JWS weird Authentication deadlock on HttpUrlConnection with response 401

Question

Right after writing it all down (offline), I found the *bug here* just before posting.
I'll post it anyway as it was, 'cause it costed me time and this won't be wasted if it comes usefull for someone else.
The only pending questions are: does anybody know a workaround for the bug? And why does this only happen when having a dedicated thread and not running in EventDispatcher?
Do you think posting in Swing forum may be usefull to get a solution with connection running in EventDispatcher and another thread listening for button pressure?
And, now, here it is what I wrote at first:
I have a simple SwingWorker testing credentials on a SSO connection (I've tried with my own Thread code also), everything works fine on standard jre (with standard java.net implementation), but on JWS I'm getting this weird lock:
"SwingWorker-pool-1-thread-3" prio=6 tid=0x031f1400 nid=0x130 in Object.wait() [0x0344f000..0x0344fc94]
   java.lang.Thread.State: WAITING (on object monitor)
     at java.lang.Object.wait(Native Method)
     - waiting on <0x23169bc0> (a java.util.HashMap)
     at java.lang.Object.wait(Object.java:485)
     at sun.net.www.protocol.http.AuthenticationInfo.requestIsInProgress(Unknown Source)
     - locked <0x23169bc0> (a java.util.HashMap)
     at sun.net.www.protocol.http.AuthenticationInfo.getServerAuth(Unknown Source)
     at sun.net.www.protocol.http.HttpURLConnection.getServerAuthentication(Unknown Source)
     at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
     - locked <0x22a0e668> (a sun.net.www.protocol.https.DelegateHttpsURLConnection)
     at sun.net.www.protocol.http.HttpURLConnection.getHeaderFields(Unknown Source)
     at sun.net.www.protocol.https.HttpsURLConnectionImpl.getHeaderFields(Unknown Source)
     at my class reading header for cookies to setI also get stack if I try reading response code (requestIsInProgress should be meaningfull about this).
Everything goes fine until request successeds, I have problems when server returns 401, first test ends correctly: I throw an exception telling me 'login failed, wrong username or password, check credentials' and this gets written in my result area.
But something gets locked in the Authentication infrastructure, than on, if I test again with wrong credentials it freezes waiting, If I test with right credential everything is fine ('cause it doesn't ask for Auth).
I've got my own Authenticator because on my SSO server I must return null (jws doesn't manage correctly SSO auth), but I wanna keep asking for proxy credentials, I though it could be it and went back to default one (and to null one), nothing changed (except annoying, not working, authentication mask).
Everything works fine if I use a single thread solution, but this means everything gets done in EventDispatcher and can't be stopped, I don't want it like this.
I've notice this other thing: if I call notifyAll at the and of done() method it goes fine on standard JRE, but I get IllegalMonitorState in JWS.
There's just one instance running, anyhow the connection code itself is multithread tested (I've run thousands at same time to test server-load).
Connection goes like this (everything in HTTPS):
- ask for homepage: it is under SSO, so i get a MOVED and destination url contains an SSO token
- read destination url and go there adding username and password (I'm using GET, final version will use POST for security reasons): i get a MOVED to login success page and go there to 'activate' SSO session and get my cookie OR (wrong credentials) I get 401, that is my problem. I can even get MOVED to other url (having account locked or other SSO error), this has no impact on my problem, just reporting to assure you problem is just as described.
Obviously homepage request goes always fine, you just get stack on second part when getting 401 for second time, 'cause first one left a resource locked.
Any suggestions?
Here is SwingWorker code (test is a button, connection is a pointer to SwingWorker I keep to know if it's running, risultato is a textarea where I write the test result, BaseMessages retrieves i18n messages):
     test.addActionListener(new ActionListener(){
         public void actionPerformed(ActionEvent e) {
          if (connection!=null&&!connection.isDone()){
              connection.cancel(true);connection=null;return;
           connection = new SwingWorker<String, Object>(){
              protected String doInBackground() throws Exception {
               //my method creating SSO connection (it then invokes a servlet that just mirrors username to prove authentication)
               return new ClientUpload(getUsername(), getPassword()).testConnection();
              protected void done() {
                  super.done();
                  try {
                   risultato.setText(get());
               } catch (InterruptedException e) {
                   risultato.setText(BaseMessages.getMessage("test.cancelled"));
               } catch (CancellationException e) {
                   risultato.setText(BaseMessages.getMessage("test.cancelled"));
               } catch (ExecutionException e) {
                   e.printStackTrace();
                   risultato.setText(BaseMessages.getMessage("test.error")+ e.getMessage());
               risultato.repaint();
               test.setText(BaseMessages.getMessage("test"));
               test.setIcon(testIcon);
               setCursor(Cursor.getDefaultCursor());
               connection=null;
               //notifyAll();
          setCursor(Cursor.getPredefinedCursor(Cursor.WAIT_CURSOR));
          risultato.setText(BaseMessages.getMessage("connecting"));
          test.setText(BaseMessages.getMessage("test.cancel"));
          test.setIcon(stopIcon);
          connection.execute();
     });What's wrong? Why doesn't single thread solution produce deadlock the same? Which object does jws java.net implementation lock (I tried calling notifyAll on everything)? Anyone having sun.net.www.protocol.http source code?
Please help, I'm really java disappointed at this time (first big 'Write once, run only where written!' of my programmer life).
P.S.: I tried both with and without Keep-Alive. And tried moving super.done() at the end of method.

Answer 1

I got it! It works for most cases (it works for mine for sure, doesn't work if you're talking with many servers, I suppose), may be refined (for multi-thread, multi-server, etc..). After getting response code 401 (in the connection code I did not post) I just call:
try {
    Field f= Class.forName("sun.net.www.protocol.http.AuthenticationInfo").getDeclaredField("requests");
    f.setAccessible(true);
    HashMap hm=(HashMap)f.get(null);
    hm.clear();
} catch (Exception e) {
    e.printStackTrace();
}I really love reflection.
I also tried invoking notifyAll an AuthenticationInfo, requests and objects in it, but nothing worked (except submitted code).
I'll leave a Duke on it (were seven, sorry), may be someone has better ideas.