Password set to null in UsernameTokenValidator
----------------------------------------------
Key: WSS-281
URL: https://issues.apache.org/jira/browse/WSS-281
Project: WSS4J
Issue Type: Bug
Components: WSS4J Core
Affects Versions: 1.6
Environment: linux, cxf, jetty 6.10
Reporter: Nicolas Poirot
Assignee: Colm O hEigeartaigh
Fix For: 1.6.1
When trying to do basic authentication in Soap header with UserNameToken, token
is well read from XML, but badly passed to password callback.
Line 165 of org.apache.ws.security.validate.UsernameTokenValidator :
WSPasswordCallback pwCb =
new WSPasswordCallback(user, null, pwType,
WSPasswordCallback.USERNAME_TOKEN, data);
The password is set to null, while it has been correcty read just before.
Proposed patch :
Index: src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
===================================================================
--- src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
(révision 1098991)
+++ src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
(copie de travail)
@@ -163,7 +163,7 @@
boolean passwordsAreEncoded = usernameToken.getPasswordsAreEncoded();
WSPasswordCallback pwCb =
- new WSPasswordCallback(user, null, pwType,
WSPasswordCallback.USERNAME_TOKEN, data);
+ new WSPasswordCallback(user, password, pwType,
WSPasswordCallback.USERNAME_TOKEN, data);
try {
data.getCallbackHandler().handle(new Callback[]{pwCb});
} catch (IOException e) {
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
