatar_id":"","url":"https://api.github.com/users/brutif","html_url":"https://github.com/brutif","followers_url":"https://api.github.com/users/brutif/followers","following_url":"https://api.github.com/users/brutif/following{/other_user}","gists_url":"https://api.github.com/users/brutif/gists{/gist_id}","starred_url":"https://api.github.com/users/brutif/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brutif/subscriptions","organizations_url":"https://api.github.com/users/brutif/orgs","repos_url":"https://api.github.com/users/brutif/repos","events_url":"https://api.github.com/users/brutif/events{/privacy}","received_events_url":"https://api.github.com/users/brutif/received_events","type":"User","site_admin":false},{"login":"chunlongliang-ibm","id":29715913,"avatar_url":"https://avatars2.githubusercontent.com/u/29715913?v=4","gravatar_id":"","url":"https://api.github.com/users/chunlongliang-ibm","html_url":"https://github.com/chunlongliang-ibm","followers_url":"https://api.github.com/users/chunlongliang-ibm/followers","following_url":"https://api.github.com/users/chunlongliang-ibm/following{/other_user}","gists_url":"https://api.github.com/users/chunlongliang-ibm/gists{/gist_id}","starred_url":"https://api.github.com/users/chunlongliang-ibm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chunlongliang-ibm/subscriptions","organizations_url":"https://api.github.com/users/chunlongliang-ibm/orgs","repos_url":"https://api.github.com/users/chunlongliang-ibm/repos","events_url":"https://api.github.com/users/chunlongliang-ibm/events{/privacy}","received_events_url":"https://api.github.com/users/chunlongliang-ibm/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2018-04-24T19:58:54Z","updated_at":"2018-04-25T15:17:10Z","closed_at":"2018-04-25T15:11:38Z","author_association":"CONTRIBUTOR","body":"Test scenario:\r\n- Log into the protected resource _without_ the JWT SSO feature, obtaining an LTPA token/cookie\r\n- Reconfigure the server to enable the JWT SSO feature\r\n- Re-access the protected resource with the LTPA cookie that was just obtained\r\n\r\nRe-accessing the resource should produce a login prompt, however I'm reaching the protected resource and a new JWT principal is put into the subject in addition to the WSPrincipal.\r\n\r\n\r\n[server_noFeature.txt](https://github.com/OpenLiberty/open-liberty/files/1944363/server_noFeature.txt)\r\n[server_withFeature.txt](https://github.com/OpenLiberty/open-liberty/files/1944365/server_withFeature.txt)\r\n[trace.log](https://github.com/OpenLiberty/open-liberty/files/1944366/trace.log)\r\n"},"comment":{"url":"https://api.github.com/repos/OpenLiberty/open-liberty/issues/comments/384325058","html_url":"https://github.com/OpenLiberty/open-liberty/issues/3275#issuecomment-384325058","issue_url":"https://api.github.com/repos/OpenLiberty/open-liberty/issues/3275","id":384325058,"user":{"login":"brutif","id":26486297,"avatar_url":"https://avatars0.githubusercontent.com/u/26486297?v=4","gravatar_id":"","url":"https://api.github.com/users/brutif","html_url":"https://github.com/brutif","followers_url":"https://api.github.com/users/brutif/followers","following_url":"https://api.github.com/users/brutif/following{/other_user}","gists_url":"https://api.github.com/users/brutif/gists{/gist_id}","starred_url":"https://api.github.com/users/brutif/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brutif/subscriptions","organizations_url":"https://api.github.com/users/brutif/orgs","repos_url":"https://api.github.com/users/brutif/repos","events_url":"https://api.github.com/users/brutif/events{/privacy}","received_events_url":"https://api.github.com/users/brutif/received_events","type":"User","site_admin":false},"created_at":"2018-04-25T15:17:09Z","updated_at":"2018-04-25T15:17:09Z","author_association":"MEMBER","body":"Should get fixed by #3268"}}
{"actor":{"display_login":"brutif"}}