Spring/spring-ws
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Wss4jHandler: override securement password using the message context (#1408)

Browse Source 
* Allow to override securementPassword via MessageContext

* amend @author tags
This commit is contained in:
cachescrubber
2024-04-10 16:33:53 +02:00
committed by GitHub
parent 8d7bb43bd4
commit 37662a05e4
3 changed files with 31 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jHandler.java
View File

@@ -16,6 +16,8 @@
package org.springframework.ws.soap.security.wss4j2;
import static org.springframework.ws.soap.security.wss4j2.Wss4jSecurityInterceptor.SECUREMENT_PASSWORD_PROPERTY_NAME;
import java.util.List;
import java.util.Properties;
@@ -26,6 +28,7 @@ import org.apache.wss4j.dom.engine.WSSecurityEngineResult;
import org.apache.wss4j.dom.handler.HandlerAction;
import org.apache.wss4j.dom.handler.RequestData;
import org.apache.wss4j.dom.handler.WSHandler;
import org.springframework.util.StringUtils;
import org.springframework.ws.context.MessageContext;
import org.w3c.dom.Document;
@@ -33,6 +36,7 @@ import org.w3c.dom.Document;
* @author Tareq Abed Rabbo
* @author Arjen Poutsma
* @author Jamin Hitchcock
* @author Lars Uffmann
* @since 2.3.0
*/
class Wss4jHandler extends WSHandler {
@@ -90,6 +94,10 @@ class Wss4jHandler extends WSHandler {
@Override
public String getPassword(Object msgContext) {
String contextPassword = (String)getProperty(msgContext, SECUREMENT_PASSWORD_PROPERTY_NAME);
if (StringUtils.hasLength(contextPassword)) {
return contextPassword;
}
return securementPassword;
}

3
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java
View File

@@ -137,12 +137,15 @@ import org.w3c.dom.Element;
* @author Greg Turnquist
* @author Jamin Hitchcock
* @author Rob Leland
* @author Lars Uffmann
* @see <a href="http://ws.apache.org/wss4j/">Apache WSS4J 2.0</a>
* @since 2.3.0
*/
public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor implements InitializingBean {
public static final String SECUREMENT_USER_PROPERTY_NAME = "Wss4jSecurityInterceptor.securementUser";
public static final String SECUREMENT_PASSWORD_PROPERTY_NAME = "Wss4jSecurityInterceptor.securementPassword";
private String securementActions;

24
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorUsernameTokenTestCase.java
View File

@@ -88,7 +88,23 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j
interceptor.secureMessage(message, messageContext);
assertAddUsernameTokenPlainText(message);
assertAddUsernameTokenPlainText(message, "Bert", "Ernie");
}
@Test
public void testAddUsernameTokenPlainTextContextCredentialsOverride() throws Exception {
Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", false, false);
interceptor.setSecurementUsername("Bert");
interceptor.setSecurementPassword("Ernie");
SoapMessage message = loadSoap11Message("empty-soap.xml");
MessageContext messageContext = getSoap11MessageContext(message);
messageContext.setProperty(Wss4jSecurityInterceptor.SECUREMENT_USER_PROPERTY_NAME, "Bibo");
messageContext.setProperty(Wss4jSecurityInterceptor.SECUREMENT_PASSWORD_PROPERTY_NAME, "Elmo");
interceptor.secureMessage(message, messageContext);
assertAddUsernameTokenPlainText(message, "Bibo","Elmo");
}
@Test
@@ -114,7 +130,7 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j
getDocument(message));
}
protected void assertAddUsernameTokenPlainText(SoapMessage message) {
protected void assertAddUsernameTokenPlainText(SoapMessage message, String expectedUsername, String expectedPassword) {
Object result = getMessage(message);
@@ -122,9 +138,9 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j
Document doc = getDocument(message);
assertXpathEvaluatesTo("Invalid Username", "Bert",
assertXpathEvaluatesTo("Invalid Username", expectedUsername,
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Username/text()", doc);
assertXpathEvaluatesTo("Invalid Password", "Ernie",
assertXpathEvaluatesTo("Invalid Password", expectedPassword,
"/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Password[@Type='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText']/text()",
doc);
}