From d25afe7218bf1615b9cac2a12b46bedcf9edf6eb Mon Sep 17 00:00:00 2001 From: Tareq Abedrabbo Date: Thu, 26 Nov 2009 00:26:17 +0000 Subject: [PATCH] SWS-581 - added the possibility to allow qualified password types to Wss4jSecurityInterceptor --- .../wss4j/Wss4jSecurityInterceptor.java | 9 +++++-- ...ssageInterceptorUsernameTokenTestCase.java | 27 ++++++++++++++++--- ...ernameTokenPlainTextQualifiedType-soap.xml | 17 ++++++++++++ 3 files changed, 47 insertions(+), 6 deletions(-) create mode 100755 security/src/test/resources/org/springframework/ws/soap/security/wss4j/usernameTokenPlainTextQualifiedType-soap.xml diff --git a/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java b/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java index 77a3eae5..eef5307e 100755 --- a/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java +++ b/security/src/main/java/org/springframework/ws/soap/security/wss4j/Wss4jSecurityInterceptor.java @@ -123,7 +123,9 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl private int timeToLive = 300; - private Wss4jHandler handler = new Wss4jHandler(); + private final Wss4jHandler handler = new Wss4jHandler(); + + private final WSSecurityEngine securityEngine = WSSecurityEngine.getInstance(); public void setSecurementActions(String securementActions) { this.securementActions = securementActions; @@ -434,6 +436,10 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl handler.setOption(WSHandlerConstants.ADD_UT_ELEMENTS, securementUsernameTokenElements); } + public void setAllowQualifiedPasswordTypes(boolean allowQualifiedPasswordTypes) { + securityEngine.getWssConfig().setAllowNamespaceQualifiedPasswordTypes(allowQualifiedPasswordTypes); + } + public void afterPropertiesSet() throws Exception { Assert.isTrue(validationActions != null || securementActions != null, "validationActions or securementActions are required"); @@ -508,7 +514,6 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl Document envelopeAsDocument = toDocument(soapMessage, messageContext); // Header processing - WSSecurityEngine securityEngine = WSSecurityEngine.getInstance(); try { Vector results = securityEngine diff --git a/security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorUsernameTokenTestCase.java b/security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorUsernameTokenTestCase.java index 336fa6bc..bdc8d725 100755 --- a/security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorUsernameTokenTestCase.java +++ b/security/src/test/java/org/springframework/ws/soap/security/wss4j/Wss4jMessageInterceptorUsernameTokenTestCase.java @@ -25,6 +25,7 @@ import org.springframework.ws.context.DefaultMessageContext; import org.springframework.ws.context.MessageContext; import org.springframework.ws.soap.SoapMessage; import org.springframework.ws.soap.security.wss4j.callback.SimplePasswordValidationCallbackHandler; +import org.springframework.ws.soap.security.WsSecurityValidationException; public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4jTestCase { @@ -50,6 +51,28 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j assertValidateUsernameToken(message); } + public void testValidateUsernameTokenAcceptQualifiedType() throws Exception { + Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", true, false); + interceptor.setAllowQualifiedPasswordTypes(true); + SoapMessage message = loadMessage("usernameTokenPlainTextQualifiedType-soap.xml"); + MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory()); + interceptor.validateMessage(message, messageContext); + assertValidateUsernameToken(message); + } + + public void testValidateUsernameTokenRejectQualifiedType() throws Exception { + Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", true, false); + interceptor.setAllowQualifiedPasswordTypes(false); + SoapMessage message = loadMessage("usernameTokenPlainTextQualifiedType-soap.xml"); + MessageContext messageContext = new DefaultMessageContext(message, getMessageFactory()); + try { + interceptor.validateMessage(message, messageContext); + fail("Qualified password type was not rejected"); + } catch (WsSecurityValidationException e) { + // expected + } + } + public void testAddUsernameTokenPlainText() throws Exception { Wss4jSecurityInterceptor interceptor = prepareInterceptor("UsernameToken", false, false); interceptor.setSecurementUsername("Bert"); @@ -115,13 +138,9 @@ public abstract class Wss4jMessageInterceptorUsernameTokenTestCase extends Wss4j SimplePasswordValidationCallbackHandler callbackHandler = new SimplePasswordValidationCallbackHandler(); callbackHandler.setUsers(users); if (digest) { -// callbackHandler.setPasswordDigestRequired(true); -// callbackHandler.setPasswordPlainTextRequired(false); interceptor.setSecurementPasswordType(WSConstants.PW_DIGEST); } else { -// callbackHandler.setPasswordDigestRequired(false); -// callbackHandler.setPasswordPlainTextRequired(true); interceptor.setSecurementPasswordType(WSConstants.PW_TEXT); } interceptor.setValidationCallbackHandler(callbackHandler); diff --git a/security/src/test/resources/org/springframework/ws/soap/security/wss4j/usernameTokenPlainTextQualifiedType-soap.xml b/security/src/test/resources/org/springframework/ws/soap/security/wss4j/usernameTokenPlainTextQualifiedType-soap.xml new file mode 100755 index 00000000..8d96909c --- /dev/null +++ b/security/src/test/resources/org/springframework/ws/soap/security/wss4j/usernameTokenPlainTextQualifiedType-soap.xml @@ -0,0 +1,17 @@ + + + + + Bert + Ernie + + + + + QQQ + + \ No newline at end of file