Spring/spring-ws
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SWS-581 - added the possibility to allow qualified password types to Wss4jSecurityInterceptor

Browse Source
This commit is contained in:
Tareq Abedrabbo
2009-11-26 00:26:17 +00:00
parent db09ab3032
commit d25afe7218
3 changed files with 47 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java
View File

@@ -123,7 +123,9 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
private int timeToLive = 300;
private Wss4jHandler handler = new Wss4jHandler();
private final Wss4jHandler handler = new Wss4jHandler();
private final WSSecurityEngine securityEngine = WSSecurityEngine.getInstance();
public void setSecurementActions(String securementActions) {
this.securementActions = securementActions;
@@ -434,6 +436,10 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
handler.setOption(WSHandlerConstants.ADD_UT_ELEMENTS, securementUsernameTokenElements);
}
public void setAllowQualifiedPasswordTypes(boolean allowQualifiedPasswordTypes) {
securityEngine.getWssConfig().setAllowNamespaceQualifiedPasswordTypes(allowQualifiedPasswordTypes);
}
public void afterPropertiesSet() throws Exception {
Assert.isTrue(validationActions != null || securementActions != null,
"validationActions or securementActions are required");
@@ -508,7 +514,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
Document envelopeAsDocument = toDocument(soapMessage, messageContext);
// Header processing
WSSecurityEngine securityEngine = WSSecurityEngine.getInstance();
try {
Vector results = securityEngine

27
security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorUsernameTokenTestCase.java
View File

@@ -25,6 +25,7 @@ import org.springframework.ws.context.DefaultMessageContext;
import org.springframework.ws.context.MessageContext;
import org.springframework.ws.soap.SoapMessage;
import org.springframework.ws.soap.security.wss4j.callback.SimplePasswordValidationCallbackHandler;
import org.springframework.ws.soap.security.WsSecurityValidationException;
public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4jTestCase {
@@ -50,6 +51,28 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j
assertValidateUsernameToken(message);
}
public void testValidateUsernameTokenAcceptQualifiedType() throws Exception {
Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", true, false);
interceptor.setAllowQualifiedPasswordTypes(true);
SoapMessage message = loadMessage("usernameTokenPlainTextQualifiedType-soap.xml");
MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory());
interceptor.validateMessage(message, messageContext);
assertValidateUsernameToken(message);
}
public void testValidateUsernameTokenRejectQualifiedType() throws Exception {
Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", true, false);
interceptor.setAllowQualifiedPasswordTypes(false);
SoapMessage message = loadMessage("usernameTokenPlainTextQualifiedType-soap.xml");
MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory());
try {
interceptor.validateMessage(message, messageContext);
fail("Qualified password type was not rejected");
} catch (WsSecurityValidationException e) {
// expected
}
}
public void testAddUsernameTokenPlainText() throws Exception {
Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", false, false);
interceptor.setSecurementUsername("Bert");
@@ -115,13 +138,9 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j
SimplePasswordValidationCallbackHandler callbackHandler = new SimplePasswordValidationCallbackHandler();
callbackHandler.setUsers(users);
if (digest) {
// callbackHandler.setPasswordDigestRequired(true);
// callbackHandler.setPasswordPlainTextRequired(false);
interceptor.setSecurementPasswordType(WSConstants.PW_DIGEST);
}
else {
// callbackHandler.setPasswordDigestRequired(false);
// callbackHandler.setPasswordPlainTextRequired(true);
interceptor.setSecurementPasswordType(WSConstants.PW_TEXT);
}
interceptor.setValidationCallbackHandler(callbackHandler);

17
security/src/test/resources/org/springframework/ws/soap/security/wss4j/usernameTokenPlainTextQualifiedType-soap.xml Executable file
View File

@@ -0,0 +1,17 @@
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
SOAP-ENV:mustUnderstand="1">
<wsse:UsernameToken
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
wsu:Id="XWSSGID-1149200055993710197275"
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:Username>Bert</wsse:Username>
<wsse:Password wsse:Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">Ernie</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</SOAP-ENV:Header>
<SOAP-ENV:Body>
<tru:StockSymbol xmlns:tru="http://fabrikam123.com/payloads">QQQ</tru:StockSymbol>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>