Spring/spring-ws
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SWS-581 - allow for qualified password types by default

Browse Source
This commit is contained in:
Tareq Abedrabbo
2009-12-15 10:30:39 +00:00
parent d25afe7218
commit 6b33487838
2 changed files with 4 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java
View File

@@ -436,10 +436,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
handler.setOption(WSHandlerConstants.ADD_UT_ELEMENTS, securementUsernameTokenElements);
}
public void setAllowQualifiedPasswordTypes(boolean allowQualifiedPasswordTypes) {
securityEngine.getWssConfig().setAllowNamespaceQualifiedPasswordTypes(allowQualifiedPasswordTypes);
}
public void afterPropertiesSet() throws Exception {
Assert.isTrue(validationActions != null || securementActions != null,
"validationActions or securementActions are required");
@@ -454,6 +450,9 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
}
// securement actions are not to be validated at start up as they could
// be configured dynamically via the message context
// allow for qualified password types for .Net interoperability
securityEngine.getWssConfig().setAllowNamespaceQualifiedPasswordTypes(true);
}
protected void secureMessage(SoapMessage soapMessage, MessageContext messageContext)

16
security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorUsernameTokenTestCase.java
View File

@@ -51,28 +51,14 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j
assertValidateUsernameToken(message);
}
public void testValidateUsernameTokenAcceptQualifiedType() throws Exception {
public void testValidateUsernameTokenWithQualifiedType() throws Exception {
Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", true, false);
interceptor.setAllowQualifiedPasswordTypes(true);
SoapMessage message = loadMessage("usernameTokenPlainTextQualifiedType-soap.xml");
MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory());
interceptor.validateMessage(message, messageContext);
assertValidateUsernameToken(message);
}
public void testValidateUsernameTokenRejectQualifiedType() throws Exception {
Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", true, false);
interceptor.setAllowQualifiedPasswordTypes(false);
SoapMessage message = loadMessage("usernameTokenPlainTextQualifiedType-soap.xml");
MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory());
try {
interceptor.validateMessage(message, messageContext);
fail("Qualified password type was not rejected");
} catch (WsSecurityValidationException e) {
// expected
}
}
public void testAddUsernameTokenPlainText() throws Exception {
Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", false, false);
interceptor.setSecurementUsername("Bert");