Return-Path: 
 <java-dev-return-88807-apmail-axis-java-dev-archive=axis.apache.org@axis.apache.org>
X-Original-To: apmail-axis-java-dev-archive@www.apache.org
Delivered-To: apmail-axis-java-dev-archive@www.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id 89D3FDDF2
	for <apmail-axis-java-dev-archive@www.apache.org>;
 Wed, 18 Jul 2012 10:39:36 +0000 (UTC)
Received: (qmail 74891 invoked by uid 500); 18 Jul 2012 10:39:35 -0000
Delivered-To: apmail-axis-java-dev-archive@axis.apache.org
Received: (qmail 74781 invoked by uid 500); 18 Jul 2012 10:39:35 -0000
Mailing-List: contact java-dev-help@axis.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:java-dev-help@axis.apache.org>
List-Unsubscribe: <mailto:java-dev-unsubscribe@axis.apache.org>
List-Post: <mailto:java-dev@axis.apache.org>
List-Id: <java-dev.axis.apache.org>
Reply-To: java-dev@axis.apache.org
Delivered-To: mailing list java-dev@axis.apache.org
Received: (qmail 74751 invoked by uid 99); 18 Jul 2012 10:39:35 -0000
Received: from issues-vm.apache.org (HELO issues-vm) (140.211.11.160)
    by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 18 Jul 2012 10:39:35 +0000
Received: from isssues-vm.apache.org (localhost [127.0.0.1])
	by issues-vm (Postfix) with ESMTP id 19809141826
	for <java-dev@axis.apache.org>; Wed, 18 Jul 2012 10:39:35 +0000 (UTC)
Date: Wed, 18 Jul 2012 10:39:35 +0000 (UTC)
From: "Yoann Guerro (JIRA)" <jira@apache.org>
To: java-dev@axis.apache.org
Message-ID: <507238700.68449.1342607975108.JavaMail.jiratomcat@issues-vm>
Subject: [jira] [Created] (RAMPART-383) sp:HashPassword from
 WS-SecurityPolicy 1.2 assertion doesn't work
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394

Yoann Guerro created RAMPART-383:
------------------------------------

             Summary: sp:HashPassword from WS-SecurityPolicy 1.2 assertion doesn't work
                 Key: RAMPART-383
                 URL: https://issues.apache.org/jira/browse/RAMPART-383
             Project: Rampart
          Issue Type: Bug
          Components: rampart-policy
    Affects Versions: 1.6.2
         Environment: Windows XP Professional
Java 1.6.0_26
Eclipse 3.5.1
Axis2 1.6.2
Neethi 3.0.2
            Reporter: Yoann Guerro


I have a WSDL with the following policy:

<sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
	<wsp:Policy>
		<sp:HashPassword />
		<sp:WssUsernameToken11 />
	</wsp:Policy>
</sp:UsernameToken>

According the WS-SecurityPolicy 1.2 which is supported by Rampart 1.6.2 (modulo the workaround from issue <a href="https://issues.apache.org/jira/browse/RAMPART-371">RAMPART-371</a> the policy grammar is as follows:



<sp:UsernameToken sp:IncludeToken="xs:anyURI"? xmlns:sp="..." ... >
  (
    <sp:Issuer>wsa:EndpointReferenceType</sp:Issuer> |  
    <sp:IssuerName>xs:anyURI</sp:IssuerName>
  ) ?
  <wst:Claims Dialect="..."> ... </wst:Claims> ?
  <wsp:Policy xmlns:wsp="...">
    (
      <sp:NoPassword ... /> |
      <sp:HashPassword ... />
    ) ?
   (
      <sp:RequireDerivedKeys /> |
      <sp:RequireImpliedDerivedKeys ... /> |
      <sp:RequireExplicitDerivedKeys ... />
    ) ?
    (
      <sp:WssUsernameToken10 ... /> |
      <sp:WssUsernameToken11 ... />
    ) ?
    ...
  </wsp:Policy>
  ...
</sp:UsernameToken>

My policy respect the grammar.

But while launching a client, setting username and password callback, the output shows the following section:

<wsse:UsernameToken wsu:Id="UsernameToken-1">
	<wsse:Username>USER</wsse:Username>
	<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">PASSWORD</wsse:Password>
</wsse:UsernameToken>

And debugging the code, the rampart policy does create a UsernameToken with hashpassword attribute set to false.

I thought it was due to the following <a href="https://issues.apache.org/jira/browse/NEETHI-3">neethi issue</a> but using the same version of neethi with CXF and WSS4J it works (I mean password digest is sent)

Note that I'm not using a rampart configuration, just engaging the module as follows:

	mProxy._getServiceClient().engageModule("rampart");
	// Set Password callback	
	mProxy._getServiceClient().getOptions().setProperty(WSHandlerConstants.PW_CALLBACK_REF, new ClientPasswordCallbackHandler());
	// Set User name
	mProxy._getServiceClient().getOptions().setUserName("USER");


--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

        

---------------------------------------------------------------------
To unsubscribe, e-mail: java-dev-unsubscribe@axis.apache.org
For additional commands, e-mail: java-dev-help@axis.apache.org