Fix null pointer exception when getting jwt validator based on the is…

…suer
wso2 · Apr 1, 2024 · cc9d84b · cc9d84b
1 parent 8e8879d
commit cc9d84b
Showing 1 changed file with 16 additions and 2 deletions.
diff --git a/...o2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/security/jwt/Oauth2Authenticator.java b/...o2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/security/jwt/Oauth2Authenticator.java
@@ -48,6 +48,7 @@
 import org.wso2.apk.enforcer.security.jwt.validator.JWTValidator;
 import org.wso2.apk.enforcer.security.jwt.validator.RevokedJWTDataHolder;
 import org.wso2.apk.enforcer.subscription.SubscriptionDataHolder;
+import org.wso2.apk.enforcer.subscription.SubscriptionDataStore;
 import org.wso2.apk.enforcer.server.RevokedTokenRedisClient;
 import org.wso2.apk.enforcer.tracing.TracingConstants;
 import org.wso2.apk.enforcer.tracing.TracingSpan;
@@ -472,8 +473,21 @@ private JWTValidationInfo getJwtValidationInfo(String jwtToken, String organizat
  try {
  // Get issuer
  String issuer = jwtClaimsSet.getIssuer();
- JWTValidator jwtValidator = SubscriptionDataHolder.getInstance().getSubscriptionDataStore(organization)
- .getJWTValidatorByIssuer(issuer, environment);
+ SubscriptionDataStore subscriptionDataStore = SubscriptionDataHolder.getInstance()
+ .getSubscriptionDataStore(organization);
+ if (subscriptionDataStore == null) {
+ throw new APISecurityException(APIConstants.StatusCodes.UNAUTHENTICATED.getCode(),
+ APISecurityConstants.API_AUTH_INVALID_CREDENTIALS,
+ APISecurityConstants.API_AUTH_INVALID_CREDENTIALS_MESSAGE);
+ }
+ JWTValidator jwtValidator = subscriptionDataStore.getJWTValidatorByIssuer(issuer, environment);
+ // If no validator found for the issuer, we are not caching the token.
+ if (jwtValidator == null) {
+ throw new APISecurityException(APIConstants.StatusCodes.UNAUTHENTICATED.getCode(),
+ APISecurityConstants.API_AUTH_INVALID_CREDENTIALS,
+ APISecurityConstants.API_AUTH_INVALID_CREDENTIALS_MESSAGE);
+ }
+
  // If no validator found for the issuer, we are not caching the token.
  if (jwtValidator == null) {
  throw new APISecurityException(APIConstants.StatusCodes.UNAUTHENTICATED.getCode(),