Repository: cxf Updated Branches: refs/heads/3.1.x-fixes 4c687895d -> 14e7cea44
Make sure a Subject claim exists before setting up the JWT security context Project: http://git-wip-us.apache.org/repos/asf/cxf/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/14e7cea4 Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/14e7cea4 Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/14e7cea4 Branch: refs/heads/3.1.x-fixes Commit: 14e7cea440d7492d4f59584394162d593ec6ec69 Parents: 4c68789 Author: Colm O hEigeartaigh <[email protected]> Authored: Mon Dec 7 14:03:21 2015 +0000 Committer: Colm O hEigeartaigh <[email protected]> Committed: Mon Dec 7 14:06:35 2015 +0000 ---------------------------------------------------------------------- .../cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf/blob/14e7cea4/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java ---------------------------------------------------------------------- diff --git a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java index 97c127d..50c6a13 100644 --- a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java +++ b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java @@ -73,7 +73,8 @@ public class JwtAuthenticationFilter extends AbstractJoseJwtConsumer implements // The token must be signed/verified with a public key to set up the security context, // unless we directly configure otherwise - if (isVerifiedWithAPublicKey(jwt) || enableUnsignedJwt) { + if (jwt.getClaims().getSubject() != null + && (isVerifiedWithAPublicKey(jwt) || enableUnsignedJwt)) { return new JwtTokenSecurityContext(jwt, roleClaim); } return null;
