[jira] [Created] (CXF-4776) UsernameTokenPolicyValidator does not validate that password is not provided.

["Jason Pell (JIRA)" <ji...@apache.org>]

Jason Pell created CXF-4776:
-------------------------------

             Summary: UsernameTokenPolicyValidator does not validate that password is not provided.
                 Key: CXF-4776
                 URL: https://issues.apache.org/jira/browse/CXF-4776
             Project: CXF
          Issue Type: Bug
          Components: WS-* Components
    Affects Versions: 2.7.2
            Reporter: Jason Pell


See my attached WS-Policy which I attached via @Policies annotation to Placement.BINDING_OPERATION_INPUT.

If I include an incorrect Password I get the expected authentication error.  If I actually remove the password I get no authentication failure.  The UsernameTokenPolicyValidator only checks that the username is provided.

I have a simple patch for this but would appreciate some weigh in from ws-policy cxf devs please.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira