I found that the TokenAuthFilter.java class creates a static exception:

private static final WebApplicationException UNAVAILABLE_EX = new WebApplicationException(
Response.status(Status.SERVICE_UNAVAILABLE)
.type(MediaType.APPLICATION_JSON)
.entity("

")
.build());

It seems that the intent was to deduplicate the amount of code written inline with statics. While this is fine for a static Response message, by creating the exception object here and not inline you get incorrect trace information when the exception is thrown.

We should change this so that the exception is not created here, but just the response (i.e. the response is static).

Then when we throw the exception in the constructor we should create the new WebApplicationException object. This way the exception will have the proper trace and you get the reusable response.

While this is a single example, there are other cases in this same file and other files that should be reviewed and fixed as well.

File: https://github.com/opendaylight/aaa/blob/master/aaa-authn-sts/src/main/java/org/opendaylight/aaa/sts/TokenAuthFilter.java

NOTE: If we are intentionally doing this for some reason then the code should be commented to describe why.