[keycloak-dev] servlet-filter-adapter Principal NPE

[Harold Campbell]

The servlet-filter-adapter causes an NPE when a user authed either
through Basic or Bearer attempts to retrieve the Principal from the
HttpServletRequest. This is because completeBearerAuthentication,
unlike completeOAuthAuthentication, does not add an OidcKeycloakAccount
to the session. If a user is authed via OAuth, everything works fine.

The attached patch against 1.8.x takes care of the problem. It appears
the same problem exists in master, though with files moved around the
patch will not apply directly. This patch makes completeBearer...
essentially identical to completeOAuth..., so for 1.9.x (or indeed
1.8.x if someone wants to redo this) these might oughta be combined
into a single method.

-- 
Harold Campbell <hcamp at muerte.net>



The more data I punch in this card, the lighter it becomes, and the
lower the mailing cost.
		-- S. Kelly-Bootle, "The Devil's DP Dictionary"
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-servlet-filter-adapter-completeBearerAuthentication-.patch
Type: text/x-patch
Size: 2643 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-dev/attachments/20160202/357a59f9/attachment-0001.bin