You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by srinivas thallapalli <sr...@gmail.com> on 2011/01/07 08:31:17 UTC
Problem with WSS4J and CXF
Hi All,
I am trying to use ws-security standards like UsernameToken, Encryption,
Signature and etc with CXF services.
For that I am constructing WSS4j interceptors one for each standard and
associating each interceptor separately with each endpoint and the problem
is the endpoints(server n client) recognizing only the first associated
interceptor hence only the first added standard only working and rest
interceptors are not effective.
Thanks in advance
--
View this message in context: http://cxf.547215.n5.nabble.com/Problem-with-WSS4J-and-CXF-tp3331500p3331500.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Problem with WSS4J and CXF
Posted by Daniel Kulp <dk...@apache.org>.
On Thursday 20 January 2011 12:06:18 pm Glen Mazza wrote:
> To clarify your question, the callback handlers are both client-side,
> you're not concerned about the service-side here, correct? i.e., one
> CallbackHandler to specify the end user's (or client's) username and the
> second to provide the client's private key password (for the signature),
> correct?
>
> You might be able to use the same CallbackHandler for both.
I was actually thinking something along the lines of a CallbackHandler that
would wrapper the other handlers and call them appropriately depending on the
context. Shouldn't be too hard to write.
Dan
>
> Glen
>
> On 20.01.2011 08:50, srinivas thallapalli wrote:
> > Thanks alot...
> >
> > I have a scenario for using ws-security combination of UsernameToken and
> > Signature with different alias of signature from user of Usernametoken
> > and different passwords for each. And I want to provide passwords using
> > callback classes, How can I provide two callback classes one for
> > Usernametoken and one for signing.
> >
> > Please let me know.
> >
> > Thanks
--
Daniel Kulp
dkulp@apache.org
http://dankulp.com/blog
Re: Problem with WSS4J and CXF
Posted by Glen Mazza <gm...@talend.com>.
To clarify your question, the callback handlers are both client-side,
you're not concerned about the service-side here, correct? i.e., one
CallbackHandler to specify the end user's (or client's) username and the
second to provide the client's private key password (for the signature),
correct?
You might be able to use the same CallbackHandler for both.
Glen
On 20.01.2011 08:50, srinivas thallapalli wrote:
> Thanks alot...
>
> I have a scenario for using ws-security combination of UsernameToken and
> Signature with different alias of signature from user of Usernametoken and
> different passwords for each. And I want to provide passwords using callback
> classes, How can I provide two callback classes one for Usernametoken and
> one for signing.
>
> Please let me know.
>
> Thanks
>
>
--
Glen Mazza
Software Engineer, Talend (http://www.talend.com)
blog: http://www.jroller.com/gmazza
Re: Problem with WSS4J and CXF
Posted by srinivas thallapalli <sr...@gmail.com>.
Thanks alot...
I have a scenario for using ws-security combination of UsernameToken and
Signature with different alias of signature from user of Usernametoken and
different passwords for each. And I want to provide passwords using callback
classes, How can I provide two callback classes one for Usernametoken and
one for signing.
Please let me know.
Thanks
--
View this message in context: http://cxf.547215.n5.nabble.com/Problem-with-WSS4J-and-CXF-tp3331500p3349626.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Problem with WSS4J and CXF
Posted by Freeman Fang <fr...@gmail.com>.
Hi,
I guess you miss my previous reply, just copy it here
It's expected behavior, you can't add same interceptor class(with
multiple different instances object) for a certain endpoint.
You need specify multiple action(standard in your term) like
UsernameToken, Encryption, Signature for one WSS4j interceptor.
If different service need different actions set, you just need use
different WSS4j interceptors with different actions set for each
service.
You should only use one WSS4JInInterceptor for a given cxf endpoint.
Your code should be like
Map<String,Object> inProps1= new HashMap<String,Object>();
inProps1
.put(WSHandlerConstants.ACTION,WSHandlerConstants.USERNAME_TOKEN + " "
+ WSHandlerConstants.ENCRYPT);
inProps1.put(WSHandlerConstants.PASSWORD_TYPE,
WSConstants.PASSWORD_DIGEST);
inProps1.put(WSHandlerConstants.PW_CALLBACK_CLASS,
ServerPasswordCallback.class.getName());
inProps1.put(WSHandlerConstants.DEC_PROP_FILE,
"Server_Decrypt.properties");
WSS4JInInterceptor wssIn1 = new WSS4JInInterceptor(inProps1);
cxfEndpoint.getInInterceptors().add(wssIn1);
With this code the WSS4JInInterceptor can handle both USERNAME_TOKEN
and ENCRYPT actions.
Freeman
On 2011-1-10, at 下午2:54, srinivas thallapalli wrote:
>
> Hi,
>
> I am using multiple interceptor in the following way
>
> Map<String,Object> inProps1= new HashMap<String,Object>();
>
> inProps1
> .put(WSHandlerConstants.ACTION,WSHandlerConstants.USERNAME_TOKEN );
> inProps1.put(WSHandlerConstants.PASSWORD_TYPE,
> WSConstants.PASSWORD_DIGEST);
> inProps1.put(WSHandlerConstants.PW_CALLBACK_CLASS,
> ServerPasswordCallback.class.getName());
>
> Map<String,Object> inProps2= new HashMap<String,Object>();
>
> inProps2.put(WSHandlerConstants.ACTION,WSHandlerConstants.ENCRYPT);
> inProps2.put(WSHandlerConstants.PW_CALLBACK_CLASS,
> ServerPasswordCallback.class.getName());
> inProps2.put(WSHandlerConstants.DEC_PROP_FILE,
> "Server_Decrypt.properties");
>
> WSS4JInInterceptor wssIn1 = new WSS4JInInterceptor(inProps1);
> cxfEndpoint.getInInterceptors().add(wssIn1);
> WSS4JInInterceptor wssIn2 = new WSS4JInInterceptor(inProps2);
> cxfEndpoint.getInInterceptors().add(wssIn2);
>
> So in the case only the first added intercpetor is effective, rest
> of the
> interceptors are not effective.
>
>
> Thanks
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Problem-with-WSS4J-and-CXF-tp3331500p3334479.html
> Sent from the cxf-user mailing list archive at Nabble.com.
--
Freeman Fang
------------------------
FuseSource: http://fusesource.com
blog: http://freemanfang.blogspot.com
twitter: http://twitter.com/freemanfang
Apache Servicemix:http://servicemix.apache.org
Apache Cxf: http://cxf.apache.org
Apache Karaf: http://karaf.apache.org
Apache Felix: http://felix.apache.org
Re: Problem with WSS4J and CXF
Posted by srinivas thallapalli <sr...@gmail.com>.
Hi,
I am using multiple interceptor in the following way
Map<String,Object> inProps1= new HashMap<String,Object>();
inProps1.put(WSHandlerConstants.ACTION,WSHandlerConstants.USERNAME_TOKEN );
inProps1.put(WSHandlerConstants.PASSWORD_TYPE,
WSConstants.PASSWORD_DIGEST);
inProps1.put(WSHandlerConstants.PW_CALLBACK_CLASS,
ServerPasswordCallback.class.getName());
Map<String,Object> inProps2= new HashMap<String,Object>();
inProps2.put(WSHandlerConstants.ACTION,WSHandlerConstants.ENCRYPT);
inProps2.put(WSHandlerConstants.PW_CALLBACK_CLASS,
ServerPasswordCallback.class.getName());
inProps2.put(WSHandlerConstants.DEC_PROP_FILE,
"Server_Decrypt.properties");
WSS4JInInterceptor wssIn1 = new WSS4JInInterceptor(inProps1);
cxfEndpoint.getInInterceptors().add(wssIn1);
WSS4JInInterceptor wssIn2 = new WSS4JInInterceptor(inProps2);
cxfEndpoint.getInInterceptors().add(wssIn2);
So in the case only the first added intercpetor is effective, rest of the
interceptors are not effective.
Thanks
--
View this message in context: http://cxf.547215.n5.nabble.com/Problem-with-WSS4J-and-CXF-tp3331500p3334479.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Problem with WSS4J and CXF
Posted by Freeman Fang <fr...@gmail.com>.
Hi,
It's expected behavior, you can't add same interceptor class(with
multiple different instances object) for a certain endpoint.
You need specify multiple action(standard in your term) like
UsernameToken, Encryption, Signature for one WSS4j interceptor.
If different service need different actions set, you just need use
different WSS4j interceptors with different actions set for each
service.
Freeman
On 2011-1-7, at 下午3:31, srinivas thallapalli wrote:
>
> Hi All,
>
> I am trying to use ws-security standards like UsernameToken,
> Encryption,
> Signature and etc with CXF services.
> For that I am constructing WSS4j interceptors one for each standard
> and
> associating each interceptor separately with each endpoint and the
> problem
> is the endpoints(server n client) recognizing only the first
> associated
> interceptor hence only the first added standard only working and rest
> interceptors are not effective.
>
> Thanks in advance
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Problem-with-WSS4J-and-CXF-tp3331500p3331500.html
> Sent from the cxf-user mailing list archive at Nabble.com.
--
Freeman Fang
------------------------
FuseSource: http://fusesource.com
blog: http://freemanfang.blogspot.com
twitter: http://twitter.com/freemanfang
Apache Servicemix:http://servicemix.apache.org
Apache Cxf: http://cxf.apache.org
Apache Karaf: http://karaf.apache.org
Apache Felix: http://felix.apache.org
Re: Problem with WSS4J and CXF
Posted by Glen Mazza <gl...@gmail.com>.
It might be helpful to see the basic structure (not the actual security
data) to see what you might be doing wrong. Keep in mind you also have
the option of WS-SecurityPolicy with CXF, perhaps slightly more common
and preferred.
Links #2 and #4 under security show more config options with CXF:
http://www.jroller.com/gmazza/entry/blog_article_index
Dennis' security articles are even better:
http://www.sosnoski.com/articles.html
HTH,
Glen
On 07.01.2011 02:31, srinivas thallapalli wrote:
> Hi All,
>
> I am trying to use ws-security standards like UsernameToken, Encryption,
> Signature and etc with CXF services.
> For that I am constructing WSS4j interceptors one for each standard and
> associating each interceptor separately with each endpoint and the problem
> is the endpoints(server n client) recognizing only the first associated
> interceptor hence only the first added standard only working and rest
> interceptors are not effective.
>
> Thanks in advance
>
>
--
Glen Mazza
gmazza at apache dot org
http://www.jroller.com/gmazza