You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ws.apache.org by "Nicolas Poirot (JIRA)" <ji...@apache.org> on 2011/05/03 12:03:03 UTC
[jira] [Created] (WSS-281) Password set to null in
UsernameTokenValidator
Password set to null in UsernameTokenValidator
----------------------------------------------
Key: WSS-281
URL: https://issues.apache.org/jira/browse/WSS-281
Project: WSS4J
Issue Type: Bug
Components: WSS4J Core
Affects Versions: 1.6
Environment: linux, cxf, jetty 6.10
Reporter: Nicolas Poirot
Assignee: Colm O hEigeartaigh
Fix For: 1.6.1
When trying to do basic authentication in Soap header with UserNameToken, token is well read from XML, but badly passed to password callback.
Line 165 of org.apache.ws.security.validate.UsernameTokenValidator :
WSPasswordCallback pwCb =
new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
The password is set to null, while it has been correcty read just before.
Proposed patch :
Index: src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
===================================================================
--- src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java (révision 1098991)
+++ src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java (copie de travail)
@@ -163,7 +163,7 @@
boolean passwordsAreEncoded = usernameToken.getPasswordsAreEncoded();
WSPasswordCallback pwCb =
- new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
+ new WSPasswordCallback(user, password, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
try {
data.getCallbackHandler().handle(new Callback[]{pwCb});
} catch (IOException e) {
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org
[jira] [Closed] (WSS-281) Password set to null in
UsernameTokenValidator
Posted by "Colm O hEigeartaigh (Closed) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-281?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Colm O hEigeartaigh closed WSS-281.
-----------------------------------
> Password set to null in UsernameTokenValidator
> ----------------------------------------------
>
> Key: WSS-281
> URL: https://issues.apache.org/jira/browse/WSS-281
> Project: WSS4J
> Issue Type: Bug
> Components: WSS4J Core
> Affects Versions: 1.6
> Environment: linux, cxf, jetty 6.10
> Reporter: Nicolas Poirot
> Assignee: Colm O hEigeartaigh
> Labels: UsernameTokenValidator
>
> When trying to do basic authentication in Soap header with UserNameToken, token is well read from XML, but badly passed to password callback.
> Line 165 of org.apache.ws.security.validate.UsernameTokenValidator :
> WSPasswordCallback pwCb =
> new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
> The password is set to null, while it has been correcty read just before.
> Proposed patch :
> Index: src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
> ===================================================================
> --- src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java (révision 1098991)
> +++ src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java (copie de travail)
> @@ -163,7 +163,7 @@
> boolean passwordsAreEncoded = usernameToken.getPasswordsAreEncoded();
>
> WSPasswordCallback pwCb =
> - new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
> + new WSPasswordCallback(user, password, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
> try {
> data.getCallbackHandler().handle(new Callback[]{pwCb});
> } catch (IOException e) {
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org
[jira] [Commented] (WSS-281) Password set to null in
UsernameTokenValidator
Posted by "Colm O hEigeartaigh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-281?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13028137#comment-13028137 ]
Colm O hEigeartaigh commented on WSS-281:
-----------------------------------------
This is not a bug. The job of the password callback is to supply a password to the validator for the given user, so why would it need to know the password that has been received?
Colm.
> Password set to null in UsernameTokenValidator
> ----------------------------------------------
>
> Key: WSS-281
> URL: https://issues.apache.org/jira/browse/WSS-281
> Project: WSS4J
> Issue Type: Bug
> Components: WSS4J Core
> Affects Versions: 1.6
> Environment: linux, cxf, jetty 6.10
> Reporter: Nicolas Poirot
> Assignee: Colm O hEigeartaigh
> Labels: UsernameTokenValidator
> Fix For: 1.6.1
>
>
> When trying to do basic authentication in Soap header with UserNameToken, token is well read from XML, but badly passed to password callback.
> Line 165 of org.apache.ws.security.validate.UsernameTokenValidator :
> WSPasswordCallback pwCb =
> new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
> The password is set to null, while it has been correcty read just before.
> Proposed patch :
> Index: src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
> ===================================================================
> --- src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java (révision 1098991)
> +++ src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java (copie de travail)
> @@ -163,7 +163,7 @@
> boolean passwordsAreEncoded = usernameToken.getPasswordsAreEncoded();
>
> WSPasswordCallback pwCb =
> - new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
> + new WSPasswordCallback(user, password, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
> try {
> data.getCallbackHandler().handle(new Callback[]{pwCb});
> } catch (IOException e) {
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org
[jira] [Resolved] (WSS-281) Password set to null in
UsernameTokenValidator
Posted by "Colm O hEigeartaigh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-281?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Colm O hEigeartaigh resolved WSS-281.
-------------------------------------
Resolution: Won't Fix
> Password set to null in UsernameTokenValidator
> ----------------------------------------------
>
> Key: WSS-281
> URL: https://issues.apache.org/jira/browse/WSS-281
> Project: WSS4J
> Issue Type: Bug
> Components: WSS4J Core
> Affects Versions: 1.6
> Environment: linux, cxf, jetty 6.10
> Reporter: Nicolas Poirot
> Assignee: Colm O hEigeartaigh
> Labels: UsernameTokenValidator
>
> When trying to do basic authentication in Soap header with UserNameToken, token is well read from XML, but badly passed to password callback.
> Line 165 of org.apache.ws.security.validate.UsernameTokenValidator :
> WSPasswordCallback pwCb =
> new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
> The password is set to null, while it has been correcty read just before.
> Proposed patch :
> Index: src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
> ===================================================================
> --- src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java (révision 1098991)
> +++ src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java (copie de travail)
> @@ -163,7 +163,7 @@
> boolean passwordsAreEncoded = usernameToken.getPasswordsAreEncoded();
>
> WSPasswordCallback pwCb =
> - new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
> + new WSPasswordCallback(user, password, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
> try {
> data.getCallbackHandler().handle(new Callback[]{pwCb});
> } catch (IOException e) {
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org
[jira] [Updated] (WSS-281) Password set to null in
UsernameTokenValidator
Posted by "Colm O hEigeartaigh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-281?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Colm O hEigeartaigh updated WSS-281:
------------------------------------
Fix Version/s: (was: 1.6.1)
> Password set to null in UsernameTokenValidator
> ----------------------------------------------
>
> Key: WSS-281
> URL: https://issues.apache.org/jira/browse/WSS-281
> Project: WSS4J
> Issue Type: Bug
> Components: WSS4J Core
> Affects Versions: 1.6
> Environment: linux, cxf, jetty 6.10
> Reporter: Nicolas Poirot
> Assignee: Colm O hEigeartaigh
> Labels: UsernameTokenValidator
>
> When trying to do basic authentication in Soap header with UserNameToken, token is well read from XML, but badly passed to password callback.
> Line 165 of org.apache.ws.security.validate.UsernameTokenValidator :
> WSPasswordCallback pwCb =
> new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
> The password is set to null, while it has been correcty read just before.
> Proposed patch :
> Index: src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
> ===================================================================
> --- src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java (révision 1098991)
> +++ src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java (copie de travail)
> @@ -163,7 +163,7 @@
> boolean passwordsAreEncoded = usernameToken.getPasswordsAreEncoded();
>
> WSPasswordCallback pwCb =
> - new WSPasswordCallback(user, null, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
> + new WSPasswordCallback(user, password, pwType, WSPasswordCallback.USERNAME_TOKEN, data);
> try {
> data.getCallbackHandler().handle(new Callback[]{pwCb});
> } catch (IOException e) {
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org