From 3f1ab233dc5a7ce5122698039e438f3a8530b6ab Mon Sep 17 00:00:00 2001
From: Luke Taylor <luke.taylor@springsource.com>
Date: Mon, 4 Feb 2008 19:27:12 +0000
Subject: [PATCH] SEC-662: Add check for a null authentication object returned
 by provider and skip passing it to session controller.

---
 .../security/providers/ProviderManager.java           | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/core/src/main/java/org/springframework/security/providers/ProviderManager.java b/core/src/main/java/org/springframework/security/providers/ProviderManager.java
index e8aa1d2d98..702f9130e3 100644
--- a/core/src/main/java/org/springframework/security/providers/ProviderManager.java
+++ b/core/src/main/java/org/springframework/security/providers/ProviderManager.java
@@ -86,7 +86,7 @@ import java.util.Properties;
  * <p>
  * The exception to this process is when a provider throws an {@link AccountStatusException} or if the configured
  * concurrent session controller throws a {@link ConcurrentLoginException}. In both these cases, no further providers
- * in the list will be queried. 
+ * in the list will be queried.
  *
  * <p>
  * If a valid <code>Authentication</code> is returned by an <code>AuthenticationProvider</code>, the
@@ -207,15 +207,18 @@ public class ProviderManager extends AbstractAuthenticationManager implements In
 
             try {
                 result = provider.authenticate(authentication);
-                copyDetails(authentication, result);
-                sessionController.checkAuthenticationAllowed(result);
+
+                if (result != null) {
+                    copyDetails(authentication, result);
+                    sessionController.checkAuthenticationAllowed(result);
+                }
             } catch (AuthenticationException ae) {
                 lastException = ae;
                 result = null;
             }
 
             // SEC-546: Avoid polling additional providers if auth failure is due to invalid account status or
-            // disallowed concurrent login.            
+            // disallowed concurrent login.
             if (lastException instanceof AccountStatusException || lastException instanceof ConcurrentLoginException) {
                 break;
             }