ws-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Bouke (JIRA)" <j...@apache.org>
Subject [jira] [Created] (WSS-636) CLONE - Password set to null in UsernameTokenValidator
Date Tue, 20 Nov 2018 16:27:01 GMT
Bouke created WSS-636:
-------------------------

             Summary: CLONE - Password set to null in UsernameTokenValidator
                 Key: WSS-636
                 URL: https://issues.apache.org/jira/browse/WSS-636
             Project: WSS4J
          Issue Type: Bug
          Components: WSS4J Core
    Affects Versions: 1.6
         Environment: linux, cxf, jetty 6.10
            Reporter: Bouke
            Assignee: Colm O hEigeartaigh


When trying to do basic authentication in Soap header with UserNameToken, token is well read
from XML, but badly passed to password callback.
Line 165 of org.apache.ws.security.validate.UsernameTokenValidator :

WSPasswordCallback pwCb = 
            new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN,
data);

The password is set to null, while it has been correcty read just before.
Proposed patch :


Index: src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
===================================================================
--- src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java	(révision 1098991)
+++ src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java	(copie de travail)
@@ -163,7 +163,7 @@
         boolean passwordsAreEncoded = usernameToken.getPasswordsAreEncoded();
         
         WSPasswordCallback pwCb = 
-            new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN,
data);
+            new WSPasswordCallback(user, password, pwType, WSPasswordCallback.USERNAME_TOKEN,
data);
         try {
             data.getCallbackHandler().handle(new Callback[]{pwCb});
         } catch (IOException e) {





--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org


Mime
View raw message