Enh 38188654 - [38068862->22.06.14] Do not log an unnecessary message when an access controller fails to verify a subject

(merge 14.1.1.2206 -> ce/22.06 117378)

[git-p4: depot-paths = "//dev/coherence-ce/release/coherence-ce-v22.06/": change = 117380]

Author: thegridman

prj/coherence-core-components/src/main/java/com/tangosol/coherence/component/net/security/Standard.java

@@ -1,6 +1,6 @@
 
 /*
- * Copyright (c) 2000, 2023, Oracle and/or its affiliates.
+ * Copyright (c) 2000, 2025, Oracle and/or its affiliates.
  *
  * Licensed under the Universal Permissive License v 1.0 as shown at
  * https://oss.oracle.com/licenses/upl.
@@ -271,7 +271,7 @@ public void checkPermission(com.tangosol.net.Cluster cluster, com.tangosol.net.C
             {
             try
                 {
-                validateSubject(sService, subject);
+                validateSubject(sService, subject, false);
                 fValid = true;
                 }
             catch (SecurityException ex)
@@ -291,7 +291,7 @@ public void checkPermission(com.tangosol.net.Cluster cluster, com.tangosol.net.C
 
         if (!fValid)
             {
-            validateSubject(sService, subject);
+            validateSubject(sService, subject, true);
             }
 
         // TODO: leave the audit trail?
@@ -685,10 +685,18 @@ private void setValidSubjects(java.util.Map cache)
      */
     protected void validateSubject(String sService, javax.security.auth.Subject subject)
         {
-        // import com.tangosol.net.security.AccessController as com.tangosol.net.security.AccessController;
-        // import java.util.Map;
-        // import javax.security.auth.Subject;
-        
+        validateSubject(sService, subject, true);
+        }
+
+    /**
+     * Prevent a security hole when a caller would construct a Subject object
+    * with a Principal object that have a high security clearance, but provide
+    * a valid cerificate representing a low security clearance Principal. The
+    * very first validated subject becomes assosiated with the specified
+    * service.
+     */
+    protected void validateSubject(String sService, javax.security.auth.Subject subject, boolean fLog)
+        {
         Map mapValid = getValidSubjects();
 
         if (!mapValid.containsKey(subject))
@@ -704,7 +712,10 @@ protected void validateSubject(String sService, javax.security.auth.Subject subj
                 }
             catch (Exception e)
                 {
-                _trace("Failed to verify the subject: " + subject + " due to: " + e.getMessage(), 3);
+                if (fLog)
+                    {
+                    _trace("Failed to verify the subject: " + subject + " due to: " + e.getMessage(), 3);
+                    }
                 throw new SecurityException("Failed to verify the subject");
                 }
             }