Repository: cxf Updated Branches: refs/heads/master ca69e7b43 -> ac61bc177
Make sure a Subject claim exists before setting up the JWT security context Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/ac61bc17 Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/ac61bc17 Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/ac61bc17 Branch: refs/heads/master Commit: ac61bc177c6dffc5c752e6e587ade22a27ad0480 Parents: ca69e7b Author: Colm O hEigeartaigh <[email protected]> Authored: Mon Dec 7 14:03:21 2015 +0000 Committer: Colm O hEigeartaigh <[email protected]> Committed: Mon Dec 7 14:03:37 2015 +0000 ---------------------------------------------------------------------- .../cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf/blob/ac61bc17/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java index 97c127d..50c6a13 100644 --- a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java +++ b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java @@ -73,7 +73,8 @@ public class JwtAuthenticationFilter extends AbstractJoseJwtConsumer implements // The token must be signed/verified with a public key to set up the security context, // unless we directly configure otherwise - if (isVerifiedWithAPublicKey(jwt) || enableUnsignedJwt) { + if (jwt.getClaims().getSubject() != null + && (isVerifiedWithAPublicKey(jwt) || enableUnsignedJwt)) { return new JwtTokenSecurityContext(jwt, roleClaim); } return null;
