ws-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Colm O hEigeartaigh (Closed) (JIRA)" <j...@apache.org>
Subject [jira] [Closed] (WSS-281) Password set to null in UsernameTokenValidator
Date Mon, 03 Oct 2011 09:04:40 GMT

     [ https://issues.apache.org/jira/browse/WSS-281?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Colm O hEigeartaigh closed WSS-281.
-----------------------------------

    
> Password set to null in UsernameTokenValidator
> ----------------------------------------------
>
>                 Key: WSS-281
>                 URL: https://issues.apache.org/jira/browse/WSS-281
>             Project: WSS4J
>          Issue Type: Bug
>          Components: WSS4J Core
>    Affects Versions: 1.6
>         Environment: linux, cxf, jetty 6.10
>            Reporter: Nicolas Poirot
>            Assignee: Colm O hEigeartaigh
>              Labels: UsernameTokenValidator
>
> When trying to do basic authentication in Soap header with UserNameToken, token is well
read from XML, but badly passed to password callback.
> Line 165 of org.apache.ws.security.validate.UsernameTokenValidator :
> WSPasswordCallback pwCb = 
>             new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN,
data);
> The password is set to null, while it has been correcty read just before.
> Proposed patch :
> Index: src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
> ===================================================================
> --- src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java	(révision
1098991)
> +++ src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java	(copie
de travail)
> @@ -163,7 +163,7 @@
>          boolean passwordsAreEncoded = usernameToken.getPasswordsAreEncoded();
>          
>          WSPasswordCallback pwCb = 
> -            new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN,
data);
> +            new WSPasswordCallback(user, password, pwType, WSPasswordCallback.USERNAME_TOKEN,
data);
>          try {
>              data.getCallbackHandler().handle(new Callback[]{pwCb});
>          } catch (IOException e) {

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org


Mime
View raw message