7.4. Authenticating Received Credentials
Overview
On the server side, you can verify that received credentials are authentic by registering a callback handler with the Apache CXF runtime. You can either write your own custom code to perform credentials verification or you can implement a callback handler that integrates with a third-party enterprise security system (for example, an LDAP server).
Configuring a server callback handler in Spring XML
To configure a server callback handler that verifies
UsernameToken credentials received from clients, set the ws-security.callback-handler property in the server's Spring XML configuration, as follows:
<beans ... >
<jaxws:endpoint
id="UserNameOverTransport"
address="https://localhost:9001/UserNameOverTransport"
serviceName="interop:PingService10"
endpointName="interop:UserNameOverTransport_IPingService"
implementor="interop.server.UserNameOverTransport"
depends-on="tls-settings">
<jaxws:properties>
<entry key="ws-security.username" value="Alice"/>
<entry key="ws-security.callback-handler" value="interop.client.UTPasswordCallback"/>
</jaxws:properties>
</jaxws:endpoint>
...
</beans>
In the preceding example, the callback handler is implemented by the
UTPasswordCallback class.
Implementing the callback handler to check passwords
To implement a callback handler for checking passwords on the server side, implement the
javax.security.auth.callback.CallbackHandler interface. The general approach to implementing the CallbackHandler interface for a server is similar to implementing a CallbackHandler for a client. The interpretation given to the returned password on the server side is different, however: the password from the callback handler is compared against the received client password in order to verify the client's credentials.
For example, you could use the sample implementation shown in Example 7.2, “Callback Handler for UsernameToken Passwords” to obtain passwords on the server side. On the server side, the WSS4J runtime would compare the password obtained from the callback with the password in the received client credentials. If the two passwords match, the credentials are successfully verified.
A more realistic implementation of a server callback handler would involve writing an integration with a third-party database that is used to store security data (for example, integration with an LDAP server).
