WindowsDesktopSSO: login after the service credentials expire returns LOGIN_IGNORE unless debug logging is on #1173

Summary

When the cached service credentials of the WindowsDesktopSSO module expire, the module logs in again and retries the token. If the retry succeeds, the module still returns LOGIN_IGNORE instead of LOGIN_SUCCEED, unless message-level debug logging is enabled. A user with a valid Kerberos ticket is therefore not logged in by the module.

Cause

process() has two retry branches for GSSException.CREDENTIALS_EXPIRED: one for a GSSException wrapped in a PrivilegedActionException, one for a bare GSSException. In both, result = ISAuthConstants.LOGIN_SUCCEED sits inside if (debug.messageEnabled()):

• WindowsDesktopSSO.java#L219-L223
• WindowsDesktopSSO.java#L241-L245

authenticateToken(kerberosToken, trustedKerberosRealms);
if (debug.messageEnabled()){
    debug.message("Authentication succeeded with new cred.");
        result = ISAuthConstants.LOGIN_SUCCEED;
}

result starts as LOGIN_IGNORE (L164), so with debug logging at its default level the successful retry is lost.

Impact

• The first login after the service credentials expire is ignored by the module. In a chain the user falls through to the next module (typically the password form); in a Kerberos-only chain the login fails.
• The bug disappears as soon as message-level debug logging is turned on, which makes it hard to reproduce while investigating.

Expected

A successful retry returns LOGIN_SUCCEED regardless of the debug level: move the assignment out of the if in both branches.

Test

The Kerby-based module test proposed in #1172 does not reach these branches. A test that forces CREDENTIALS_EXPIRED on the first acceptSecContext (or expires the service ticket) and asserts LOGIN_SUCCEED with debug at its default level would cover it.