Possible Bug in Token Random Numbers

2008-10-27 07:59:45,567 http-8095-Processor24 DEBUG [service.soap.xfire.XFireInLoggingMethodHandler] SOAP service method: isValidPrincipalToken
	com.atlassian.crowd.integration.authentication.AuthenticatedToken@4dff28[name=xxx,token=yyy]
	kkk
	com.atlassian.crowd.integration.authentication.ValidationFactor@aad19e[name=remote_address,value=bbb]
	com.atlassian.crowd.integration.authentication.ValidationFactor@a7efe7[name=User-Agent,value=Jakarta Commons-HttpClient/3.0.1]
	
2008-10-27 07:59:45,567 http-8095-Processor24 DEBUG [crowd.service.soap.SOAPService] validating license key
2008-10-27 07:59:45,567 http-8095-Processor24 DEBUG [crowd.service.soap.SOAPService] validating application token: yyy
2008-10-27 07:59:45,567 http-8095-Processor24 DEBUG [crowd.manager.application.ApplicationServiceGeneric] genericValidateToken
2008-10-27 07:59:45,567 http-8095-Processor24 DEBUG [crowd.model.token.TokenDAOHibernate] About to findByKey(yyy)
2008-10-27 07:59:45,568 http-8095-Processor24 DEBUG [atlassian.crowd.authentication.TokenKeyGeneratorImpl] Generating Token for principal: xxx
2008-10-27 07:59:45,568 http-8095-Processor24 DEBUG [atlassian.crowd.authentication.TokenKeyGeneratorImpl] Adding remote address of aaa
2008-10-27 07:59:45,568 http-8095-Processor24 DEBUG [atlassian.crowd.authentication.TokenKeyGeneratorImpl] Adding remote_host of com.atlassian.crowd.integration.authentication.ValidationFactor@4a7d83[name=remote_host,value=aaa]
2008-10-27 07:59:45,568 http-8095-Processor24 DEBUG [atlassian.crowd.authentication.TokenKeyGeneratorImpl] Adding NAME of com.atlassian.crowd.integration.authentication.ValidationFactor@763d40[name=NAME,value=bbb]
2008-10-27 07:59:45,568 http-8095-Processor24 DEBUG [atlassian.crowd.authentication.TokenKeyGeneratorImpl] Adding Random-Number of com.atlassian.crowd.integration.authentication.ValidationFactor@af51b5[name=Random-Number,value=5596922776887921685]
2008-10-27 07:59:45,568 http-8095-Processor24 DEBUG [crowd.manager.application.ApplicationServiceGeneric] Current Validation Factors: 
com.atlassian.crowd.integration.authentication.ValidationFactor@1d7096[name=remote_address,value=aaa]com.atlassian.crowd.integration.authentication.ValidationFactor@4a7d83[name=remote_host,value=aaa]com.atlassian.crowd.integration.authentication.ValidationFactor@763d40[name=NAME,value=bbb]
2008-10-27 07:59:45,568 http-8095-Processor24 DEBUG [crowd.manager.application.ApplicationServiceGeneric] comparing existing token com.atlassian.crowd.model.token.Token@3df90[ID=3244198,key=yyy,name=bbb,secretNumber=5596922776887921685,Directory ID=-1] with a validation token com.atlassian.crowd.model.token.Token@ca9e7a[ID=0,key=yyy,name=bbb,secretNumber=5596922776887921685,Directory ID=-1]
2008-10-27 07:59:45,568 http-8095-Processor24 DEBUG [crowd.manager.application.ApplicationServiceGeneric] they match
2008-10-27 07:59:45,568 http-8095-Processor24 DEBUG [crowd.manager.application.ApplicationServiceGeneric] checking if the token is expired:
2008-10-27 07:59:45,568 http-8095-Processor24 DEBUG [crowd.manager.application.ApplicationServiceGeneric] 	now: 			1225090785568
2008-10-27 07:59:45,569 http-8095-Processor24 DEBUG [crowd.manager.application.ApplicationServiceGeneric] 	last accessed: 	1225090785539
2008-10-27 07:59:45,569 http-8095-Processor24 DEBUG [crowd.manager.application.ApplicationServiceGeneric] 	difference: 	29
2008-10-27 07:59:45,569 http-8095-Processor24 DEBUG [crowd.manager.application.ApplicationServiceGeneric] 	allowed elapse: 432000000
2008-10-27 07:59:45,569 http-8095-Processor24 DEBUG [crowd.manager.application.ApplicationServiceGeneric] returning validated token, with updated last accessed time
2008-10-27 07:59:45,569 http-8095-Processor24 DEBUG [crowd.model.token.TokenDAOHibernate] About to update(com.atlassian.crowd.model.token.Token@3df90[ID=3244198,key=yyy,name=bbb,secretNumber=5596922776887921685,Directory ID=-1])
2008-10-27 07:59:45,569 http-8095-Processor24 DEBUG [util.persistence.hibernate.HibernateDao] Updating object: com.atlassian.crowd.model.token.Token@3df90[ID=3244198,key=yyy,name=bbb,secretNumber=5596922776887921685,Directory ID=-1]
2008-10-27 07:59:45,569 http-8095-Processor24 DEBUG [crowd.model.token.TokenDAOHibernate] Completed update(com.atlassian.crowd.model.token.Token@3df90[ID=3244198,key=yyy,name=bbb,secretNumber=5596922776887921685,Directory ID=-1])
2008-10-27 07:59:45,569 http-8095-Processor24 DEBUG [crowd.service.soap.SOAPService] loading application: bbb
2008-10-27 07:59:45,569 http-8095-Processor24 DEBUG [crowd.service.soap.SOAPService] Client address: aaa
2008-10-27 07:59:45,569 http-8095-Processor24 DEBUG [crowd.service.soap.SOAPService] Client host: aaaa
2008-10-27 07:59:45,570 http-8095-Processor24 DEBUG [crowd.manager.application.ApplicationServiceGeneric] validateToken: token kkk
2008-10-27 07:59:45,570 http-8095-Processor24 DEBUG [crowd.manager.application.ApplicationServiceGeneric] genericValidateToken
2008-10-27 07:59:45,570 http-8095-Processor24 DEBUG [crowd.model.token.TokenDAOHibernate] About to findByKey(kkk)
2008-10-27 07:59:45,571 http-8095-Processor24 DEBUG [atlassian.crowd.authentication.TokenKeyGeneratorImpl] Generating Token for principal: bamboo
2008-10-27 07:59:45,571 http-8095-Processor24 DEBUG [atlassian.crowd.authentication.TokenKeyGeneratorImpl] Adding User-Agent of com.atlassian.crowd.integration.authentication.ValidationFactor@a7efe7[name=User-Agent,value=Jakarta Commons-HttpClient/3.0.1]
2008-10-27 07:59:45,571 http-8095-Processor24 DEBUG [atlassian.crowd.authentication.TokenKeyGeneratorImpl] Adding remote address of ddd
2008-10-27 07:59:45,571 http-8095-Processor24 DEBUG [atlassian.crowd.authentication.TokenKeyGeneratorImpl] Adding Random-Number of com.atlassian.crowd.integration.authentication.ValidationFactor@11df67d[name=Random-Number,value=<null>]
2008-10-27 07:59:45,571 http-8095-Processor24 DEBUG [crowd.manager.application.ApplicationServiceGeneric] Current Validation Factors: 
com.atlassian.crowd.integration.authentication.ValidationFactor@aad19e[name=remote_address,value=195.177.254.13]com.atlassian.crowd.integration.authentication.ValidationFactor@a7efe7[name=User-Agent,value=Jakarta Commons-HttpClient/3.0.1]
2008-10-27 07:59:45,571 http-8095-Processor24 ERROR [codehaus.xfire.handler.DefaultFaultHandler] Fault occurred!
java.lang.NullPointerException
	at com.atlassian.crowd.model.token.Token.hashCode(Token.java:199)
	at java.util.HashMap.put(HashMap.java:418)
	at java.util.HashSet.add(HashSet.java:194)
	at org.apache.commons.lang.builder.ToStringStyle.register(ToStringStyle.java:151)
	at org.apache.commons.lang.builder.ToStringStyle.appendClassName(ToStringStyle.java:1403)
	at org.apache.commons.lang.builder.ToStringStyle.appendStart(ToStringStyle.java:328)
	at org.apache.commons.lang.builder.ToStringBuilder.<init>(ToStringBuilder.java:255)
	at org.apache.commons.lang.builder.ToStringBuilder.<init>(ToStringBuilder.java:212)
	at com.atlassian.crowd.model.token.Token.toString(Token.java:208)
	at java.lang.String.valueOf(String.java:2615)
	at java.lang.StringBuilder.append(StringBuilder.java:116)
	at com.atlassian.crowd.manager.GenericManager.genericValidateToken(GenericManager.java:119)
	at com.atlassian.crowd.manager.application.ApplicationServiceGeneric.validateToken(ApplicationServiceGeneric.java:1924)
	at sun.reflect.GeneratedMethodAccessor217.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:585)
	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:310)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149)
	at com.atlassian.spring.interceptors.SpringProfilingInterceptor.invoke(SpringProfilingInterceptor.java:20)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
	at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:106)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
	at $Proxy9.validateToken(Unknown Source)
	at com.atlassian.crowd.service.soap.SecurityServerGeneric.isValidPrincipalToken(SecurityServerGeneric.java:185)
	at sun.reflect.GeneratedMethodAccessor205.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:585)
	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:310)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149)
	at com.atlassian.spring.interceptors.SpringProfilingInterceptor.invoke(SpringProfilingInterceptor.java:20)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
	at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:106)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
	at $Proxy11.isValidPrincipalToken(Unknown Source)
	at sun.reflect.GeneratedMethodAccessor205.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:585)
	at org.codehaus.xfire.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:59)
	at org.codehaus.xfire.service.binding.ServiceInvocationHandler.sendMessage(ServiceInvocationHandler.java:320)
	at org.codehaus.xfire.service.binding.ServiceInvocationHandler$1.run(ServiceInvocationHandler.java:86)
	at org.codehaus.xfire.service.binding.ServiceInvocationHandler.execute(ServiceInvocationHandler.java:134)
	at org.codehaus.xfire.service.binding.ServiceInvocationHandler.invoke(ServiceInvocationHandler.java:109)
	at org.codehaus.xfire.handler.HandlerPipeline.invoke(HandlerPipeline.java:131)
	at org.codehaus.xfire.transport.DefaultEndpoint.onReceive(DefaultEndpoint.java:64)
	at org.codehaus.xfire.transport.AbstractChannel.receive(AbstractChannel.java:38)
	at org.codehaus.xfire.transport.http.XFireServletController.invoke(XFireServletController.java:304)
	at org.codehaus.xfire.transport.http.XFireServletController.doService(XFireServletController.java:129)
	at org.codehaus.xfire.transport.http.XFireServlet.doPost(XFireServlet.java:116)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:710)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:269)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
	at org.springframework.orm.hibernate3.support.OpenSessionInViewFilter.doFilterInternal(OpenSessionInViewFilter.java:198)
	at com.atlassian.crowd.console.filter.CrowdOpenSessionInViewFilter.doFilterInternal(CrowdOpenSessionInViewFilter.java:26)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:75)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
	at com.atlassian.gzipfilter.GzipFilter.doFilterInternal(GzipFilter.java:94)
	at com.atlassian.gzipfilter.GzipFilter.doFilter(GzipFilter.java:64)
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:183)
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:138)
	at com.atlassian.crowd.console.filter.CrowdDelegatingFilterProxy.doFilter(CrowdDelegatingFilterProxy.java:38)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
	at com.atlassian.core.filters.AbstractEncodingFilter.doFilter(AbstractEncodingFilter.java:33)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
	at com.atlassian.johnson.filters.AbstractJohnsonFilter.doFilter(AbstractJohnsonFilter.java:72)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
	at com.atlassian.johnson.filters.AbstractJohnsonFilter.doFilter(AbstractJohnsonFilter.java:72)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:174)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:108)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:151)
	at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:874)
	at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:665)
	at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:528)
	at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:81)
	at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:689)
	at java.lang.Thread.run(Thread.java:595)
2008-10-27 07:59:45,573 http-8095-Processor24 DEBUG [service.soap.xfire.XFireFaultLoggingMethodHandler] SOAP service fault for method: isValidPrincipalToken
	java.lang.NullPointerException

2008-10-27 07:59:45,573 http-8095-Processor24 DEBUG [crowd.console.filter.CrowdOpenSessionInViewFilter] Closing single Hibernate Session in OpenSessionInViewFilter
2008-10-27 07:59:45,580 http-8095-Processor21 DEBUG [crowd.console.filter.CrowdOpenSessionInViewFilter] Using SessionFactory 'sessionFactory' for OpenSessionInViewFilter
2008-10-27 07:59:45,580 http-8095-Processor21 DEBUG [crowd.console.filter.CrowdOpenSessionInViewFilter] Opening single Hibernate Session in OpenSessionInViewFilter
2008-10-27 07:59:45,580 http-8095-Processor21 DEBUG [service.soap.xfire.XFireInLoggingMethodHandler] SOAP service method: findPrincipalByName
	com.atlassian.crowd.integration.authentication.AuthenticatedToken@139d320[name=bbb,token=yyy]
	bamboo