Revised implementation

Decided to not dispose user created credentials at all.
microsoft · May 30, 2018 · 88dc78b · 88dc78b
1 parent d969b03
commit 88dc78b
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 24 deletions.
diff --git a/src/main/java/com/microsoft/sqlserver/jdbc/KerbAuthentication.java b/src/main/java/com/microsoft/sqlserver/jdbc/KerbAuthentication.java
@@ -49,6 +49,7 @@ final class KerbAuthentication extends SSPIAuthentication {
 
     private final GSSManager manager = GSSManager.getInstance();
     private LoginContext lc = null;
+    private boolean isUserCreatedCredential = false;
     private GSSCredential peerCredentials = null;
     private GSSContext peerContext = null;
 
@@ -390,6 +391,7 @@ interface RealmValidator {
             int port,
             GSSCredential ImpersonatedUserCred) throws SQLServerException {
         this(con, address, port);
+        isUserCreatedCredential = true;
         peerCredentials = ImpersonatedUserCred;
     }
 
@@ -403,8 +405,11 @@ byte[] GenerateClientContext(byte[] pin,
 
     int ReleaseClientContext() throws SQLServerException {
         try {
-            if (null != peerCredentials)
+            if (null != peerCredentials && !isUserCreatedCredential) {
                 peerCredentials.dispose();
+            } else if (null != peerCredentials && isUserCreatedCredential) {
+                peerCredentials = null;
+            }
             if (null != peerContext)
                 peerContext.dispose();
             if (null != lc)

diff --git a/src/main/java/com/microsoft/sqlserver/jdbc/SQLServerConnection.java b/src/main/java/com/microsoft/sqlserver/jdbc/SQLServerConnection.java
@@ -3417,9 +3417,10 @@ final boolean doExecute() throws SQLServerException {
         if (integratedSecurity && AuthenticationScheme.nativeAuthentication == intAuthScheme)
             authentication = new AuthenticationJNI(this, currentConnectPlaceHolder.getServerName(), currentConnectPlaceHolder.getPortNumber());
         if (integratedSecurity && AuthenticationScheme.javaKerberos == intAuthScheme) {
-            if (null != ImpersonatedUserCred)
+            if (null != ImpersonatedUserCred) {
                 authentication = new KerbAuthentication(this, currentConnectPlaceHolder.getServerName(), currentConnectPlaceHolder.getPortNumber(),
                         ImpersonatedUserCred);
+            }
             else
                 authentication = new KerbAuthentication(this, currentConnectPlaceHolder.getServerName(), currentConnectPlaceHolder.getPortNumber());
         }
@@ -3441,7 +3442,6 @@ final boolean doExecute() throws SQLServerException {
             // No need any further info from the server for token based authentication. So set _federatedAuthenticationRequested to true
             federatedAuthenticationRequested = true;
         }
-
         try {
             sendLogon(command, authentication, fedAuthFeatureExtensionData);
 
@@ -3455,29 +3455,15 @@ final boolean doExecute() throws SQLServerException {
                     connectionCommand(sqlStmt, "Change Settings");
                 }
             }
-        }
-        finally {
-            if (integratedSecurity) {                
-                if (null != ImpersonatedUserCred) {
-                    try {
-                        if (ImpersonatedUserCred.getRemainingLifetime() <= 0) {
-                            if (null != authentication) {
-                                authentication.ReleaseClientContext();
-                            }
-                            authentication = null;
-                            ImpersonatedUserCred.dispose();
-                    	}
-                    }
-                    catch (GSSException e) {
-                        if (connectionlogger.isLoggable(Level.FINER))
-                            connectionlogger.finer(toString() + " Release of the credentials failed GSSException: " + e);
-                    }
-                } else {
-                    if (null != authentication) {
-                        authentication.ReleaseClientContext();
-                    }
+        } finally {
+            if (integratedSecurity) {
+                if (null != authentication) {
+                    authentication.ReleaseClientContext();
                     authentication = null;
                 }
+                if (null != ImpersonatedUserCred) {
+                    ImpersonatedUserCred = null;
+                }
             }
         }
     }