11.4. Authentication

Procedure 11.1. On the Server

• Specify Interceptors

  Specify (possibly by using a jbossws-cxf.xml descriptor):
  1. An interceptor for performing authentication and populating a valid SecurityContext; the provided interceptor should extend org.apache.cxf.ws.security.wss4j.AbstractUsernameTokenAuthenticatingInterceptor.
     JBossWS integration comes with org.jboss.wsf.stack.cxf.security.authentication.SubjectCreatingInterceptor for this use.
  2. An interceptor for performing authorization; CXF requires this to extend org.apache.cxf.interceptor.security.AbstractAuthorizingInInterceptor.
     For instance, the SimpleAuthorizingInterceptor can be used for mapping endpoint operations to allowed roles.

  Example 11.1. SimpleAuthorizingInterceptor

  <beans
       xmlns='http://www.springframework.org/schema/beans'
       xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
       xmlns:beans='http://www.springframework.org/schema/beans'
       xmlns:jaxws='http://cxf.apache.org/jaxws'
       xmlns:util='http://www.springframework.org/schema/util'
       xsi:schemaLocation='http://cxf.apache.org/core
         http://cxf.apache.org/schemas/core.xsd
         http://www.springframework.org/schema/util
         http://www.springframework.org/schema/util/spring-util-2.0.xsd
         http://www.springframework.org/schema/beans
         http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
         http://cxf.apache.org/jaxws
         http://cxf.apache.org/schemas/jaxws.xsd'>
       
       <bean id="SecurityContextIn"
          class="org.jboss.wsf.stack.cxf.security.authentication.SubjectCreatingInterceptor">
         <constructor-arg>
           <map>
             <entry key="action" value="UsernameToken"/> 
           </map>
         </constructor-arg>
       </bean>
      
       <util:map id="methodPermissions">
          <entry key="sayHello" value="friend"/> 
          <entry key="greetMe" value="snoopies"/> 
       </util:map>
      
       <bean id="AuthorizeIn"
         class="org.apache.cxf.interceptor.security.SimpleAuthorizingInterceptor">
        <property name="methodRolesMap" ref="methodPermissions"/> 
       </bean>
       
       <jaxws:endpoint
         id='ServiceImpl'
         address='http://@jboss.bind.address@:8080/jaxws-samples-wsse-username-authorize'
         implementor='org.jboss.test.ws.jaxws.samples.wsse.ServiceImpl'>
         <jaxws:inInterceptors>
             <ref bean="SecurityContextIn"/>
             <ref bean="AuthorizeIn"/>
             <bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor"/>
         </jaxws:inInterceptors>
       </jaxws:endpoint>
     </beans>

  Copy to Clipboard Toggle word wrap
  Authentication and authorization will be delegated to the security domain configured for the endpoint.

Procedure 11.2. On the Client

1. Ensure the username is provided through the API (or a custom Spring configuration used to load the Bus):

   Example 11.2. Username API

   Endpoint cxfEndpoint = client.getEndpoint();
   Map<String, Object> outProps = new HashMap<String, Object>();
   outProps.put("action", "UsernameToken");
   outProps.put("user", username);
   outProps.put("passwordType", "PasswordText");
   outProps.put("passwordCallbackClass", "org.jboss.test.ws.jaxws.samples.wsse.UsernamePasswordCallback");
   WSS4JOutInterceptor wssOut = new WSS4JOutInterceptor(outProps); //request
   cxfEndpoint.getOutInterceptors().add(wssOut);
   cxfEndpoint.getOutInterceptors().add(new SAAJOutInterceptor());
   

   Copy to Clipboard Toggle word wrap
2. The password instead is provided through a password callback handler that needs to implement javax.security.auth.callback.CallbackHandler, similarly to the keystore's password callback handler.
   If you are using an older JBossWS-CXF version, or you are not configuring the application server authorization integration, you can use a password callback handler on server side too, configured through a WSS4JInInterceptor:

   Example 11.3. Callback Handler

   <bean id="UsernameToken_Request" class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
     <constructor-arg>
       <map>
         <entry key="action" value="UsernameToken"/> 
         <entry key="passwordCallbackClass" value="org.jboss.test.ws.jaxws.samples.wsse.ServerUsernamePasswordCallback"/> 
       </map>
     </constructor-arg>
   </bean>

   Copy to Clipboard Toggle word wrap

   Example 11.4. WSS4JInInterceptor callback handler

   package org.jboss.test.ws.jaxws.samples.wsse;
    
   import java.io.IOException;
   import javax.security.auth.callback.CallbackHandler;
   import javax.security.auth.callback.UnsupportedCallbackException;
   import org.apache.ws.security.WSPasswordCallback;
    
   public class ServerUsernamePasswordCallback implements CallbackHandler
   {
      public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException
      {
         WSPasswordCallback pc = (WSPasswordCallback)callbacks[0];
         if (!("kermit".equals(pc.getIdentifier()) && "thefrog".equals(pc.getPassword())))
            throw new SecurityException("User '" + pc.getIdentifier() + "' with password '" + pc.getPassword() + "' not allowed.");
      }
   }

   Copy to Clipboard Toggle word wrap