DO NOT REPLY [Bug 16144] New: - NullPointerException in JDBCRealm when password is null

[bugzilla]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=16144>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=16144

NullPointerException in JDBCRealm when password is null

           Summary: NullPointerException in JDBCRealm when password is null
           Product: Tomcat 4
           Version: 4.1.18
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: Minor
          Priority: Other
         Component: Catalina
        AssignedTo: [EMAIL PROTECTED]
        ReportedBy: [EMAIL PROTECTED]


My setup:

Tomcat 4.1.18 running behind Apache 2.0.40.8 (RedHat 8.0).  I use SSL on Apache
and use CoyoteConnector and mod_jk to connect httpd and tomcat.  I use basic
authentication on tomcat. I use Oracle 9.2 for my authentication db.

This setup works great, except I found one scenario where the JDBCRealm causes a
null pointer exception during Basic Authentication:

The user's password is "password" in the database.  If the user leaves the
password empty in the Basic Authentication Dialog (in IE or Netscape), nothing
is returned and the following exception occurs:


Ajp13Processor[8090][1] process: invoke
java.lang.NullPointerException
    at org.apache.catalina.realm.JDBCRealm.authenticate(JDBCRealm.java:447)
    at org.apache.catalina.realm.JDBCRealm.authenticate(JDBCRealm.java:394)
    at
org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:161)
    at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:525)
    at
org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:641)
    at
org.apache.catalina.valves.CertificatesValve.invoke(CertificatesValve.java:246)
    at
org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:641)
    at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:480)
    at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)
    at org.apache.catalina.core.StandardContext.invoke(StandardContext.java:2415)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:180)
    at
org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:643)
    at
org.apache.catalina.valves.ErrorDispatcherValve.invoke(ErrorDispatcherValve.java:170)
    at
org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:641)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:172)
    at
org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:641)
    at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:480)
    at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)
    at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:174)
    at
org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:643)
    at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:509)
    at
org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:641)
    at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:480)
    at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)
    at org.apache.ajp.tomcat4.Ajp13Processor.process(Ajp13Processor.java:458)
    at org.apache.ajp.tomcat4.Ajp13Processor.run(Ajp13Processor.java:551)
    at java.lang.Thread.run(Thread.java:536)

--
To unsubscribe, e-mail:   <mailto:[EMAIL PROTECTED]>
For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>