tree 4c33dcba8978c8362bcc5a3e5ef5b60b74de951f
parent df8b8ab0e60d3ae446a902af9762aaad89678db7
parent a710558854092a162161d8e66d1634b5831e1824
author Mike Jumper <mjumper@apache.org> 1566198679 -0700
committer GitHub <noreply@github.com> 1566198679 -0700
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJdWkuXCRBK7hj4Ov3rIwAAdHIIAFqHq9Q0HGXf7csM5n16zQIU
 2Fn2SxSx1ut/Ncut6zEU+/FTQUKLTemyZECaza5zUV76TMTLv5eXOTdbwzxS1gBK
 5/4VxHPM6+sX6WOoJMN43y7i1PMQ/UXrLs3KsoSYtwyacbl/aSqC72NlGsEWQBs5
 oC8EQ6uNNTvr+Z1VSZ74fsUO7CBlBb446xMF1hp2AP9ZLhtrRQXjzC00IoMOzSlK
 3p61bnQtB/Lt+BQ0Ns0FVouOTs/pV93s/Ged4w/rC+GzB+bcU6Dw4ArWxASHzjc7
 z758IAOKHbjVuJ0IQbKHtcAWDbYAsBa4WrpY6E4MMUiEvOnpjYrPf/Ln2vf2JIM=
 =nNuo
 -----END PGP SIGNATURE-----
 

GUACAMOLE-684: Merge changes giving tentative acceptance of credentials priority over complete refusal.

As described in the discussion surrounding the original pull request:

 * An extension throws `GuacamoleInsufficientCredentialsException`
   specifically to indicate tentative acceptance of the credentials
   passed thus far.
 * Just as such an extension that fully accepts credentials takes
   priority over an extension that refuses to accept the same, it makes
   sense to allow an extension that *tentatively* accepts those credentials
   to also take priority.

With the above perspective, authentication result priorities are as
follows, with ties broken by the inherent order of the auth providers:

 1. Acceptance (returning an `AuthenticedUser` instance).
 2. Tentative acceptance (throwing
    `GuacamoleInvalidCredentialsException`).
 3. Complete refusal (any other subclass of
    `GuacamoleCredentialsException`).
 4. Neither refusal nor acceptance (returning `null`).

See: https://github.com/apache/guacamole-client/pull/352