[WSS-636] CLONE - Password set to null in UsernameTokenValidator

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Won't Fix
• Affects Version/s: 2.2.2
• Component/s: WSS4J Core
• Labels: UsernameTokenValidator
• Environment: linux, cxf, jetty 6.10
• Assignee: Colm O hEigeartaigh
• Reporter: Bouke
• Created: 20/Nov/18 16:26
• Updated: 20/Nov/18 17:23
• Resolved: 20/Nov/18 17:23

Description

When trying to do basic authentication in Soap header with UserNameToken, token is well read from XML, but badly passed to password callback.
Line 165 of org.apache.ws.security.validate.UsernameTokenValidator :

WSPasswordCallback pwCb =
new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN, data);

The password is set to null, while it has been correcty read just before.
Proposed patch :

Index: src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
===================================================================
— src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java (révision 1098991)
+++ src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java (copie de travail)
@@ -163,7 +163,7 @@
boolean passwordsAreEncoded = usernameToken.getPasswordsAreEncoded();

WSPasswordCallback pwCb =

• new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
  + new WSPasswordCallback(user, password, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
  try
  Unknown macro: { data.getCallbackHandler().handle(new Callback[]{pwCb}); }

  catch (IOException e) {

Issue Links

• duplicates: WSS-281 Password set to null in UsernameTokenValidator
• is a clone of: WSS-281 Password set to null in UsernameTokenValidator