You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by Dominique De Vito <do...@thalesgroup.com> on 2008/02/19 18:24:03 UTC

pb adding Username/Password WS-Security to 'java_first_spring_support' sample

Hi,

I have just tried to adapt the 'java_first_spring_support' sample to add 
Username/Password WS-Security.

So, I have added to client-beans.xml the following lines :

<property name="outInterceptors">
  <list>
     <bean class="org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor"/>
     <bean class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
     ...
  </list>
</property>

The sent XML payload looks like correct according to logged traces.

On the server-side, I have my endpoint with security interceptors :

 <jaxws:inInterceptors>
     <bean class="org.apache.cxf.interceptor.LoggingInInterceptor"/>
     <bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
       <constructor-arg>
         <map>
           <entry key="action" value="UsernameToken"/>
           <entry key="passwordType" value="PasswordText"/>
           <entry key="passwordCallbackClass" 
value="demo.spring.servlet.PasswordCallbackClass"/>
         </map>
       </constructor-arg>
     </bean>
     <bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor"/>
  </jaxws:inInterceptors>

And the PasswordCallbackClass is really called according to the traces.

My test is the following : on the client-side, I send a wrong password, 
then, I expect the server-side endpoint not to send me the regular 
"Hello Joe", but some fault.

But... the server-side endpoint just returns "Hello Joe", acting just 
like no password authentification was done.

Is anyone able to give me some hint to make this example work ?
Thanks.

Regards,
Dominique

PS : AFAIK the "samples" repository into the distrib does not include 
any example of Username/Password sample. Adding such security samples 
would be a "plus".

Re: pb adding Username/Password WS-Security to 'java_first_spring_support' sample

Posted by Dominique De Vito <do...@thalesgroup.com>.
Hi Colm,

Thanks for your quick response.
That's really a VERY BIG hint.

Sure, the page http://cwiki.apache.org/CXF20DOC/ws-security.html needs a 
refresh because the ServerPasswordCallback class just says:

WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];

if (pc.getId().equals("joe") {
  // set the password on the callback. This will be compared to the
  // password which was sent from the client.
  pc.setPassword("password");
}

in case of "Password type : plain text"....

I am going to edit it tomorrow.

Thanks again.

Regards,
Dominique


O hEigeartaigh, Colm a écrit :
> Hi Dominique,
>
> no error is being thrown because the UsernameTokenProcessor in WSS4J
> delegates password validation to the Callback Class for the case of
> plain-text passwords. Please see the javadoc for 
>
> org.apache.ws.security.processor.UsernameTokenProcessor#handleUsernameTo
> ken 
>
> at:
>
> http://ws.apache.org/wss4j/apidocs/index.html
>
> Colm.
>
> -----Original Message-----
> From: Dominique De Vito [mailto:dominique.devito@thalesgroup.com] 
> Sent: 19 February 2008 17:24
> To: cxf-user@incubator.apache.org
> Subject: pb adding Username/Password WS-Security to
> 'java_first_spring_support' sample
>
> Hi,
>
> I have just tried to adapt the 'java_first_spring_support' sample to add
>
> Username/Password WS-Security.
>
> So, I have added to client-beans.xml the following lines :
>
> <property name="outInterceptors">
>   <list>
>      <bean class="org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor"/>
>      <bean class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
>      ...
>   </list>
> </property>
>
> The sent XML payload looks like correct according to logged traces.
>
> On the server-side, I have my endpoint with security interceptors :
>
>  <jaxws:inInterceptors>
>      <bean class="org.apache.cxf.interceptor.LoggingInInterceptor"/>
>      <bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
>        <constructor-arg>
>          <map>
>            <entry key="action" value="UsernameToken"/>
>            <entry key="passwordType" value="PasswordText"/>
>            <entry key="passwordCallbackClass" 
> value="demo.spring.servlet.PasswordCallbackClass"/>
>          </map>
>        </constructor-arg>
>      </bean>
>      <bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor"/>
>   </jaxws:inInterceptors>
>
> And the PasswordCallbackClass is really called according to the traces.
>
> My test is the following : on the client-side, I send a wrong password, 
> then, I expect the server-side endpoint not to send me the regular 
> "Hello Joe", but some fault.
>
> But... the server-side endpoint just returns "Hello Joe", acting just 
> like no password authentification was done.
>
> Is anyone able to give me some hint to make this example work ?
> Thanks.
>
> Regards,
> Dominique
>
> PS : AFAIK the "samples" repository into the distrib does not include 
> any example of Username/Password sample. Adding such security samples 
> would be a "plus".
>
> ----------------------------
> IONA Technologies PLC (registered in Ireland)
> Registered Number: 171387
> Registered Address: The IONA Building, Shelbourne Road, Dublin 4, Ireland
>

RE: pb adding Username/Password WS-Security to 'java_first_spring_support' sample

Posted by "O hEigeartaigh, Colm" <Co...@iona.com>.
Hi Dominique,

no error is being thrown because the UsernameTokenProcessor in WSS4J
delegates password validation to the Callback Class for the case of
plain-text passwords. Please see the javadoc for 

org.apache.ws.security.processor.UsernameTokenProcessor#handleUsernameTo
ken 

at:

http://ws.apache.org/wss4j/apidocs/index.html

Colm.

-----Original Message-----
From: Dominique De Vito [mailto:dominique.devito@thalesgroup.com] 
Sent: 19 February 2008 17:24
To: cxf-user@incubator.apache.org
Subject: pb adding Username/Password WS-Security to
'java_first_spring_support' sample

Hi,

I have just tried to adapt the 'java_first_spring_support' sample to add

Username/Password WS-Security.

So, I have added to client-beans.xml the following lines :

<property name="outInterceptors">
  <list>
     <bean class="org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor"/>
     <bean class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
     ...
  </list>
</property>

The sent XML payload looks like correct according to logged traces.

On the server-side, I have my endpoint with security interceptors :

 <jaxws:inInterceptors>
     <bean class="org.apache.cxf.interceptor.LoggingInInterceptor"/>
     <bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
       <constructor-arg>
         <map>
           <entry key="action" value="UsernameToken"/>
           <entry key="passwordType" value="PasswordText"/>
           <entry key="passwordCallbackClass" 
value="demo.spring.servlet.PasswordCallbackClass"/>
         </map>
       </constructor-arg>
     </bean>
     <bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor"/>
  </jaxws:inInterceptors>

And the PasswordCallbackClass is really called according to the traces.

My test is the following : on the client-side, I send a wrong password, 
then, I expect the server-side endpoint not to send me the regular 
"Hello Joe", but some fault.

But... the server-side endpoint just returns "Hello Joe", acting just 
like no password authentification was done.

Is anyone able to give me some hint to make this example work ?
Thanks.

Regards,
Dominique

PS : AFAIK the "samples" repository into the distrib does not include 
any example of Username/Password sample. Adding such security samples 
would be a "plus".

----------------------------
IONA Technologies PLC (registered in Ireland)
Registered Number: 171387
Registered Address: The IONA Building, Shelbourne Road, Dublin 4, Ireland