Major Description
Not sure yet, why or when this happens, but I'm quite sure I would get a better Exception later when the NPE is not thrown. 
Stephen Kitt <skitt@redhat.com> introduced on 05/21/2019 the NullPointerException code due to a refactoring in the class `org.apache.karaf.util.jaas.JaasHelper`.
The code before 05/21/2019 handles the case when assignedDomains is null correct. It did not enter the for-loop at all to access assignedDomains when it is null.
public ProtectionDomain[] combine(ProtectionDomain[] currentDomains, ProtectionDomain[] assignedDomains) { int cLen = (currentDomains == null ? 0 : currentDomains.length); int aLen = (assignedDomains == null ? 0 : assignedDomains.length); ProtectionDomain[] newDomains = new ProtectionDomain[cLen + aLen]; Principal[] principals = subject.getPrincipals().toArray(new Principal[0]); for (int i = 0; i < cLen; i++) { newDomains[i] = new DelegatingProtectionDomain(currentDomains[i], principals); } for (int i = 0; i < aLen; i++) { newDomains[cLen + i] = assignedDomains[i]; } newDomains = optimize(newDomains); return newDomains; }
The code after 05/21/2019, which introduced the System.arraycopy, throws the NPE when assignedDomains is null.
public ProtectionDomain[] combine(ProtectionDomain[] currentDomains, ProtectionDomain[] assignedDomains) { int cLen = (currentDomains == null ? 0 : currentDomains.length); int aLen = (assignedDomains == null ? 0 : assignedDomains.length); ProtectionDomain[] newDomains = new ProtectionDomain[cLen + aLen]; Principal[] principals = subject.getPrincipals().toArray(new Principal[0]); for (int i = 0; i < cLen; i++) { newDomains[i] = new DelegatingProtectionDomain(currentDomains[i], principals); } System.arraycopy(assignedDomains, 0, newDomains, cLen, aLen); return optimize(newDomains); }
The thrown exception
Caused by: java.lang.NullPointerException
at java.lang.System.arraycopy(Native Method) ~[?:?]
at org.apache.karaf.util.jaas.JaasHelper$OsgiSubjectDomainCombiner.combine(JaasHelper.java:137) ~[?:?]
at java.security.AccessControlContext.<init>(AccessControlContext.java:237) ~[?:?]
at java.security.AccessController.createWrapper(AccessController.java:599) ~[?:?]
at java.security.AccessController.doPrivilegedWithCombiner(AccessController.java:795) ~[?:?]
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1509) ~[?:?]
at sun.net.www.protocol.http.HttpURLConnection.getHeaderFields(HttpURLConnection.java:3122) ~[?:?]
at org.apache.cxf.transport.http.Headers.readFromConnection(Headers.java:281) ~[?:?]
at org.apache.cxf.transport.http.URLConnectionHTTPConduit$URLConnectionWrappedOutputStream.updateResponseHeaders(URLConnectionHTTPConduit.java:328) ~[?:?]
at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:1632) ~[?:?]
at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream$1.run(HTTPConduit.java:1192) ~[?:?]
at org.apache.cxf.workqueue.AutomaticWorkQueueImpl$3.run(AutomaticWorkQueueImpl.java:413) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~[?:?]
at org.apache.cxf.workqueue.AutomaticWorkQueueImpl$AWQThreadFactory$1.run(AutomaticWorkQueueImpl.java:346) ~[?:?]
... 1 more