From 751f270e72d29c3c1cd98dc9e14f8bb5f7134e09 Mon Sep 17 00:00:00 2001 From: Arjen Poutsma Date: Sat, 30 Sep 2006 09:24:33 +0000 Subject: [PATCH] Fixed #SWS-56: Digest passwords are never accepted in the SimplePasswordValidationCallbackHandler --- ...mplePasswordValidationCallbackHandler.java | 26 +++++++------------ ...PasswordValidationCallbackHandlerTest.java | 6 ++--- 2 files changed, 13 insertions(+), 19 deletions(-) diff --git a/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/SimplePasswordValidationCallbackHandler.java b/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/SimplePasswordValidationCallbackHandler.java index 74d9fb9c..be2f6a60 100644 --- a/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/SimplePasswordValidationCallbackHandler.java +++ b/security/src/main/java/org/springframework/ws/soap/security/xwss/callback/SimplePasswordValidationCallbackHandler.java @@ -16,20 +16,18 @@ package org.springframework.ws.soap.security.xwss.callback; +import com.sun.xml.wss.impl.callback.PasswordValidationCallback; +import com.sun.xml.wss.impl.callback.TimestampValidationCallback; +import org.springframework.beans.factory.InitializingBean; +import org.springframework.util.Assert; + +import javax.security.auth.callback.Callback; +import javax.security.auth.callback.UnsupportedCallbackException; import java.io.IOException; import java.util.Iterator; import java.util.Map; import java.util.Properties; -import javax.security.auth.callback.Callback; -import javax.security.auth.callback.UnsupportedCallbackException; - -import com.sun.xml.wss.impl.callback.PasswordValidationCallback; -import com.sun.xml.wss.impl.callback.TimestampValidationCallback; - -import org.springframework.beans.factory.InitializingBean; -import org.springframework.util.Assert; - /** * Simple callback handler that validates passwords agains a in-memory Properties object. Password * validation is done on a case-sensitive basis. @@ -60,21 +58,17 @@ public class SimplePasswordValidationCallbackHandler extends AbstractCallbackHan PasswordValidationCallback passwordCallback = (PasswordValidationCallback) callback; if (passwordCallback.getRequest() instanceof PasswordValidationCallback.PlainTextPasswordRequest) { passwordCallback.setValidator(new SimplePlainTextPasswordValidator()); - } - else if (passwordCallback.getRequest() instanceof PasswordValidationCallback.DigestPasswordRequest) { + } else if (passwordCallback.getRequest() instanceof PasswordValidationCallback.DigestPasswordRequest) { PasswordValidationCallback.DigestPasswordRequest digestPasswordRequest = (PasswordValidationCallback.DigestPasswordRequest) passwordCallback.getRequest(); String password = users.getProperty(digestPasswordRequest.getUsername()); digestPasswordRequest.setPassword(password); passwordCallback.setValidator(new PasswordValidationCallback.DigestPasswordValidator()); } - passwordCallback.setValidator(new SimplePlainTextPasswordValidator()); - } - else if (callback instanceof TimestampValidationCallback) { + } else if (callback instanceof TimestampValidationCallback) { TimestampValidationCallback timestampCallback = (TimestampValidationCallback) callback; timestampCallback.setValidator(new DefaultTimestampValidator()); - } - else { + } else { throw new UnsupportedCallbackException(callback); } } diff --git a/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/SimplePasswordValidationCallbackHandlerTest.java b/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/SimplePasswordValidationCallbackHandlerTest.java index ab195eb4..43cd16b7 100644 --- a/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/SimplePasswordValidationCallbackHandlerTest.java +++ b/security/src/test/java/org/springframework/ws/soap/security/xwss/callback/SimplePasswordValidationCallbackHandlerTest.java @@ -16,11 +16,11 @@ package org.springframework.ws.soap.security.xwss.callback; -import java.util.Properties; - import com.sun.xml.wss.impl.callback.PasswordValidationCallback; import junit.framework.TestCase; +import java.util.Properties; + public class SimplePasswordValidationCallbackHandlerTest extends TestCase { private SimplePasswordValidationCallbackHandler handler; @@ -69,7 +69,7 @@ public class SimplePasswordValidationCallbackHandlerTest extends TestCase { PasswordValidationCallback callback = new PasswordValidationCallback(request); handler.handleInternal(callback); boolean authenticated = callback.getResult(); - assertFalse("Authenticated", authenticated); + assertTrue("Authenticated", authenticated); }