You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by Glen Mazza <gl...@gmail.com> on 2009/03/23 22:07:30 UTC
Package for SecurityException?
Hello, this page[1], within one of the ServerPasswordCallbacks, uses a class
called "SecurityException" -- what Java package is SecurityException in?
Thanks,
Glen
[1]
http://cwiki.apache.org/CXF20DOC/ws-security.html#WS-Security-UsernameTokenAuthentication
--
View this message in context: http://www.nabble.com/Package-for-SecurityException--tp22669188p22669188.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Package for SecurityException?
Posted by Glen Mazza <gl...@gmail.com>.
Can answer my own question I think...it's apparently a run-time exception
handled by CXF that can be trapped as a SOAPFaultException on the client
side.
Glen Mazza wrote:
>
> Otherwise, if it is not intended for the SEI implementation to handle the
> WSSecurityException being thrown, what does handle it?
>
--
View this message in context: http://www.nabble.com/Package-for-SecurityException--tp22669188p22679350.html
Sent from the cxf-user mailing list archive at Nabble.com.
RE: Package for SecurityException?
Posted by Glen Mazza <gl...@gmail.com>.
Excellent! I'm fully in agreement with you on that.
Glen
Colm O hEigeartaigh wrote:
>
>
> FYI I'm going to change the behaviour for Username Tokens in WSS4J 1.6:
>
> https://issues.apache.org/jira/browse/WSS-183
>
> Colm.
>
> -----Original Message-----
> From: Daniel Kulp [mailto:dkulp@apache.org]
> Sent: 24 March 2009 13:36
> To: users@cxf.apache.org; wss4j-dev@ws.apache.org
> Cc: Glen Mazza
> Subject: Re: Package for SecurityException?
>
>
> CC the wss4j list as that's probably more appropriate.
>
> Actually, with 1.5.6, the callbacks are also used to verify trust for
> any
> RSAKeyValue tokens found in the message. Thus, they are used for
> various
> validation things.
>
> In the future, I'd like to see the callbacks actually do more validation
> prior
> to things being used. For example, we could validate the trusts of the
> x509
> certs that are found PRIOR to using the cert for decryption. If the
> cert
> isn't trusted, why spend the processor time doing the decryption and
> such.
> Right now, we do all the processing, then after the fact, we check to
> make
> sure the certs that were used are OK. Timestamps could be checked
> immediately, etc...
>
> Dan
>
>
> On Tue March 24 2009 8:32:25 am Glen Mazza wrote:
>> BTW, I will update our online example to use a IOException for a bad
>> cleartext password, as that appears to be the less incorrect of our
> two
>> exception choices. It seems strange, though, that WSS4J treats digest
> and
>> cleartext passwords differently, relying on the CallbackHandler to do
> the
>> validation for the latter: http://tinyurl.com/cuqblz.
> CallbackHandlers do
>> not appear meant to do validation, or else they would have a
>> BadPasswordSuppliedException or similar exception-throwing capability.
>>
>> Glen
>>
>> Glen Mazza wrote:
>> > Technically, I guess you're limited to not just any exception but
>> > specifically a IOException or a UnsupportedCallbackException
> subclass, as
>> > those are the only two types of exceptions declared throwable by the
>> > handle() method:
>>
>>
> http://java.sun.com/javase/6/docs/api/javax/security/auth/callback/Callb
> ack
>>Handler.html
>
> --
> Daniel Kulp
> dkulp@apache.org
> http://www.dankulp.com/blog
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
> For additional commands, e-mail: wss4j-dev-help@ws.apache.org
>
>
>
--
View this message in context: http://www.nabble.com/Re%3A-Package-for-SecurityException--tp22680584p23340083.html
Sent from the WSS4J mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
Re: Package for SecurityException?
Posted by Glen Mazza <gl...@gmail.com>.
If you would want them to validate even more, it would appear WSS4J should be
using another class for these callbacks besides
javax.security.auth.callback.CallbackHandler, which again does not appear
designed for validation because of the deeply constrained types of
exceptions it can throw.
I also noticed that, because we require a different type of service-side
callback handler (http://tinyurl.com/cw7tas) depending on whether cleartext
or digest passwords are being used (because of the way WSS4J presently
operates), if I switch from password digest to cleartext on the client side,
the service starts to accept everything if its callback handler has not been
correspondingly updated to now start validating instead of providing
passwords--which is a rather large security hole. It would be good if WSS4J
were designed in such a way that the CXF service-side callback hander would
*not* need to be changed depending on whether cleartext or digest passwords
are being sent from the client.
Glen
dkulp wrote:
>
>
> CC the wss4j list as that's probably more appropriate.
>
> Actually, with 1.5.6, the callbacks are also used to verify trust for any
> RSAKeyValue tokens found in the message. Thus, they are used for various
> validation things.
>
> In the future, I'd like to see the callbacks actually do more validation
> prior
> to things being used. For example, we could validate the trusts of the
> x509
> certs that are found PRIOR to using the cert for decryption. If the cert
> isn't trusted, why spend the processor time doing the decryption and such.
> Right now, we do all the processing, then after the fact, we check to make
> sure the certs that were used are OK. Timestamps could be checked
> immediately, etc...
>
> Dan
>
>
> On Tue March 24 2009 8:32:25 am Glen Mazza wrote:
>> BTW, I will update our online example to use a IOException for a bad
>> cleartext password, as that appears to be the less incorrect of our two
>> exception choices. It seems strange, though, that WSS4J treats digest
>> and
>> cleartext passwords differently, relying on the CallbackHandler to do the
>> validation for the latter: http://tinyurl.com/cuqblz. CallbackHandlers
>> do
>> not appear meant to do validation, or else they would have a
>> BadPasswordSuppliedException or similar exception-throwing capability.
>>
>> Glen
>>
>> Glen Mazza wrote:
>> > Technically, I guess you're limited to not just any exception but
>> > specifically a IOException or a UnsupportedCallbackException subclass,
>> as
>> > those are the only two types of exceptions declared throwable by the
>> > handle() method:
>>
>> http://java.sun.com/javase/6/docs/api/javax/security/auth/callback/Callback
>>Handler.html
>
> --
> Daniel Kulp
> dkulp@apache.org
> http://www.dankulp.com/blog
>
>
--
View this message in context: http://www.nabble.com/Package-for-SecurityException--tp22669188p22683472.html
Sent from the cxf-user mailing list archive at Nabble.com.
RE: Package for SecurityException?
Posted by Colm O hEigeartaigh <co...@progress.com>.
FYI I'm going to change the behaviour for Username Tokens in WSS4J 1.6:
https://issues.apache.org/jira/browse/WSS-183
Colm.
-----Original Message-----
From: Daniel Kulp [mailto:dkulp@apache.org]
Sent: 24 March 2009 13:36
To: users@cxf.apache.org; wss4j-dev@ws.apache.org
Cc: Glen Mazza
Subject: Re: Package for SecurityException?
CC the wss4j list as that's probably more appropriate.
Actually, with 1.5.6, the callbacks are also used to verify trust for
any
RSAKeyValue tokens found in the message. Thus, they are used for
various
validation things.
In the future, I'd like to see the callbacks actually do more validation
prior
to things being used. For example, we could validate the trusts of the
x509
certs that are found PRIOR to using the cert for decryption. If the
cert
isn't trusted, why spend the processor time doing the decryption and
such.
Right now, we do all the processing, then after the fact, we check to
make
sure the certs that were used are OK. Timestamps could be checked
immediately, etc...
Dan
On Tue March 24 2009 8:32:25 am Glen Mazza wrote:
> BTW, I will update our online example to use a IOException for a bad
> cleartext password, as that appears to be the less incorrect of our
two
> exception choices. It seems strange, though, that WSS4J treats digest
and
> cleartext passwords differently, relying on the CallbackHandler to do
the
> validation for the latter: http://tinyurl.com/cuqblz.
CallbackHandlers do
> not appear meant to do validation, or else they would have a
> BadPasswordSuppliedException or similar exception-throwing capability.
>
> Glen
>
> Glen Mazza wrote:
> > Technically, I guess you're limited to not just any exception but
> > specifically a IOException or a UnsupportedCallbackException
subclass, as
> > those are the only two types of exceptions declared throwable by the
> > handle() method:
>
>
http://java.sun.com/javase/6/docs/api/javax/security/auth/callback/Callb
ack
>Handler.html
--
Daniel Kulp
dkulp@apache.org
http://www.dankulp.com/blog
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
RE: Package for SecurityException?
Posted by Colm O hEigeartaigh <co...@progress.com>.
FYI I'm going to change the behaviour for Username Tokens in WSS4J 1.6:
https://issues.apache.org/jira/browse/WSS-183
Colm.
-----Original Message-----
From: Daniel Kulp [mailto:dkulp@apache.org]
Sent: 24 March 2009 13:36
To: users@cxf.apache.org; wss4j-dev@ws.apache.org
Cc: Glen Mazza
Subject: Re: Package for SecurityException?
CC the wss4j list as that's probably more appropriate.
Actually, with 1.5.6, the callbacks are also used to verify trust for
any
RSAKeyValue tokens found in the message. Thus, they are used for
various
validation things.
In the future, I'd like to see the callbacks actually do more validation
prior
to things being used. For example, we could validate the trusts of the
x509
certs that are found PRIOR to using the cert for decryption. If the
cert
isn't trusted, why spend the processor time doing the decryption and
such.
Right now, we do all the processing, then after the fact, we check to
make
sure the certs that were used are OK. Timestamps could be checked
immediately, etc...
Dan
On Tue March 24 2009 8:32:25 am Glen Mazza wrote:
> BTW, I will update our online example to use a IOException for a bad
> cleartext password, as that appears to be the less incorrect of our
two
> exception choices. It seems strange, though, that WSS4J treats digest
and
> cleartext passwords differently, relying on the CallbackHandler to do
the
> validation for the latter: http://tinyurl.com/cuqblz.
CallbackHandlers do
> not appear meant to do validation, or else they would have a
> BadPasswordSuppliedException or similar exception-throwing capability.
>
> Glen
>
> Glen Mazza wrote:
> > Technically, I guess you're limited to not just any exception but
> > specifically a IOException or a UnsupportedCallbackException
subclass, as
> > those are the only two types of exceptions declared throwable by the
> > handle() method:
>
>
http://java.sun.com/javase/6/docs/api/javax/security/auth/callback/Callb
ack
>Handler.html
--
Daniel Kulp
dkulp@apache.org
http://www.dankulp.com/blog
Re: Package for SecurityException?
Posted by Daniel Kulp <dk...@apache.org>.
CC the wss4j list as that's probably more appropriate.
Actually, with 1.5.6, the callbacks are also used to verify trust for any
RSAKeyValue tokens found in the message. Thus, they are used for various
validation things.
In the future, I'd like to see the callbacks actually do more validation prior
to things being used. For example, we could validate the trusts of the x509
certs that are found PRIOR to using the cert for decryption. If the cert
isn't trusted, why spend the processor time doing the decryption and such.
Right now, we do all the processing, then after the fact, we check to make
sure the certs that were used are OK. Timestamps could be checked
immediately, etc...
Dan
On Tue March 24 2009 8:32:25 am Glen Mazza wrote:
> BTW, I will update our online example to use a IOException for a bad
> cleartext password, as that appears to be the less incorrect of our two
> exception choices. It seems strange, though, that WSS4J treats digest and
> cleartext passwords differently, relying on the CallbackHandler to do the
> validation for the latter: http://tinyurl.com/cuqblz. CallbackHandlers do
> not appear meant to do validation, or else they would have a
> BadPasswordSuppliedException or similar exception-throwing capability.
>
> Glen
>
> Glen Mazza wrote:
> > Technically, I guess you're limited to not just any exception but
> > specifically a IOException or a UnsupportedCallbackException subclass, as
> > those are the only two types of exceptions declared throwable by the
> > handle() method:
>
> http://java.sun.com/javase/6/docs/api/javax/security/auth/callback/Callback
>Handler.html
--
Daniel Kulp
dkulp@apache.org
http://www.dankulp.com/blog
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
Re: Package for SecurityException?
Posted by Daniel Kulp <dk...@apache.org>.
CC the wss4j list as that's probably more appropriate.
Actually, with 1.5.6, the callbacks are also used to verify trust for any
RSAKeyValue tokens found in the message. Thus, they are used for various
validation things.
In the future, I'd like to see the callbacks actually do more validation prior
to things being used. For example, we could validate the trusts of the x509
certs that are found PRIOR to using the cert for decryption. If the cert
isn't trusted, why spend the processor time doing the decryption and such.
Right now, we do all the processing, then after the fact, we check to make
sure the certs that were used are OK. Timestamps could be checked
immediately, etc...
Dan
On Tue March 24 2009 8:32:25 am Glen Mazza wrote:
> BTW, I will update our online example to use a IOException for a bad
> cleartext password, as that appears to be the less incorrect of our two
> exception choices. It seems strange, though, that WSS4J treats digest and
> cleartext passwords differently, relying on the CallbackHandler to do the
> validation for the latter: http://tinyurl.com/cuqblz. CallbackHandlers do
> not appear meant to do validation, or else they would have a
> BadPasswordSuppliedException or similar exception-throwing capability.
>
> Glen
>
> Glen Mazza wrote:
> > Technically, I guess you're limited to not just any exception but
> > specifically a IOException or a UnsupportedCallbackException subclass, as
> > those are the only two types of exceptions declared throwable by the
> > handle() method:
>
> http://java.sun.com/javase/6/docs/api/javax/security/auth/callback/Callback
>Handler.html
--
Daniel Kulp
dkulp@apache.org
http://www.dankulp.com/blog
Re: Package for SecurityException?
Posted by Glen Mazza <gl...@gmail.com>.
BTW, I will update our online example to use a IOException for a bad
cleartext password, as that appears to be the less incorrect of our two
exception choices. It seems strange, though, that WSS4J treats digest and
cleartext passwords differently, relying on the CallbackHandler to do the
validation for the latter: http://tinyurl.com/cuqblz. CallbackHandlers do
not appear meant to do validation, or else they would have a
BadPasswordSuppliedException or similar exception-throwing capability.
Glen
Glen Mazza wrote:
>
> Technically, I guess you're limited to not just any exception but
> specifically a IOException or a UnsupportedCallbackException subclass, as
> those are the only two types of exceptions declared throwable by the
> handle() method:
>
http://java.sun.com/javase/6/docs/api/javax/security/auth/callback/CallbackHandler.html
--
View this message in context: http://www.nabble.com/Package-for-SecurityException--tp22669188p22679478.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Package for SecurityException?
Posted by Glen Mazza <gl...@gmail.com>.
Technically, I guess you're limited to not just any exception but
specifically a IOException or a UnsupportedCallbackException subclass, as
those are the only two types of exceptions declared throwable by the
handle() method:
http://java.sun.com/j2se/1.4.2/docs/api/javax/security/auth/callback/CallbackHandler.html
But this raises another question, how can the SEI implementation catch the
WSSecurityException that WSS4J throws in this case? My SEI implementation
is oblivious to the fact that WS-Security is being used (that information is
configured in the cxf-servlet.xml):
package com.mycompany.webservice.service;
import javax.jws.WebService;
@WebService(targetNamespace = "http://www.example.org/DoubleIt",
portName="DoubleItPort",
serviceName="DoubleItService",
endpointInterface="org.example.doubleit.DoubleItPortType")
public class DoubleItPortTypeImpl {
public int doubleIt(int numberToDouble) {
return numberToDouble * 2;
}
}
Otherwise, if it is not intended for the SEI implementation to handle the
WSSecurityException being thrown, what does handle it?
Thanks,
Glen
dkulp wrote:
>
>
> It's basically "any SecurityException you have" or, literally, anything
> that
> subclasses Exception. If you have your own exception, throw it.
> Whatever
> you throw will be caught and wrapped in a WSSecurityException and
> rethrown.
>
> Dan
>
>
> On Mon March 23 2009 5:07:30 pm Glen Mazza wrote:
>> Hello, this page[1], within one of the ServerPasswordCallbacks, uses a
>> class called "SecurityException" -- what Java package is
>> SecurityException
>> in?
>>
>> Thanks,
>> Glen
>>
>> [1]
>> http://cwiki.apache.org/CXF20DOC/ws-security.html#WS-Security-UsernameToken
>>Authentication
>
> --
> Daniel Kulp
> dkulp@apache.org
> http://www.dankulp.com/blog
>
>
--
View this message in context: http://www.nabble.com/Package-for-SecurityException--tp22669188p22678226.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Package for SecurityException?
Posted by Daniel Kulp <dk...@apache.org>.
It's basically "any SecurityException you have" or, literally, anything that
subclasses Exception. If you have your own exception, throw it. Whatever
you throw will be caught and wrapped in a WSSecurityException and rethrown.
Dan
On Mon March 23 2009 5:07:30 pm Glen Mazza wrote:
> Hello, this page[1], within one of the ServerPasswordCallbacks, uses a
> class called "SecurityException" -- what Java package is SecurityException
> in?
>
> Thanks,
> Glen
>
> [1]
> http://cwiki.apache.org/CXF20DOC/ws-security.html#WS-Security-UsernameToken
>Authentication
--
Daniel Kulp
dkulp@apache.org
http://www.dankulp.com/blog