Disallow this by default
@@ -264,7 +264,7 @@ public class UsernameTokenInterceptor extends AbstractTokenInterceptor {
private boolean allowNamespaceQualifiedPWDTypes(final SoapMessage message) {
String allow = (String)message
.getContextualProperty(ConfigurationConstants.ALLOW_NAMESPACE_QUALIFIED_PASSWORD_TYPES);
- return !("false".equals(allow) || "0".equals(allow));
+ return "true".equals(allow) || "1".equals(allow);
}
private boolean isAllowNoPassword(AssertionInfoMap aim) throws WSSecurityException {
Collection<AssertionInfo> ais =
