cxf-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Steven Tippetts (JIRA)" <j...@apache.org>
Subject [jira] [Created] (CXF-4637) Exception when validating access token on a resource server (OAuth2)
Date Thu, 15 Nov 2012 23:19:12 GMT
Steven Tippetts created CXF-4637:
------------------------------------

             Summary: Exception when validating access token on a resource server (OAuth2)
                 Key: CXF-4637
                 URL: https://issues.apache.org/jira/browse/CXF-4637
             Project: CXF
          Issue Type: Bug
          Components: JAX-RS Security
    Affects Versions: 2.6.2
            Reporter: Steven Tippetts
            Priority: Blocker


When I set scopes and subject on a ServerAccessToken in getAccessToken on the OAuth2 server,
I get an exception on the resource server when it tries to validate the token in AccessTokenValidatorClient
at validateAccessToken.

Here is a snippet of code in the getAccessToken method:

1 List<OAuthPermission> scopes = new ArrayList<OAuthPermission>();
2 OAuthPermission p = new OAuthPermission();
3 List<String> v = new ArrayList<String>();
4 v.add("GET");
5 p.setHttpVerbs(v);
6 p.setPermission("read_test_info");
7 scopes.add(p);
8 token.setScopes(scopes);

If I comment line 5, then the exception doesn't happen.

Here is the exception:

[12/11/15 15:40:21:777] 0000000c Wr AbstractJAXBProvider: java.lang.UnsupportedOperationException
	at java.util.AbstractList.add(AbstractList.java:131)
	at java.util.AbstractList.add(AbstractList.java:91)
	at com.sun.xml.internal.bind.v2.runtime.reflect.Lister$CollectionLister.addToPack(Lister.java:290)
	at com.sun.xml.internal.bind.v2.runtime.reflect.Lister$CollectionLister.addToPack(Lister.java:254)
	at com.sun.xml.internal.bind.v2.runtime.unmarshaller.Scope.add(Scope.java:106)
	at com.sun.xml.internal.bind.v2.runtime.property.ArrayERProperty$ReceiverImpl.receive(ArrayERProperty.java:195)
	at com.sun.xml.internal.bind.v2.runtime.unmarshaller.UnmarshallingContext.endElement(UnmarshallingContext.java:524)
	at com.sun.xml.internal.bind.v2.runtime.unmarshaller.InterningXmlVisitor.endElement(InterningXmlVisitor.java:66)
	at com.sun.xml.internal.bind.v2.runtime.unmarshaller.StAXStreamConnector.handleEndElement(StAXStreamConnector.java:206)
	at com.sun.xml.internal.bind.v2.runtime.unmarshaller.StAXStreamConnector.bridge(StAXStreamConnector.java:170)
	at com.sun.xml.internal.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal0(UnmarshallerImpl.java:351)
	at com.sun.xml.internal.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal(UnmarshallerImpl.java:323)
	at org.apache.cxf.jaxrs.provider.JAXBElementProvider.unmarshalFromInputStream(JAXBElementProvider.java:257)
	at org.apache.cxf.jaxrs.provider.JAXBElementProvider.doUnmarshal(JAXBElementProvider.java:214)
	at org.apache.cxf.jaxrs.provider.JAXBElementProvider.readFrom(JAXBElementProvider.java:181)
	at org.apache.cxf.jaxrs.client.AbstractClient.readBody(AbstractClient.java:445)
	at org.apache.cxf.jaxrs.client.WebClient.handleResponse(WebClient.java:832)
	at org.apache.cxf.jaxrs.client.WebClient.doChainedInvocation(WebClient.java:816)
	at org.apache.cxf.jaxrs.client.WebClient.doInvoke(WebClient.java:743)
	at org.apache.cxf.jaxrs.client.WebClient.doInvoke(WebClient.java:717)
	at org.apache.cxf.jaxrs.client.WebClient.invoke(WebClient.java:344)
	at org.apache.cxf.jaxrs.client.WebClient.get(WebClient.java:469)
	at edu.byu.mtc.servicelayer.service.AccessTokenValidatorClient.validateAccessToken(AccessTokenValidatorClient.java:25)
	at edu.byu.mtc.servicelayer.service.AbstractAccessTokenValidator.getAccessTokenValidation(AbstractAccessTokenValidator.java:84)
	at edu.byu.mtc.servicelayer.service.OAuthRequestFilter.handleRequest(OAuthRequestFilter.java:34)

The problem is that the AbstractList is an empty collection, which I believe is from line
35 in OAuthPermission.java:

    private List<String> httpVerbs = Collections.emptyList();

If I change that line to this then the exception goes away:

    private List<String> httpVerbs = new ArrayList<String>();

This same fix needs to be made to line 36 in OAuthPermission.java and to line 34 in UserSubject.java.


--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira

Mime
View raw message