[jboss-jira] [JBoss JIRA] (SECURITY-897) Unable to authenticate in SPNEGO Login Module with NullPointerException

Unable to authenticate in SPNEGO Login Module with NullPointerException ----------------------------------------------------------------------- Key: SECURITY-897 URL: https://issues.jboss.org/browse/SECURITY-897 Project: PicketBox Issue Type: Bug Components: Negotiation Affects Versions: Negotiation_2_3_6_Final Environment: Red Hat JBoss EAP 6.3.2 Reporter: Kunjan Rathod Assignee: Chao Wang Labels: jboss, jboss-as Fix For: Negotiation_3_0_0_Final Description of problem: The configuration with SPNEGO works fine, however from time to time the authentication fails with the following error: ERROR (HTTP-341) [org.jboss.security.auth.spi.AbstractServerLoginModule] Unable to authenticate: java.lang.NullPointerException at org.jboss.security.negotiation.spnego.SPNEGOLoginModule$AcceptSecContext.run(SPNEGOLoginModule.java:420) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAs(Subject.java:356) Version-Release number of selected component (if applicable): JBoss Security Negotiation 2.3.3.Final How reproducible: This happens very rarely (20 times in a day on a system where about 50 users are working) and it is extremely hard to reproduce. Additional info: At line 420 in [1], the GSSToken is null ~~~~ if (respToken != null) { NegotiationMessage response; if (requestMessage instanceof KerberosMessage) { response = new KerberosMessage(Constants.KERBEROS_V5, respToken); } else { NegTokenTarg negTokenTarg = new NegTokenTarg(); negTokenTarg.setResponseToken(respToken); response = negTokenTarg; } ~~~~ It looks like a GSSToken can be or is null, check the line#344 as follows:- ~~~~~~~~~ public Object run() { try { // The message type will have already been checked before this point so we know it is // a SPNEGO message. NegotiationMessage requestMessage = negotiationContext.getRequestMessage(); // TODO - Ensure no way to fall through with gssToken still null. byte[] gssToken = null; if (requestMessage instanceof NegTokenInit) { ... ~~~~~~~~~ [1] : https://github.com/wildfly-security/jboss-negotiation/blob/2.3.3.Final/jb...