--- a/jdk/src/share/classes/com/sun/security/auth/module/Krb5LoginModule.java	Wed Dec 04 01:58:37 2013 +0100
+++ b/jdk/src/share/classes/com/sun/security/auth/module/Krb5LoginModule.java	Wed Dec 04 09:14:42 2013 +0800
@@ -916,8 +916,7 @@
                 char[] tmpPassword = ((PasswordCallback)
                                       callbacks[0]).getPassword();
                 if (tmpPassword == null) {
-                    // treat a NULL password as an empty password
-                    tmpPassword = new char[0];
+                    throw new LoginException("No password provided");
                 }
                 password = new char[tmpPassword.length];
                 System.arraycopy(tmpPassword, 0,

--- a/jdk/test/sun/security/krb5/auto/KDC.java	Wed Dec 04 01:58:37 2013 +0100
+++ b/jdk/test/sun/security/krb5/auto/KDC.java	Wed Dec 04 09:14:42 2013 +0800
@@ -605,7 +605,7 @@
      * @return the response
      * @throws java.lang.Exception for various errors
      */
-    private byte[] processMessage(byte[] in) throws Exception {
+    protected byte[] processMessage(byte[] in) throws Exception {
         if ((in[0] & 0x1f) == Krb5.KRB_AS_REQ)
             return processAsReq(in);
         else
@@ -618,7 +618,7 @@
      * @return the response
      * @throws java.lang.Exception for various errors
      */
-    private byte[] processTgsReq(byte[] in) throws Exception {
+    protected byte[] processTgsReq(byte[] in) throws Exception {
         TGSReq tgsReq = new TGSReq(in);
         PrincipalName service = tgsReq.reqBody.sname;
         if (options.containsKey(KDC.Option.RESP_NT)) {
@@ -841,7 +841,7 @@
      * @return the response
      * @throws java.lang.Exception for various errors
      */
-    private byte[] processAsReq(byte[] in) throws Exception {
+    protected byte[] processAsReq(byte[] in) throws Exception {
         ASReq asReq = new ASReq(in);
         int[] eTypes = null;
         List<PAData> outPAs = new ArrayList<>();

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/jdk/test/sun/security/krb5/auto/LoginNoPass.java	Wed Dec 04 09:14:42 2013 +0800
@@ -0,0 +1,73 @@
+/*
+ * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8028351
+ * @summary JWS doesn't get authenticated when using kerberos auth proxy
+ * @compile -XDignore.symbol.file LoginNoPass.java
+ * @run main/othervm LoginNoPass
+ */
+
+import sun.security.jgss.GSSUtil;
+
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.NameCallback;
+import javax.security.auth.callback.PasswordCallback;
+import java.security.Security;
+
+public class LoginNoPass {
+
+    static boolean kdcTouched = false;
+    public static void main(String[] args) throws Exception {
+
+        new OneKDC(null) {
+            protected byte[] processAsReq(byte[] in) throws Exception {
+                kdcTouched = true;
+                return super.processAsReq(in);
+            }
+        }.writeJAASConf();
+        Security.setProperty("auth.login.defaultCallbackHandler",
+                "LoginNoPass$CallbackForClient");
+        System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
+
+        try {
+            Context c;
+            c = Context.fromJAAS("client");
+            c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
+            c.take(new byte[0]);
+        } catch (Exception e) {
+            e.printStackTrace(System.out);
+            // OK
+        }
+        if (kdcTouched) {
+            throw new Exception("Failed");
+        }
+    }
+    public static class CallbackForClient implements CallbackHandler {
+        public void handle(Callback[] callbacks) {
+            // Do nothing
+        }
+    }
+}