You are viewing a plain text version of this content. The canonical link for it is here.
Posted to java-user@axis.apache.org by Tania Marinova <ta...@yahoo.com> on 2013/05/09 11:08:10 UTC
why WSPasswordCallback.getPassword is null when I try my soap request
i
I have made axis 2 web service with rampart security
but I constantly was receiving null point exception at this line
if((pwcb.getIdentifier().equals("bob")) && pwcb.getPassword().equals("bobPW")) )
so when I wrote this code
if ( pwcb.getPassword()==null)
{ throw new Exception ("passsssssssss is null:"+pwcb.getPassword());
I saw at last that the problem is that pwcb.getPassword is null and I can't explain why
Thank you in advance
this is my soaprequest
"<?xml version=\"1.0\" encoding=\"utf-8\"?>" + "<soapenv:Envelope " + "xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" " + "xmlns:nilo=\"http://nilo\">"+ "<soapenv:Header>"+ '<wsse:Security xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" soapenv:mustUnderstand="1">'+ '<wsse:UsernameToken xmlns:wsu="http://docs.oasisopen.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="123">'+ '<wsse:Username>bob</wsse:Username>'+ '<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">bobPW</wsse:Password>'+ '</wsse:UsernameToken>'+ '</wsse:Security>'+ "</soapenv:Header>"+ "<soapenv:Body>" + "<nilo:getdataForChecking>" + '<nilo:data>'+tranXml+'</nilo:data>' + ' </nilo:getdataForChecking>'+ '</soapenv:Body>' + '</soapenv:Envelope>';
My PWCBHandler.java class
public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
for (int i = 0; i < callbacks.length; i++) { //When the server side need to authenticate the user WSPasswordCallback pwcb = (WSPasswordCallback)callbacks[i]; if ( pwcb.getPassword()==null) { try { throw new Exception ("passsssssssss null:"+pwcb.getPassword()); } catch (Exception e) { // TODO Auto-generated catch block e.printStackTrace(); } } else { try { throw new Exception ("pass nooot null:"+pwcb.getPassword()); } catch (Exception e) { // TODO Auto-generated catch block e.printStackTrace(); } } if(pwcb.getIdentifier().equals("bob") && pwcb.getPassword().equals("bobPW")) { return; }
Re: why WSPasswordCallback.getPassword is null when I try my soap request
Posted by Tania Marinova <ta...@yahoo.com>.
Thank you for yur answer but as my .net project is more serious I don't have time to read and ovveride
so I want to asko just tat - I have post this as another question and I hope I will not bother you with my questions any more
0 down vote favorite
I want to ask - as in this case teh rampart engine will set the password only if the username is correct can I do this:
1.
I store in a database the hashed value of "bob" username and the salt
In my PWCBHandler.java class
•I get the stored password and hash
•I hash pwcb.getIdentifier() with the same hash function
•check if this hashed username is equal to the stored username
if so - I set the password to bobPW
Bu there is one problem - in the following soap request from
jaavscript everyone with a simple view source can view the plain text
username and password can I cahnge that what would you reccomend me
"<?xml version=\"1.0\" encoding=\"utf-8\"?>" + "<soapenv:Envelope " + "xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" " + "xmlns:nlo=\"http://nlo\">"+ "<soapenv:Header>"+ '<wsse:Security xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" soapenv:mustUnderstand="1">'+ '<wsse:UsernameToken xmlns:wsu="http://docs.oasisopen.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="123">'+ '<wsse:Username>bob</wsse:Username>'+ '<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">bobPW</wsse:Password>'+ '</wsse:UsernameToken>'+ '</wsse:Security>'+ "</soapenv:Header>"+ "<soapenv:Body>" + "<nlo:getdataForChecking>" + '<nlo:data>'+tranXml+'</nlo:data>' + ' </nlo:getdataForChecking>'+ '</soapenv:Body>' + '</soapenv:Envelope>';
________________________________
From: robert lazarski <ro...@gmail.com>
To: java-user@axis.apache.org; Tania Marinova <ta...@yahoo.com>
Sent: Saturday, May 11, 2013 9:06 PM
Subject: Re: why WSPasswordCallback.getPassword is null when I try my soap request
On Fri, May 10, 2013 at 4:26 AM, Tania Marinova <ta...@yahoo.com> wrote:
> Hi thank you!
>
> So the callback number is 0 (sorry for forgetting
>
> the usage is really 'Username_Token';
>
From what I gather, the WSPasswordCallback went thru major changes
recently and WSPasswordCallback.USERNAME_TOKEN_UNKNOWN is no longer an
option. You probably are running WSS4J 1.6 , please confirm the jar
version.
http://coheigea.blogspot.com.br/2011/02/usernametoken-processing-changes-in.html
http://coheigea.blogspot.com.br/2011/04/wss4j-16-introducing-validators.html
For your purposes it seems you need to override a method,
UsernameTokenValidator.verifyPlaintextPassword() , as explained here :
"So what if you want to validate the plaintext password against a
directory store, rather than have the CallbackHandler set the
password? Instead of implementing this behaviour in your
CallbackHandler implementation, you can simply @Override the
verifyPlaintextPassword(UsernameToken usernameToken) method in the
validator instead. "
I'd look at the source to get started, make sure it matches your jar version.
http://svn.apache.org/repos/asf/webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
-R
---------------------------------------------------------------------
To unsubscribe, e-mail: java-user-unsubscribe@axis.apache.org
For additional commands, e-mail: java-user-help@axis.apache.org
Re: why WSPasswordCallback.getPassword is null when I try my soap request
Posted by robert lazarski <ro...@gmail.com>.
On Fri, May 10, 2013 at 4:26 AM, Tania Marinova <ta...@yahoo.com> wrote:
> Hi thank you!
>
> So the callback number is 0 (sorry for forgetting
>
> the usage is really 'Username_Token';
>
>From what I gather, the WSPasswordCallback went thru major changes
recently and WSPasswordCallback.USERNAME_TOKEN_UNKNOWN is no longer an
option. You probably are running WSS4J 1.6 , please confirm the jar
version.
http://coheigea.blogspot.com.br/2011/02/usernametoken-processing-changes-in.html
http://coheigea.blogspot.com.br/2011/04/wss4j-16-introducing-validators.html
For your purposes it seems you need to override a method,
UsernameTokenValidator.verifyPlaintextPassword() , as explained here :
"So what if you want to validate the plaintext password against a
directory store, rather than have the CallbackHandler set the
password? Instead of implementing this behaviour in your
CallbackHandler implementation, you can simply @Override the
verifyPlaintextPassword(UsernameToken usernameToken) method in the
validator instead. "
I'd look at the source to get started, make sure it matches your jar version.
http://svn.apache.org/repos/asf/webservices/wss4j/branches/1_6_x-fixes/src/main/java/org/apache/ws/security/validate/UsernameTokenValidator.java
-R
---------------------------------------------------------------------
To unsubscribe, e-mail: java-user-unsubscribe@axis.apache.org
For additional commands, e-mail: java-user-help@axis.apache.org
Re: why WSPasswordCallback.getPassword is null when I try my soap request
Posted by Tania Marinova <ta...@yahoo.com>.
Hi thank you!
So the callback number is 0 (sorry for forgetting
the usage is really 'Username_Token';
Here is the test
if (pwcb.getUsage() == WSPasswordCallback.USERNAME_TOKEN)
{
try {
throw new Exception("USername_Token");
} catch (Exception e) wicallback number" + i +"Usage is 0");
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
But I was searching all night how to force my callback handler to use Username_token_Unknown but with no success@
AND last if you of course know
i have to consume my web service from javascript ans I use this soa request.Bu as you see everyine with just one View Source can see the user and the password with no problem
Thank you again Robert for your help
var sr = ou s
"<?xml version=\"1.0\" encoding=\"utf-8\"?>" +
"<soapenv:Envelope " +
"xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" " +
"xmlns:nilo=\"http://nilo\">"+
"<soapenv:Header>"+
'<wsse:Security xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" soapenv:mustUnderstand="1">'+
'<wsse:UsernameToken xmlns:wsu="http://docs.oasisopen.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="123">'+
'<wsse:Username>bobWWW</wsse:Username>'+
'<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">bobPW</wsse:Password>'+
'</wsse:UsernameToken>'+
'</wsse:Security>'+
"</soapenv:Header>"+
"<soapenv:Body>" +
"<nilo:getdataForChecking>" +
'<nilo:data>'+tranXml+'</nilo:data>' +
' </nilo:getdataForChecking>'+
'</soapenv:Body>' +
'</soapenv:Envelope>';
________________________________
From: robert lazarski <ro...@gmail.com>
To: java-user@axis.apache.org; Tania Marinova <ta...@yahoo.com>
Sent: Thursday, May 9, 2013 6:44 PM
Subject: Re: why WSPasswordCallback.getPassword is null when I try my soap request is really
On Thu, May 9, 2013 at 12:05 PM, Tania Marinova <ta...@yahoo.com> wrote:
> I tried your code (insted of System.out.println I throw an exception )
>
>
>
>
> public void handle(Callback[] callbacks) throws IOException,
> UnsupportedCallbackException
> {
>
> for (int i = 0; i < callbacks.length; i++) {
>
>
> WSPasswordCallback pwcb =
> (WSPasswordCallback)callbacks[i];
>
>
>
>
>
> if (pwcb.getUsage()==0)
> {
>
> try {
> throw new Exception("Usage is 0");
>
> } catch (Exception e) {
> // TODO Auto-generated catch block
> e.printStackTrace();
> }
>
> }
>
> else
> {
> try {
> throw new Exception("Usage is: "
> +pwcb.getUsage() );
>
> } catch (Exception e) {
> // TODO Auto-generated catch block
> e.printStackTrace();
> }
>
>
>
> }
>
>
> if (pwcb.getIdentifier()==null)
> {
>
> pwcb.setPassword("bobPW");
>
> }
>
> else
> {
> try {
> throw new Exception ("found id, could be used to get
> stored passwod" + pwcb.getIdentifier());
>
> } catch (Exception e) {
> // TODO Auto-generated catch block
> e.printStackTrace();
> }
> }
>
>
>
>
>
>
>
>
> }
> }
>
> And here is the response
>
>
>
>
>
>
> java.lang.Exception: Usage is: 2
> at nilo.PWCBHandler.handle(PWCBHandler.java:77)
//haide mac
>
> -----------------------------------------------------------------------------------------
> java.lang.Exception: found id, could be used to get stored passwod: bobWWW
> at nilo.PWCBHandler.handle(PWCBHandler.java:97)
> at
> org.apache.rampart.TokenCallbackHandler.handle(TokenCallbackHandler.java:98)
>
> a------------------------------------------------------------------------------------
>
>
> So usage is : 2 and of course it extract the identifier correctly
Well you removed part of my debugging that informed the Callback index
number in the array, its possible there is a different usage number in
each loop if there is more than one Callback - not sure.
Anyways, usage 2 is USERNAME_TOKEN , which explains the null password.
You seem to want usage USERNAME_TOKEN_UNKNOWN = 5 .
Once you get to that point, you still have the hash and salt stored
separate in different columns, bad idea! Google on rainbow tables to
understand the vulnerability.
- R
---------------------------------------------------------------------
To unsubscribe, e-mail: java-user-unsubscribe@axis.apache.org
For additional commands, e-mail: java-user-help@axis.apache.org
Re: why WSPasswordCallback.getPassword is null when I try my soap request
Posted by robert lazarski <ro...@gmail.com>.
On Thu, May 9, 2013 at 12:05 PM, Tania Marinova <ta...@yahoo.com> wrote:
> I tried your code (insted of System.out.println I throw an exception )
>
>
>
>
> public void handle(Callback[] callbacks) throws IOException,
> UnsupportedCallbackException
> {
>
> for (int i = 0; i < callbacks.length; i++) {
>
>
> WSPasswordCallback pwcb =
> (WSPasswordCallback)callbacks[i];
>
>
>
>
>
> if (pwcb.getUsage()==0)
> {
>
> try {
> throw new Exception("Usage is 0");
>
> } catch (Exception e) {
> // TODO Auto-generated catch block
> e.printStackTrace();
> }
>
> }
>
> else
> {
> try {
> throw new Exception("Usage is: "
> +pwcb.getUsage() );
>
> } catch (Exception e) {
> // TODO Auto-generated catch block
> e.printStackTrace();
> }
>
>
>
> }
>
>
> if (pwcb.getIdentifier()==null)
> {
>
> pwcb.setPassword("bobPW");
>
> }
>
> else
> {
> try {
> throw new Exception ("found id, could be used to get
> stored passwod" + pwcb.getIdentifier());
>
> } catch (Exception e) {
> // TODO Auto-generated catch block
> e.printStackTrace();
> }
> }
>
>
>
>
>
>
>
>
> }
> }
>
> And here is the response
>
>
>
>
>
>
> java.lang.Exception: Usage is: 2
> at nilo.PWCBHandler.handle(PWCBHandler.java:77)
>
> -----------------------------------------------------------------------------------------
> java.lang.Exception: found id, could be used to get stored passwod: bobWWW
> at nilo.PWCBHandler.handle(PWCBHandler.java:97)
> at
> org.apache.rampart.TokenCallbackHandler.handle(TokenCallbackHandler.java:98)
>
> a------------------------------------------------------------------------------------
>
>
> So usage is : 2 and of course it extract the identifier correctly
Well you removed part of my debugging that informed the Callback index
number in the array, its possible there is a different usage number in
each loop if there is more than one Callback - not sure.
Anyways, usage 2 is USERNAME_TOKEN , which explains the null password.
You seem to want usage USERNAME_TOKEN_UNKNOWN = 5 .
Once you get to that point, you still have the hash and salt stored
separate in different columns, bad idea! Google on rainbow tables to
understand the vulnerability.
- R
---------------------------------------------------------------------
To unsubscribe, e-mail: java-user-unsubscribe@axis.apache.org
For additional commands, e-mail: java-user-help@axis.apache.org
Re: why WSPasswordCallback.getPassword is null when I try my soap request
Posted by Tania Marinova <ta...@yahoo.com>.
I tried your code (insted of System.out.println I throw an exception )
public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException
{
for (int i = 0; i < callbacks.length; i++) {
WSPasswordCallback pwcb = (WSPasswordCallback)callbacks[i];
if (pwcb.getUsage()==0)
{
try {
throw new Exception("Usage is 0");
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
else
{
try {
throw new Exception("Usage is: " +pwcb.getUsage() );
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
if (pwcb.getIdentifier()==null)
{
pwcb.setPassword("bobPW");
}
else
{
try {
throw new Exception ("found id, could be used to get stored passwod" + pwcb.getIdentifier());
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
}
}
And here is the response
java.lang.Exception: Usage is: 2
at nilo.PWCBHandler.handle(PWCBHandler.java:77)
-----------------------------------------------------------------------------------------
java.lang.Exception: found id, could be used to get stored passwod: bobWWW
at nilo.PWCBHandler.handle(PWCBHandler.java:97)
at org.apache.rampart.TokenCallbackHandler.handle(TokenCallbackHandler.java:98)
a------------------------------------------------------------------------------------
So usage is : 2 and of course it extract the identifier correctly
________________________________
From: robert lazarski <ro...@gmail.com>
To: java-user@axis.apache.org; Tania Marinova <ta...@yahoo.com>
Sent: Thursday, May 9, 2013 4:58 PM
Subject: Re: why WSPasswordCallback.getPassword is null when I try my soap request
On Thu, May 9, 2013 at 8:36 AM, Tania Marinova <ta...@yahoo.com> wrote:
>
> Thank you for the help robert but I really think there is something wrong
> here and I can't find no documentation and nobody can answer me!
That's why you need to run the code I asked you to - I need the debug
info to find the problem in your env. The "usage" param value, as
described in the link you pasted, explains 4 use cases and a few of
those pass a null password. I suggest you read the docs again, seems
you missed some important details.
- R
---------------------------------------------------------------------
To unsubscribe, e-mail: java-user-unsubscribe@axis.apache.org
For additional commands, e-mail: java-user-help@axis.apache.org
Re: why WSPasswordCallback.getPassword is null when I try my soap request
Posted by robert lazarski <ro...@gmail.com>.
On Thu, May 9, 2013 at 8:36 AM, Tania Marinova <ta...@yahoo.com> wrote:
>
> Thank you for the help robert but I really think there is something wrong
> here and I can't find no documentation and nobody can answer me!
That's why you need to run the code I asked you to - I need the debug
info to find the problem in your env. The "usage" param value, as
described in the link you pasted, explains 4 use cases and a few of
those pass a null password. I suggest you read the docs again, seems
you missed some important details.
- R
---------------------------------------------------------------------
To unsubscribe, e-mail: java-user-unsubscribe@axis.apache.org
For additional commands, e-mail: java-user-help@axis.apache.org
Re: why WSPasswordCallback.getPassword is null when I try my soap request
Posted by Tania Marinova <ta...@yahoo.com>.
Thank you for the help robert but I really think there is something wrong here and I can't find no documentation and nobody can answer me!
So have a look at this tutorial for example - http://jkrzemie.files.wordpress.com/2011/02/ws.pdf
Or this page http://wso2.org/library/3733 - as you see here it;s written
In the case of plain text, the behavior changes slightly. Here Rampart Engine passes both identifier and the password to the password callback handler and the callback handler does the actual validation. This is useful if the service store the hash of the passwords of clients and not the real passwords. In this case, as Rampart providing the password in the Username Token to the callback handler, it can do hashing operation on it and check the hashed value with the hashed password associated with the username' and there is also some a scheme (I have attached it) and Ican't understand why it doesn't work and what I'm doing wong.
So I looked at your code but I really have some things that I don't understand:
public void handle (Callback[] callbacks) throws IOException,
UnsupportedCallbackException {
WSPasswordCallback pwcb = (WSPasswordCallback) callbacks[i];
if (pwcb.getIdentifer() == null) {
pwcb.setPassword(passWordFromDB);
//so you mean to check if the identifier is null and only then to set password - the hashed password from db!
//and also I always sent the username (identifier and it's always different from null.
}
else {
System.out.println("found id, this could be used to get
the stored password from somewhere: " + pwcb.getIdentifer());
//so I get the identifier and what ?
}
//?when to return
}
}
________________________________
From: robert lazarski <ro...@gmail.com>
To: java-user@axis.apache.org; Tania Marinova <ta...@yahoo.com>
Sent: Thursday, May 9, 2013 1:56 PM
Subject: Re: why WSPasswordCallback.getPassword is null when I try my soap request
On Thu, May 9, 2013 at 6:08 AM, Tania Marinova <ta...@yahoo.com> wrote:
>
> i
>
> I have made axis 2 web service with rampart security
> but I constantly was receiving null point exception at this line
>
> if((pwcb.getIdentifier().equals("bob")) &&
> pwcb.getPassword().equals("bobPW")) )
>
> so when I wrote this code
>
> if ( pwcb.getPassword()==null)
> { throw new Exception ("passsssssssss is null:"+pwcb.getPassword());
>
> I saw at last that the problem is that pwcb.getPassword is null and I
> can't explain why Thank you in advance
>
>
> this is my soaprequest
>
> "<?xml version=\"1.0\" encoding=\"utf-8\"?>" +
> "<soapenv:Envelope " +
>
>
> "xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" " +
> "xmlns:nilo=\"http://nilo\">"+
>
> "<soapenv:Header>"+
>
> '<wsse:Security
> xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\"
> soapenv:mustUnderstand="1">'+
> '<wsse:UsernameToken
> xmlns:wsu="http://docs.oasisopen.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
> wsu:Id="123">'+
> '<wsse:Username>bob</wsse:Username>'+
> '<wsse:Password
> Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">bobPW</wsse:Password>'+
> '</wsse:UsernameToken>'+
> '</wsse:Security>'+
> "</soapenv:Header>"+
> "<soapenv:Body>" +
> "<nilo:getdataForChecking>" +
> '<nilo:data>'+tranXml+'</nilo:data>' +
>
> ' </nilo:getdataForChecking>'+
>
> '</soapenv:Body>' +
> '</soapenv:Envelope>';
>
>
>
>
>
> My PWCBHandler.java class
>
> public void handle(Callback[] callbacks) throws IOException,
> UnsupportedCallbackException {
>
> for (int i = 0; i < callbacks.length; i++) {
>
>
> //When the server side need to authenticate the user
> WSPasswordCallback pwcb = (WSPasswordCallback)callbacks[i];
>
>
> if ( pwcb.getPassword()==null)
> {
> try {
> throw new Exception ("passsssssssss
> null:"+pwcb.getPassword());
> } catch (Exception e) {
> // TODO Auto-generated catch block
> e.printStackTrace();
> }
>
<snip>
My WSS knowledge is a bit dated but try this:
public void handle (Callback[] callbacks) throws IOException,
UnsupportedCallbackException {
for (int i = 0; i < callbacks.length; i++) {
System.out.println("in callback number: " + i + " , usage:
" + pwcb.getUsage());
WSPasswordCallback pwcb = (WSPasswordCallback) callbacks[i];
if (pwcb.getIdentifer() == null) {
pwcb.setPassword(passWordFromDB);
} else {
System.out.println("found id, this could be used to get
the stored password from somewhere: " + pwcb.getIdentifer());
}
}
}
My read on the docs and some code examples is that you set password in
this callback:
http://wso2.org/library/3733
"So let's look at how password callback handlers work. Whenever
Rampart Engine needs a password to create a username token, whether it
is to build a signature, validate username token or decrypt an
encrypted content, it will create a WSPasswordCallback instance
setting the appropriate identifier which it extracts from the
<ramp:user> parameter of the Rampart configuration and pass it to the
password callback class via the handle method. Then password callback
fills the password relevant to the given identifier so that the
Rampart Engine can use it for further processing."
"
- R
---------------------------------------------------------------------
To unsubscribe, e-mail: java-user-unsubscribe@axis.apache.org
For additional commands, e-mail: java-user-help@axis.apache.org
Re: why WSPasswordCallback.getPassword is null when I try my soap request
Posted by robert lazarski <ro...@gmail.com>.
On Thu, May 9, 2013 at 6:08 AM, Tania Marinova <ta...@yahoo.com> wrote:
>
> i
>
> I have made axis 2 web service with rampart security
> but I constantly was receiving null point exception at this line
>
> if((pwcb.getIdentifier().equals("bob")) &&
> pwcb.getPassword().equals("bobPW")) )
>
> so when I wrote this code
>
> if ( pwcb.getPassword()==null)
> { throw new Exception ("passsssssssss is null:"+pwcb.getPassword());
>
> I saw at last that the problem is that pwcb.getPassword is null and I
> can't explain why Thank you in advance
>
>
> this is my soaprequest
>
> "<?xml version=\"1.0\" encoding=\"utf-8\"?>" +
> "<soapenv:Envelope " +
>
>
> "xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" " +
> "xmlns:nilo=\"http://nilo\">"+
>
> "<soapenv:Header>"+
>
> '<wsse:Security
> xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\"
> soapenv:mustUnderstand="1">'+
> '<wsse:UsernameToken
> xmlns:wsu="http://docs.oasisopen.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
> wsu:Id="123">'+
> '<wsse:Username>bob</wsse:Username>'+
> '<wsse:Password
> Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">bobPW</wsse:Password>'+
> '</wsse:UsernameToken>'+
> '</wsse:Security>'+
> "</soapenv:Header>"+
> "<soapenv:Body>" +
> "<nilo:getdataForChecking>" +
> '<nilo:data>'+tranXml+'</nilo:data>' +
>
> ' </nilo:getdataForChecking>'+
>
> '</soapenv:Body>' +
> '</soapenv:Envelope>';
>
>
>
>
>
> My PWCBHandler.java class
>
> public void handle(Callback[] callbacks) throws IOException,
> UnsupportedCallbackException {
>
> for (int i = 0; i < callbacks.length; i++) {
>
>
> //When the server side need to authenticate the user
> WSPasswordCallback pwcb = (WSPasswordCallback)callbacks[i];
>
>
> if ( pwcb.getPassword()==null)
> {
> try {
> throw new Exception ("passsssssssss
> null:"+pwcb.getPassword());
> } catch (Exception e) {
> // TODO Auto-generated catch block
> e.printStackTrace();
> }
>
<snip>
My WSS knowledge is a bit dated but try this:
public void handle (Callback[] callbacks) throws IOException,
UnsupportedCallbackException {
for (int i = 0; i < callbacks.length; i++) {
System.out.println("in callback number: " + i + " , usage:
" + pwcb.getUsage());
WSPasswordCallback pwcb = (WSPasswordCallback) callbacks[i];
if (pwcb.getIdentifer() == null) {
pwcb.setPassword(passWordFromDB);
} else {
System.out.println("found id, this could be used to get
the stored password from somewhere: " + pwcb.getIdentifer());
}
}
}
My read on the docs and some code examples is that you set password in
this callback:
http://wso2.org/library/3733
"So let's look at how password callback handlers work. Whenever
Rampart Engine needs a password to create a username token, whether it
is to build a signature, validate username token or decrypt an
encrypted content, it will create a WSPasswordCallback instance
setting the appropriate identifier which it extracts from the
<ramp:user> parameter of the Rampart configuration and pass it to the
password callback class via the handle method. Then password callback
fills the password relevant to the given identifier so that the
Rampart Engine can use it for further processing."
"
- R
---------------------------------------------------------------------
To unsubscribe, e-mail: java-user-unsubscribe@axis.apache.org
For additional commands, e-mail: java-user-help@axis.apache.org