[CXF-4776] UsernameTokenValidator do not validate that password is not provided.

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.5.8, 2.6.5, 2.7.2
• Fix Version/s: 2.5.9, 2.6.6, 2.7.3
• Component/s: WS-* Components
• Estimated Complexity: Unknown
• Assignee: Jason Pell
• Reporter: Jason Pell
• Created: 24/Jan/13 01:43
• Updated: 28/Feb/13 17:27
• Resolved: 25/Jan/13 10:53

Description

This is an issue for both WS-Policy and WSS4JInInterceptor configuration.

If I include an incorrect Password I get the expected authentication error. If I actually remove the password I get no authentication failure. The UsernameTokenValidator only checks that the username is provided.