RemoteUserSSO bug

[Migrated From Jforum.net]

I'm about to implement my own SSO implementation, and I looked at net.jforum.sso.RemoteUserSSO. It seems to have a minor bug: all paths through isSessionValid() return false. I assume this is not the intent.

    public boolean isSessionValid(UserSession userSession, HttpServletRequest request) 
    {  
        String remoteUser = request.getRemoteUser();
      
        // user has since logged out
        if(remoteUser == null && userSession.getUserId() != SystemGlobals.getIntValue(ConfigKeys.ANONYMOUS_USER_ID)) {
            return false;
      
        // user has since logged in
        } else if(remoteUser != null && userSession.getUserId() == SystemGlobals.getIntValue(ConfigKeys.ANONYMOUS_USER_ID)) {
            return false;
   
        // user has changed user
        } else if(remoteUser != null && !remoteUser.equals(userSession.getUsername())) {
            return false;
        }
        return false;
   }

-- Scott Sauyet
[originally posted on jforum.net by scott_sauyet]

[Migrated From Jforum.net]

scott_sauyet wrote:net.jforum.sso.RemoteUserSSO [...] seems to have a minor bug: all paths through isSessionValid() return false.

I forgot to say this is from CVS HEAD.
[originally posted on jforum.net by scott_sauyet]