cxf-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From cohei...@apache.org
Subject cxf git commit: Make sure a Subject claim exists before setting up the JWT security context
Date Mon, 07 Dec 2015 14:07:18 GMT
Repository: cxf
Updated Branches:
  refs/heads/3.1.x-fixes 4c687895d -> 14e7cea44


Make sure a Subject claim exists before setting up the JWT security context


Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/14e7cea4
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/14e7cea4
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/14e7cea4

Branch: refs/heads/3.1.x-fixes
Commit: 14e7cea440d7492d4f59584394162d593ec6ec69
Parents: 4c68789
Author: Colm O hEigeartaigh <coheigea@apache.org>
Authored: Mon Dec 7 14:03:21 2015 +0000
Committer: Colm O hEigeartaigh <coheigea@apache.org>
Committed: Mon Dec 7 14:06:35 2015 +0000

----------------------------------------------------------------------
 .../cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java       | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/cxf/blob/14e7cea4/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
index 97c127d..50c6a13 100644
--- a/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
+++ b/rt/rs/security/jose-parent/jose-jaxrs/src/main/java/org/apache/cxf/rs/security/jose/jaxrs/JwtAuthenticationFilter.java
@@ -73,7 +73,8 @@ public class JwtAuthenticationFilter extends AbstractJoseJwtConsumer implements
         
         // The token must be signed/verified with a public key to set up the security context,

         // unless we directly configure otherwise
-        if (isVerifiedWithAPublicKey(jwt) || enableUnsignedJwt) {
+        if (jwt.getClaims().getSubject() != null 
+            && (isVerifiedWithAPublicKey(jwt) || enableUnsignedJwt)) {
             return new JwtTokenSecurityContext(jwt, roleClaim);
         }
         return null;


Mime
View raw message