Conversation
dceb97e to
f40e3be
Compare
|
!build Note: Target locations of links might be accessible only to IBM employees. |
|
!build Note: Target locations of links might be accessible only to IBM employees. |
Code analysis and actionsDO NOT DELETE THIS COMMENT.
|
1 similar comment
Code analysis and actionsDO NOT DELETE THIS COMMENT.
|
f40e3be to
cb06696
Compare
|
!build Note: Target locations of links might be accessible only to IBM employees. |
Code analysis and actionsDO NOT DELETE THIS COMMENT.
|
5cd014a to
0076d2c
Compare
|
!build Note: Target locations of links might be accessible only to IBM employees. |
Code analysis and actionsDO NOT DELETE THIS COMMENT.
|
a1a637c to
1b2e361
Compare
Before this fix, a JWT containing a realm value starting with a forward slash caused a NullPointerException inside AccessIdUtil.matcher() during authentication. The generic pattern `([^:]+):([^/]+)/(.+)` requires a non-empty, non-slash token before the first `/`, so it failed to match, returning null and triggering an NPE downstream. Changes: - AccessIdUtil: Replace single realmPattern with realmPatterns[] array, compiling one Pattern per registered realm using Pattern.quote(). This allows slash-containing realms to match exactly via the cached patterns before falling back to the generic ph/p patterns. - ServerCommonLoginModule: Guard WSPrincipal and WSCredential adds against null to produce a controlled auth failure instead of an unhandled NPE. - JwtPrincipalMappingTest: New unit tests confirming getRealm() returns the raw JWT realm claim verbatim (no stripping); slash handling belongs to AccessIdUtil, not JwtPrincipalMapping. - AccessIdUtilLeadingSlashRealmTest: New unit tests covering leading-slash, trailing-slash, internal-slash, multi-realm, and bootstrap fallback paths. - MPJwtLeadingSlashRealmTests: New FAT test class covering successful auth, realm preservation, and NPE-absence for slash variants. - FATSuite: Register MPJwtLeadingSlashRealmTests in the mpJwt-1.1 suite.
1b2e361 to
dec184d
Compare
|
!build Note: Target locations of links might be accessible only to IBM employees. |
Code analysis and actionsDO NOT DELETE THIS COMMENT.
|
wrodrig
changed the title
5ffcca3 to
361ce0d
Compare
|
!build Note: Target locations of links might be accessible only to IBM employees. |
… slashes in AccessIdUtil
361ce0d to
d452612
Compare
|
!build Note: Target locations of links might be accessible only to IBM employees. |
Code analysis and actionsDO NOT DELETE THIS COMMENT.
|
1 similar comment
Code analysis and actionsDO NOT DELETE THIS COMMENT.
|
|
!build Note: Target locations of links might be accessible only to IBM employees. |
Code analysis and actionsDO NOT DELETE THIS COMMENT.
|
|
!build Note: Target locations of links might be accessible only to IBM employees. |
|
!build |
Code analysis and actionsDO NOT DELETE THIS COMMENT.
|
|
!build Note: Target locations of links might be accessible only to IBM employees. |
Code analysis and actionsDO NOT DELETE THIS COMMENT.
|
|
!build Note: Target locations of links might be accessible only to IBM employees. |
|
!build Note: Target locations of links might be accessible only to IBM employees. |
Code analysis and actionsDO NOT DELETE THIS COMMENT.
|
1 similar comment
Code analysis and actionsDO NOT DELETE THIS COMMENT.
|
Drop multi-segment leading-slash realm support from the unregistered fallback path. The ps pattern reverts to (/[^/]+)/(.+), which handles exactly the customer-reported case where a JWT realm claim has a single leading slash (e.g. "/idbroker"). Multi-segment paths such as "/realm/subRealm" were never supported by the original code and are not part of the reported defect scope. - AccessIdUtil.java: ps simplified from greedy multi-segment pattern back to ([^:]+):(/[^/]+)/(.+) - AccessIdUtilLeadingSlashRealmTest.java: remove multi-segment unit tests; keep single-segment coverage - MPJwtLeadingSlashRealmTests.java: remove testLeadingSlashWithSubpath_authSucceeds
a8b4db0 to
cd98e8b
Compare
|
!build Note: Target locations of links might be accessible only to IBM employees. |
Code analysis and actionsDO NOT DELETE THIS COMMENT.
|
2 participants
A JWT realm claim with a leading or multi-segment slash (e.g. "/myrealm",
"/a/b") caused a NullPointerException because AccessIdUtil.matcher() returned
null, leaving a null WSCredential in sharedState that Subject.add() rejected.
AccessIdUtil: add per-realm quoted patterns for registered realms; replace
the single-segment fallback ps with a greedy variant that correctly splits
any unregistered leading-slash realm at the last slash.
ServerCommonLoginModule: guard WSCredential add against null.
Tests: unit tests for all slash variants; FAT tests for auth success and
realm value preservation.
I have considered the risk of behavior change or other zero migration impact (https://github.com/OpenLiberty/open-liberty/wiki/Behavior-Changes).
If this PR fixes an Issue, the description includes "Fixes #FILLMEIN" or "Resolves #FILLMEIN" (verify
release buglabel if applicable: https://github.com/OpenLiberty/open-liberty/wiki/Open-Liberty-Conventions).If this PR resolves an external Known Issue (including APARS), the description includes "Fixes #FILLMEIN" or "Resolves #FILLMEIN".