[CXF-5864] Anonymous users are denied to call unprotected methods since 2.6.3

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.6.3
• Fix Version/s: 2.6.15, 2.7.12, 3.0.1
• Estimated Complexity: Unknown
• Assignee: Sergey Beryozkin
• Reporter: metatech
• Created: 09/Jul/14 10:04
• Updated: 16/Feb/15 16:09
• Resolved: 09/Jul/14 13:38

Description

Since CXF-4495 (contained in CXF 2.6.3), anonymous users are denied to call unprotected methods.
The method "handleMessage" of the class "AbstractAuthorizingInInterceptor" now checks that the UserPrincipal is not null.
Any call results now into a AccessDeniedException.

Caused by: org.apache.cxf.interceptor.security.AccessDeniedException: Unauthorized
	at org.apache.cxf.interceptor.security.AbstractAuthorizingInInterceptor.handleMessage(AbstractAuthorizingInInterceptor.java:57) ~[cxf-rt-core-2.6.3.jar:2.6.3]

Issue Links

• is broken by: CXF-4495 Extend SimpleAuthorizingInterceptor to check only configured roles