Enh 38188656 - [38068862->25.09] Do not log an unnecessary message when an access controller fails to verify a subject

(merge main -> ce/main 117371)

[git-p4: depot-paths = "//dev/coherence-ce/main/": change = 117372]

Author: thegridman

prj/coherence-core-components/src/main/java/com/tangosol/coherence/component/net/security/Standard.java

@@ -269,7 +269,7 @@ public void checkPermission(com.tangosol.net.Cluster cluster, com.tangosol.net.C
             {
             try
                 {
-                validateSubject(sService, subject);
+                validateSubject(sService, subject, false);
                 fValid = true;
                 }
             catch (SecurityException ex)
@@ -289,7 +289,7 @@ public void checkPermission(com.tangosol.net.Cluster cluster, com.tangosol.net.C
 
         if (!fValid)
             {
-            validateSubject(sService, subject);
+            validateSubject(sService, subject, true);
             }
 
         // TODO: leave the audit trail?
@@ -680,10 +680,18 @@ private void setValidSubjects(java.util.Map cache)
      */
     protected void validateSubject(String sService, javax.security.auth.Subject subject)
         {
-        // import com.tangosol.net.security.AccessController as com.tangosol.net.security.AccessController;
-        // import java.util.Map;
-        // import javax.security.auth.Subject;
-        
+        validateSubject(sService, subject, true);
+        }
+
+    /**
+     * Prevent a security hole when a caller would construct a Subject object
+    * with a Principal object that have a high security clearance, but provide
+    * a valid cerificate representing a low security clearance Principal. The
+    * very first validated subject becomes assosiated with the specified
+    * service.
+     */
+    protected void validateSubject(String sService, javax.security.auth.Subject subject, boolean fLog)
+        {
         Map mapValid = getValidSubjects();
 
         if (!mapValid.containsKey(subject))
@@ -699,7 +707,10 @@ protected void validateSubject(String sService, javax.security.auth.Subject subj
                 }
             catch (Exception e)
                 {
-                _trace("Failed to verify the subject: " + subject + " due to: " + e.getMessage(), 3);
+                if (fLog)
+                    {
+                    _trace("Failed to verify the subject: " + subject + " due to: " + e.getMessage(), 3);
+                    }
                 throw new SecurityException("Failed to verify the subject");
                 }
             }