From 37662a05e4f9a6af51428ce2e8aca9b399cbae03 Mon Sep 17 00:00:00 2001 From: cachescrubber Date: Wed, 10 Apr 2024 16:33:53 +0200 Subject: [PATCH] Wss4jHandler: override securement password using the message context (#1408) * Allow to override securementPassword via MessageContext * amend @author tags --- .../ws/soap/security/wss4j2/Wss4jHandler.java | 8 +++++++ .../wss4j2/Wss4jSecurityInterceptor.java | 3 +++ ...ssageInterceptorUsernameTokenTestCase.java | 24 +++++++++++++++---- 3 files changed, 31 insertions(+), 4 deletions(-) diff --git a/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jHandler.java b/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jHandler.java index 10fcf3d9..f8018ebc 100644 --- a/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jHandler.java +++ b/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jHandler.java @@ -16,6 +16,8 @@ package org.springframework.ws.soap.security.wss4j2; +import static org.springframework.ws.soap.security.wss4j2.Wss4jSecurityInterceptor.SECUREMENT_PASSWORD_PROPERTY_NAME; + import java.util.List; import java.util.Properties; @@ -26,6 +28,7 @@ import org.apache.wss4j.dom.engine.WSSecurityEngineResult; import org.apache.wss4j.dom.handler.HandlerAction; import org.apache.wss4j.dom.handler.RequestData; import org.apache.wss4j.dom.handler.WSHandler; +import org.springframework.util.StringUtils; import org.springframework.ws.context.MessageContext; import org.w3c.dom.Document; @@ -33,6 +36,7 @@ import org.w3c.dom.Document; * @author Tareq Abed Rabbo * @author Arjen Poutsma * @author Jamin Hitchcock + * @author Lars Uffmann * @since 2.3.0 */ class Wss4jHandler extends WSHandler { @@ -90,6 +94,10 @@ class Wss4jHandler extends WSHandler { @Override public String getPassword(Object msgContext) { + String contextPassword = (String)getProperty(msgContext, SECUREMENT_PASSWORD_PROPERTY_NAME); + if (StringUtils.hasLength(contextPassword)) { + return contextPassword; + } return securementPassword; } diff --git a/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java b/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java index de89dd05..3b457cf4 100644 --- a/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java +++ b/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java @@ -137,12 +137,15 @@ import org.w3c.dom.Element; * @author Greg Turnquist * @author Jamin Hitchcock * @author Rob Leland + * @author Lars Uffmann * @see Apache WSS4J 2.0 * @since 2.3.0 */ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor implements InitializingBean { public static final String SECUREMENT_USER_PROPERTY_NAME = "Wss4jSecurityInterceptor.securementUser"; + + public static final String SECUREMENT_PASSWORD_PROPERTY_NAME = "Wss4jSecurityInterceptor.securementPassword"; private String securementActions; diff --git a/spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorUsernameTokenTestCase.java b/spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorUsernameTokenTestCase.java index 6be44400..1dc3e9cc 100644 --- a/spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorUsernameTokenTestCase.java +++ b/spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorUsernameTokenTestCase.java @@ -88,7 +88,23 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j interceptor.secureMessage(message, messageContext); - assertAddUsernameTokenPlainText(message); + assertAddUsernameTokenPlainText(message, "Bert", "Ernie"); + } + + @Test + public void testAddUsernameTokenPlainTextContextCredentialsOverride() throws Exception { + Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", false, false); + interceptor.setSecurementUsername("Bert"); + interceptor.setSecurementPassword("Ernie"); + SoapMessage message = loadSoap11Message("empty-soap.xml"); + + MessageContext messageContext = getSoap11MessageContext(message); + messageContext.setProperty(Wss4jSecurityInterceptor.SECUREMENT_USER_PROPERTY_NAME, "Bibo"); + messageContext.setProperty(Wss4jSecurityInterceptor.SECUREMENT_PASSWORD_PROPERTY_NAME, "Elmo"); + + interceptor.secureMessage(message, messageContext); + + assertAddUsernameTokenPlainText(message, "Bibo","Elmo"); } @Test @@ -114,7 +130,7 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j getDocument(message)); } - protected void assertAddUsernameTokenPlainText(SoapMessage message) { + protected void assertAddUsernameTokenPlainText(SoapMessage message, String expectedUsername, String expectedPassword) { Object result = getMessage(message); @@ -122,9 +138,9 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j Document doc = getDocument(message); - assertXpathEvaluatesTo("Invalid Username", "Bert", + assertXpathEvaluatesTo("Invalid Username", expectedUsername, "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Username/text()", doc); - assertXpathEvaluatesTo("Invalid Password", "Ernie", + assertXpathEvaluatesTo("Invalid Password", expectedPassword, "/SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/wsse:UsernameToken/wsse:Password[@Type='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText']/text()", doc); }