MainServlet is unable to handle non-userId remote user values

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.2.X, 7.3.X, Master
• Fix Version/s: 7.2.10 DXP FP11, 7.2.10.4 DXP SP4, 7.2.X, 7.3.10 DXP FP1, 7.3.10.1 DXP SP1, 7.3.6 CE GA7, 7.3.X, 7.4.13 DXP GA1, Master
• Component/s: Application Security > Auto Login
• Labels:
  • ee-ts
  • liferay-dxp-72-sp4
  • liferay-dxp-73-sp1
  • liferay-fixpack-dxp-1-7310
  • liferay-fixpack-dxp-11-7210
• Branch Version/s:
  7.3.x, 7.2.x
• Backported to Branch:
  Committed
• Story Points: 1
• Fix Priority: 2
• Git Pull Request: https://github.com/liferay-appsec/liferay-portal/pull/206

Steps to reproduce

1. Enable JAAS and set the authentication type to screen name

   portal.jaas.enable=true
   portal.jaas.auth.type=screenName
   

2. Start Liferay with JPDA (./catalina.sh jpda run, and attach a debugger
3. Add a logging breakpoint to MainServlet._loginUser which sets "remoteUser" to the screen name of a real user ("test") to simulate a successful login through JAAS that provides the correct login
4. Visit the portal

Expected behavior is that you are able to visit the portal as the user specified in step 3 (test) and there is no stack trace in the logs.

Actual behavior is that you get a stack trace.