Unhandled null reference in UserAuthenticationResource

[alessandrocavalli]

Environment (Required on creation)

Camunda 7.19.0+ & 7.18.6+

Description (Required on creation; please attach any relevant screenshots, stacktraces, log files, etc. to the ticket)

When using an external authentication system, in case the user is no longer existent, the UserAuthenticationResource will throw a NullPointerException.

org.camunda.commons.logging.BaseLogger.logWarn ENGINE-REST-HTTP500 java.lang.NullPointerException at org.camunda.bpm.webapp.impl.security.auth.UserAuthenticationResource.doLogin(UserAuthenticationResource.java:107) at

Steps to reproduce (Required on creation)

1. Create a user in an external authentication system like LDAP.
2. Configure the engine to use that external authentication system.
3. Log in with the user.
4. Remove the user from the external system.
5. After the auth cache time-to-live is exceeded, try to interact with the web apps.

Observed Behavior (Required on creation)

An NPE is thrown and the user is logged out.

Expected behavior (Required on creation)

The user is logged out and Camunda returns a different error (It could be "Unauthorized")

Root Cause (Required on prioritization)

The user is fetched from the identity provider and used without a null check. If it is null, we run into an NPE.

camunda-bpm-platform/webapps/assembly/src/main/java/org/camunda/bpm/webapp/impl/security/auth/UserAuthenticationResource.java

Line 101 in de1e0af

UserAuthentication authentication = AuthenticationUtil.createAuthentication(processEngine, username);

Solution Ideas

Add a null check to the authentication code and return unauthorized if it is.

...
if (!isPasswordValid) {
      if(isWebappsAuthenticationLoggingEnabled(processEngine)) {
        LOGGER.infoWebappFailedLogin(username, "bad credentials");
      }
      return unauthorized();
    }

    UserAuthentication authentication = AuthenticationUtil.createAuthentication(processEngine, username);

    if (authentication == null) { 
       return unauthorized();
   }
...

Hints

Links

• https://jira.camunda.com/browse/SUPPORT-18275

Breakdown

Pull Requests

Preview Give feedback

1. fix(webapp): Handle null authentication as unauthorized #4914
   bot:backport:7.22 ci:webapp-integration +2
   
2. https://github.com/camunda/camunda-bpm-platform-maintenance/pull/1354

Dev2QA handover

• Does this ticket need a QA test and the testing goals are not clear from the description? Add a Dev2QA handover comment