[RAMPART-225] SupportingToken UsernameToken is always encrypted

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.4
• Fix Version/s: 1.5.1
• Component/s: rampart-core
• Assignee: Don Samisa Abeysinghe
• Reporter: Diego Tognola
• Created: 21/Apr/09 04:16
• Updated: 11/Feb/11 12:25
• Resolved: 21/Dec/10 23:19

Description

If no encryption is specified in the policy file and UsernameToken is used as supporting token, then this token is always encrypted. org.apache.rampart.builder.BindingBuilder.handleSupportingTokens(RampartMessageData, SupportingToken) does not check if UsernameToken is an encrypted token and unconditionally adds it to the encryptedTokensIdList.

This can be easily fixed by modifying line 383 (as per src release 1.4) from

encryptedTokensIdList.add(utBuilder.getId());

to

if (suppTokens.isEncryptedToken())

{ encryptedTokensIdList.add(utBuilder.getId()); }