[WSS-281] Password set to null in UsernameTokenValidator

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 1.6
• Component/s: WSS4J Core
• Labels: UsernameTokenValidator
• Environment: linux, cxf, jetty 6.10
• Assignee: Colm O hEigeartaigh
• Reporter: Nicolas Poirot
• Created: 03/May/11 10:02
• Updated: 20/Nov/18 16:47
• Resolved: 26/Jul/11 09:04

Description

When trying to do basic authentication in Soap header with UserNameToken, token is well read from XML, but badly passed to password callback.
Line 165 of org.apache.ws.security.validate.UsernameTokenValidator :

WSPasswordCallback pwCb =
new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN, data);

The password is set to null, while it has been correcty read just before.
Proposed patch :

Index: src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
===================================================================
— src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java (révision 1098991)
+++ src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java (copie de travail)
@@ -163,7 +163,7 @@
boolean passwordsAreEncoded = usernameToken.getPasswordsAreEncoded();

WSPasswordCallback pwCb =

• new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
  + new WSPasswordCallback(user, password, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
  try
  Unknown macro: { data.getCallbackHandler().handle(new Callback[]{pwCb}); }

  catch (IOException e) {

Issue Links

• is cloned by: WSS-636 CLONE - Password set to null in UsernameTokenValidator
• is duplicated by: WSS-636 CLONE - Password set to null in UsernameTokenValidator