You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cxf.apache.org by Naresh Tallapelli <na...@gmail.com> on 2010/04/15 00:22:29 UTC
ws security password digest
Hi All,
I am using cxf 2.1.2 version. I tried to implement ws security. I have
created passowrd call backs on both client and server sides. COnfigured
password type to "PasswordText". Then i was to able to get the password on
web services server side.
But when i use password type to "PasswordDigest", password was sent to the
server in enrypted format. But when i call
"WSPasswordCallback.getPassword()" i am getting value as null. I am not
sure if i miss anything.
Please help to resolve this issue. I need to send the password in encrypted
way.
Thank you,
Naresh.
Re: Using a MultiThreadedHttpConnectionManager with JaxWsProxyFactoryBean?
Posted by Daniel Kulp <dk...@apache.org>.
Chris,
CXF doesn't use the Apache HttpClient for anything. At this point, we only
use the HttpURLConnection object built into the JDK. Thus, any bugs or
issues with Apache HttpClient would not really apply to CXF. (although any
bugs or issues with the JDK's HttpURLConnection would apply)
In anycase, since we don't use HttpClient, there isn't a way to use the
MultiThreadedHttpConnectionManager.
Dan
On Monday 19 April 2010 11:27:31 am Kessel, Christopher wrote:
> Anyone have a thought on this?
>
> Unfortunately, we've been burned by Apache's HttpClient leaking file
> handles without the MultiThreadedHttpConnectionManager and there is zero
> chance I'll be allowed to ship production code without using it again
> (or something similar) with CXF. I'd have to find some other SOAP client
> to use, which I'd rather avoid.
>
> Thanks,
> Chris
>
> -----Original Message-----
> From: Kessel, Christopher
> Sent: Thursday, April 15, 2010 10:44 AM
> To: 'users@cxf.apache.org'
> Subject: Using a MultiThreadedHttpConnectionManager with
> JaxWsProxyFactoryBean?
>
> How can I inject the connection handler into the JaxWsProxyFactoryBean?
>
> Our application literally sends hundreds of thousands of requests an
> hour and we've found we must use the MultiThreadedHttpConnectionManager
> or suffer running out of file handles (I was never able to tell if we
> were leaking or just the system can't close them up as fast as we use
> them).
>
> Our old interface uses HttpClient, with the multi-threaded connection
> manager. Our new code is using CXF, with JaxWsProxyFactoryBean handling
> everything under the covers (well, except hopefully I can control the
> connection manager).
>
> I've scoured Google, but not had much luck finding an example.
>
> Thanks,
> Chris
--
Daniel Kulp
dkulp@apache.org
http://dankulp.com/blog
RE: Using a MultiThreadedHttpConnectionManager with JaxWsProxyFactoryBean?
Posted by "Kessel, Christopher" <ck...@transunion.com>.
Anyone have a thought on this?
Unfortunately, we've been burned by Apache's HttpClient leaking file
handles without the MultiThreadedHttpConnectionManager and there is zero
chance I'll be allowed to ship production code without using it again
(or something similar) with CXF. I'd have to find some other SOAP client
to use, which I'd rather avoid.
Thanks,
Chris
-----Original Message-----
From: Kessel, Christopher
Sent: Thursday, April 15, 2010 10:44 AM
To: 'users@cxf.apache.org'
Subject: Using a MultiThreadedHttpConnectionManager with
JaxWsProxyFactoryBean?
How can I inject the connection handler into the JaxWsProxyFactoryBean?
Our application literally sends hundreds of thousands of requests an
hour and we've found we must use the MultiThreadedHttpConnectionManager
or suffer running out of file handles (I was never able to tell if we
were leaking or just the system can't close them up as fast as we use
them).
Our old interface uses HttpClient, with the multi-threaded connection
manager. Our new code is using CXF, with JaxWsProxyFactoryBean handling
everything under the covers (well, except hopefully I can control the
connection manager).
I've scoured Google, but not had much luck finding an example.
Thanks,
Chris
Using a MultiThreadedHttpConnectionManager with JaxWsProxyFactoryBean?
Posted by "Kessel, Christopher" <ck...@transunion.com>.
How can I inject the connection handler into the JaxWsProxyFactoryBean?
Our application literally sends hundreds of thousands of requests an
hour and we've found we must use the MultiThreadedHttpConnectionManager
or suffer running out of file handles (I was never able to tell if we
were leaking or just the system can't close them up as fast as we use
them).
Our old interface uses HttpClient, with the multi-threaded connection
manager. Our new code is using CXF, with JaxWsProxyFactoryBean handling
everything under the covers (well, except hopefully I can control the
connection manager).
I've scoured Google, but not had much luck finding an example.
Thanks,
Chris
Re: ws security password digest
Posted by Glen Mazza <gl...@gmail.com>.
If you're sending a password digest, you'll also need a nonce and a timestamp
in your request to guard against replay attacks, which must be used when
calculating the hash password--I'm unsure how solid CXF (or your web service
provider) is in this regard. Plain text password w/SSL may be more secure
for you.
Also, keep in mind password digest and password text are (unfortunately)
handled *oppositely* in the service-side CallbackHandler
(http://old.nabble.com/Using-WS-Security-UsernameToken-to-authenticate-users-and-populate--SecurityContexts-tp28165583p28168187.html),
in one case the service-side handler must validate the incoming password,
for the other it must supply the actual client-side password for the CXF
infrastructure to validate.
HTH,
Glen
Naresh Tallapelli wrote:
>
> Hi All,
>
> I am using cxf 2.1.2 version. I tried to implement ws security. I have
> created passowrd call backs on both client and server sides. COnfigured
> password type to "PasswordText". Then i was to able to get the password on
> web services server side.
>
> But when i use password type to "PasswordDigest", password was sent to the
> server in enrypted format. But when i call
> "WSPasswordCallback.getPassword()" i am getting value as null. I am not
> sure if i miss anything.
>
> Please help to resolve this issue. I need to send the password in
> encrypted
> way.
>
> Thank you,
> Naresh.
>
>
--
View this message in context: http://old.nabble.com/ws-security-password-digest-tp28249087p28258160.html
Sent from the cxf-user mailing list archive at Nabble.com.
RE: ws security password digest
Posted by David Valeri <dv...@apache.org>.
I'm pretty sure that the password callback is asking your for the plain text
password for the user in this scenario. If you look at the WS-Security
UsernameToken Profile [1], the digest algorithm requires both parties to be
able to access a plain-text password or password equivalent to create/verify
a password digest. See the WSPasswordCallback JavaDoc for more info [2]. I
think the usage will be USERNAME_TOKEN instead of USERNAME_TOKEN_UNKNOWN.
WSS4J's callback handler is expecting you to look at the username in the
callback and provide a plain-text password for that user. WSS4J will then
use the plain-text password to verify the digest value provided in the
request. You should be aware that a digest password is not the same as an
encrypted password. They are different cryptographic activities and provide
different levels of security on password confidentiality.
[1]
http://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-os-UsernameTokenProfile.pd
f
[2]
http://ws.apache.org/wss4j/apidocs/org/apache/ws/security/WSPasswordCallback
.html
-----Original Message-----
From: Naresh Tallapelli [mailto:naresh.tallapelli@gmail.com]
Sent: Wednesday, April 14, 2010 6:22 PM
To: users@cxf.apache.org; dev@cxf.apache.org
Subject: ws security password digest
Hi All,
I am using cxf 2.1.2 version. I tried to implement ws security. I have
created passowrd call backs on both client and server sides. COnfigured
password type to "PasswordText". Then i was to able to get the password on
web services server side.
But when i use password type to "PasswordDigest", password was sent to the
server in enrypted format. But when i call
"WSPasswordCallback.getPassword()" i am getting value as null. I am not
sure if i miss anything.
Please help to resolve this issue. I need to send the password in encrypted
way.
Thank you,
Naresh.
Re: ws security password digest
Posted by "rahul.soa" <ra...@googlemail.com>.
Hi Naresh,
I think you might want to use WSPasswordCallback.USERNAME_TOKEN usage code for
PasswordDigest.
You may find following email thread useful:
http://old.nabble.com/PasswordDigest-and-PasswordText-difference-td24475866.html
I am not cxf developer, probably cxf people can tell you exact solution.
Many Thanks,
rahul
On Thu, Apr 15, 2010 at 12:22 AM, Naresh Tallapelli <
naresh.tallapelli@gmail.com> wrote:
> Hi All,
>
> I am using cxf 2.1.2 version. I tried to implement ws security. I have
> created passowrd call backs on both client and server sides. COnfigured
> password type to "PasswordText". Then i was to able to get the password on
> web services server side.
>
> But when i use password type to "PasswordDigest", password was sent to the
> server in enrypted format. But when i call
> "WSPasswordCallback.getPassword()" i am getting value as null. I am not
> sure if i miss anything.
>
> Please help to resolve this issue. I need to send the password in encrypted
> way.
>
> Thank you,
> Naresh.
>
Re: ws security password digest
Posted by "rahul.soa" <ra...@googlemail.com>.
Hi Naresh,
I think you might want to use WSPasswordCallback.USERNAME_TOKEN usage code for
PasswordDigest.
You may find following email thread useful:
http://old.nabble.com/PasswordDigest-and-PasswordText-difference-td24475866.html
I am not cxf developer, probably cxf people can tell you exact solution.
Many Thanks,
rahul
On Thu, Apr 15, 2010 at 12:22 AM, Naresh Tallapelli <
naresh.tallapelli@gmail.com> wrote:
> Hi All,
>
> I am using cxf 2.1.2 version. I tried to implement ws security. I have
> created passowrd call backs on both client and server sides. COnfigured
> password type to "PasswordText". Then i was to able to get the password on
> web services server side.
>
> But when i use password type to "PasswordDigest", password was sent to the
> server in enrypted format. But when i call
> "WSPasswordCallback.getPassword()" i am getting value as null. I am not
> sure if i miss anything.
>
> Please help to resolve this issue. I need to send the password in encrypted
> way.
>
> Thank you,
> Naresh.
>