[CXF-6984] OAuthJSonProvider mixes expirytime and issuer in writeTokenIntrospection.

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.1.6
• Fix Version/s: 3.1.8, 3.2.0
• Component/s: JAX-RS Security
• Estimated Complexity: Unknown
• Assignee: Sergey Beryozkin
• Reporter: Svein Otto Solem
• Created: 01/Aug/16 09:47
• Updated: 21/Oct/16 18:45
• Resolved: 02/Aug/16 12:04

Description

Checks that Issuer is nonnull but outputs expiry value instead of issuer.

org.apache.cxf.rs.security.oauth2.provider.OAuthJSONProvider.java

// From line 116, version 3.1.6 
if (obj.getIss() != null) {
  sb.append(",");
  appendJsonPair(sb, "iss", obj.getExp(), false); // Wrong value, shoud be obj.getIss()
}