Hi all,
I think that we have found a bug working with setIdentity and clearIdentity from session manager. I have a Spring application that works with a SessionManager as an instance variable. This instance variable dispatch sessions based on this:
final String ticket = this.getTicketForUser(loggedUser); // just get a valid ticket with superuser credentials
final IDfLoginInfo li = this.cx.getLoginInfo();
li.setUser(loggedUser);
li.setPassword(ticket);
if (this.helpSessionMgr.hasIdentity(this.repository)) {
this.helpSessionMgr.clearIdentity(this.repository);
}
this.helpSessionMgr.setIdentity(this.repository, li);
return this.helpSessionMgr.getSession(this.repository);
where the helpSessionMgr is the instance variable of a singleton.
All seems ok. When I try to launch a DQL over a custom type that is secured with ACL's (for example select * from my_type where r_object_id='blablabla'), the DFC automatically adds the information about security: r_accesor_name and so on... The problem is that it seems that the accesor name is not cleared from the previous user who used the session from pool. So the first user using the session from pool works ok, but the second one doesn't, because in the final SQL (captured with a listener) there is information about the previous user.
Could anybody help? Tx in advance
M.
