bug 50282 : Load javax.security.auth.login.Configuration with JreMemoryLeakPrevention...

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1042029 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java b/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java
index 24fdb75..64c9f26 100644 (file)
--- a/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java
+++ b/java/org/apache/catalina/core/JreMemoryLeakPreventionListener.java
@@ -107,7 +107,21 @@ public class JreMemoryLeakPreventionListener implements LifecycleListener {
          this.securityPolicyProtection = securityPolicyProtection;
      }
      
-    /**
+     /**
+      * Protect against the memory leak caused when the first call to
+      * <code>javax.security.auth.login.Configuration</code> is triggered by a web
+      * application. This first call populate a static variable with a reference
+      * to the context class loader. Defaults to <code>true</code>.
+      */
+     private boolean securityLoginConfigurationProtection = true;
+     public boolean isSecurityLoginConfigurationProtection() {
+         return securityLoginConfigurationProtection;
+     }
+     public void setSecurityLoginConfigurationProtection(boolean securityLoginConfigurationProtection) {
+         this.securityLoginConfigurationProtection = securityLoginConfigurationProtection;
+     }
+
+     /**
      * Protect against the memory leak, when the initialization of the
      * Java Cryptography Architecture is triggered by initializing
      * a MessageDigest during web application deployment.
@@ -274,6 +288,19 @@ public class JreMemoryLeakPreventionListener implements LifecycleListener {
                     }
                 }
     
+                
+                /*
+                 * Initializing javax.security.auth.login.Configuration retains a static reference to the context 
+                 * class loader.
+                 */
+                if (securityLoginConfigurationProtection) {
+                    try {
+                        Class.forName("javax.security.auth.login.Configuration", true, ClassLoader.getSystemClassLoader());
+                    } catch(ClassNotFoundException e) {
+                        // Ignore
+                    }
+                }
+
                 /*
                  * Creating a MessageDigest during web application startup
                  * initializes the Java Cryptography Architecture. Under certain

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index febf50b..677ff96 100644 (file)
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -43,6 +43,12 @@
   <subsection name="Catalina">
     <changelog>
       <add>
+        <bug>50282</bug>: Load <code>javax.security.auth.login.Configuration</code>
+        with <code>JreMemoryLeakPreventionListener</code> to avoid memory leak
+        when stopping a webapp that would use JAAS.
+        (slaurent)
+      </add>
+      <add>
         <bug>48973</bug>: Avoid creating a SESSIONS.ser file when stopping an 
         application if there's no session. Patch provided by Marc Guillemot.
         (slaurent)

diff --git a/webapps/docs/config/listeners.xml b/webapps/docs/config/listeners.xml
index 713d1ff..10976e2 100644 (file)
--- a/webapps/docs/config/listeners.xml
+++ b/webapps/docs/config/listeners.xml
@@ -270,6 +270,16 @@ service:jmx:rmi://<hostname>:10002/jndi/rmi://<hostname>:10001/jmxrm
         trigger a memory leak on reload. Defaults to <code>true</code>.</p>
       </attribute>
 
+      <attribute name="securityLoginConfigurationProtection" required="false">
+        <p>Enables protection so that usage of the
+        <code>javax.security.auth.login.Configuration</code> class by a web 
+        application does not in a memory leak. The first access of this class will
+        trigger the initializer that will retain a static reference to the context
+        class loader. The protection loads the class with the system classloader 
+        to ensure that the static initializer is not triggered by web application.
+        Defaults to <code>true</code>.</p>
+      </attribute>
+
       <attribute name="securityPolicyProtection" required="false">
         <p>Enables protection so that usage of the deprecated
         <code>javax.security.auth.Policy</code> class by a web application does not