wrong Username/Passwords pass when in text mode?

[Rami Jaamour <rj...@parasoft.com>]

It appears to me that WSS4J is now letting requests with the wrong 
username/password pass through if the password was text (not digested)! 
Take a look at WSSecurityEngine.handleUsernameToken():

All the username and password stuff are wrapped in

if (ut.isHashed()) {
...
}

but there is no case for when it is not hashed.

I attached a possible fix for your review before I commit it, please.  I 
am also having it return a failed authentication if PWCallBack returned 
a null password for the given username to increase security so WSS4J 
does not reveal the fact that a username does not exist.

-- 

Rami Jaamour
Software Engineer
Web Services Solutions
Parasoft Corporation

"We Make Software Work"