LoginError thrown if there's no user called "admin"

Support
#1

Hello,
I noticed that, if I change the name of the admin user to anything else (eg “another_admin”) I get a LoginError every second or so…
Why is it so?
Here’s an excerpt of the log:
(CUBA ver 6.6.5)

2017-12-12 01:13:49.480 WARN [scheduler-4] com.haulmont.cuba.security.app.LoginWorkerBean - Failed to authenticate: admin 2017-12-12 01:13:49.482 ERROR [scheduler-4] org.springframework.scheduling.support.TaskUtils$LoggingErrorHandler - Unexpected error occurred in scheduled task. java.lang.RuntimeException: Unable to perform system login at com.haulmont.cuba.security.app.Authentication.begin(Authentication.java:123) ~[cuba-core-6.5.7.jar:6.5.7] at com.haulmont.cuba.security.app.Authentication.begin(Authentication.java:141) ~[cuba-core-6.5.7.jar:6.5.7] at com.haulmont.cuba.core.app.scheduling.Scheduling.processScheduledTasks(Scheduling.java:110) ~[cuba-core-6.5.7.jar:6.5.7] at com.haulmont.cuba.core.app.scheduling.Scheduling.processScheduledTasks(Scheduling.java:97) ~[cuba-core-6.5.7.jar:6.5.7] at sun.reflect.GeneratedMethodAccessor126.invoke(Unknown Source) ~[na:na] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_151] at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_151] at org.springframework.scheduling.support.ScheduledMethodRunnable.run(ScheduledMethodRunnable.java:65) ~[spring-context-4.3.3.RELEASE.jar:4.3.3.RELEASE] at org.springframework.scheduling.support.DelegatingErrorHandlingRunnable.run(DelegatingErrorHandlingRunnable.java:54) ~[spring-context-4.3.3.RELEASE.jar:4.3.3.REL$ at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [na:1.8.0_151] at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [na:1.8.0_151] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [na:1.8.0_151] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [na:1.8.0_151] at com.haulmont.cuba.core.sys.CubaThreadPoolTaskScheduler$TaskDecorator.run(CubaThreadPoolTaskScheduler.java:108) [cuba-global-6.5.7.jar:6.5.7] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_151] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_151] at java.lang.Thread.run(Thread.java:748) [na:1.8.0_151] Caused by: com.haulmont.cuba.security.global.LoginException: Unknown login name or bad password: admin at com.haulmont.cuba.security.app.LoginWorkerBean.loginSystem(LoginWorkerBean.java:185) ~[cuba-core-6.5.7.jar:6.5.7] at com.haulmont.cuba.security.app.Authentication.begin(Authentication.java:120) ~[cuba-core-6.5.7.jar:6.5.7] ... 16 common frames omitted

#3

Hi!

Do you change admin’s name or login?

Best regards,
Daniil

#4

The Login… but what is the scheduled task trying to connect every second with admin account? I don’t get it

And why there MUST be a user with “admin” Login. Isn’t it a -possible- security flaw?

#5

If you do a little research, you will find a file cuba-spring.xml that has schedulling configuration:

<task:scheduled-tasks scheduler="scheduler">
    ...
    <task:scheduled ref="cuba_Scheduling" method="processScheduledTasks"
                    fixed-rate="${cuba.schedulingInterval?:1000}"/>
    ...
</task:scheduled-tasks>

Inside of this method you will find this code:

authentication.begin();

Let’s take a look at the JavaDoc:

Authenticate with login set in {@code cuba.jmxUserLogin} app property.

It means that to solve your problem you should override default value for the application property cuba.jmxUserLogin.

Best regards,
Daniil.

2 Likes