Return-Path: X-Original-To: apmail-axis-java-user-archive@www.apache.org Delivered-To: apmail-axis-java-user-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id A18D7D0B6 for ; Tue, 5 Mar 2013 20:46:17 +0000 (UTC) Received: (qmail 45964 invoked by uid 500); 5 Mar 2013 20:46:16 -0000 Delivered-To: apmail-axis-java-user-archive@axis.apache.org Received: (qmail 45911 invoked by uid 500); 5 Mar 2013 20:46:16 -0000 Mailing-List: contact java-user-help@axis.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: java-user@axis.apache.org Delivered-To: mailing list java-user@axis.apache.org Received: (qmail 45903 invoked by uid 99); 5 Mar 2013 20:46:16 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 05 Mar 2013 20:46:16 +0000 X-ASF-Spam-Status: No, hits=2.2 required=5.0 tests=HTML_MESSAGE,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: local policy) Received: from [208.200.184.20] (HELO smtp.cgifederal.com) (208.200.184.20) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 05 Mar 2013 20:46:11 +0000 X-Sender-IP: 10.128.16.50 X-Sender-Reputation: None X-IronPort-AV: E=Sophos;i="4.84,790,1355115600"; d="scan'208,217";a="53652077" Received: from unknown (HELO FFX-S-EX-A1.cgifederal.com) ([10.128.16.50]) by smtp.cgifederal.com with ESMTP/TLS/AES128-SHA; 05 Mar 2013 15:47:54 -0500 Received: from FFX-S-EX-C1.cgifederal.com ([169.254.2.35]) by FFX-S-EX-A1.cgifederal.com ([10.128.16.50]) with mapi id 14.02.0247.003; Tue, 5 Mar 2013 15:48:03 -0500 From: "Shah, Sumit (CGI Federal)" To: "java-user@axis.apache.org" Subject: Rampart and WSS4J 1.6.x - USERNAME_TOKEN validation in Rampart WS-Password Callback Handler Thread-Topic: Rampart and WSS4J 1.6.x - USERNAME_TOKEN validation in Rampart WS-Password Callback Handler Thread-Index: Ac4Z4rq21a3y+t7bRRmh1yayD0r2QQ== Date: Tue, 5 Mar 2013 20:48:02 +0000 Message-ID: <3357D2C72D9A0345A66DFB0B043C04166C9B0864@FFX-S-EX-C1.cgifederal.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.16.36.136] Content-Type: multipart/alternative; boundary="_000_3357D2C72D9A0345A66DFB0B043C04166C9B0864FFXSEXC1cgifede_" MIME-Version: 1.0 X-Virus-Checked: Checked by ClamAV on apache.org --_000_3357D2C72D9A0345A66DFB0B043C04166C9B0864FFXSEXC1cgifede_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable WSS4j 1.6.x deprecated the use of WSPasswordCallback.USERNAME_TOKEN_UNKNOWN= (http://coheigea.blogspot.com/2011/02/usernametoken-processing-changes-in.= html) which was one of the methods to validate the plain text passwords on = the server side (@see Rampart Policy Sample01). Now, because of the deprec= ation it does not seem to be possible to validate plaintext password, espec= ially when the server side callback handler does not have access to the pla= in text password to validate against the password on the incoming request. = It seems like CXF has a way to plugin custom validators for WSS4J 1.6.x to = support this model (http://coheigea.blogspot.com/2011/06/custom-token-valid= ation-in-apache-cxf.html). I would appreciate any thoughts from the community. Maybe I am missing some= thing. Thanks Sumit --_000_3357D2C72D9A0345A66DFB0B043C04166C9B0864FFXSEXC1cgifede_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

WSS4j 1.6.x deprecated the use of WSPasswordCallback.USERNAME_TOKEN_UNKNOWN (http://coheigea.blogspot.com/201= 1/02/usernametoken-processing-changes-in.html) which was one of the methods= to validate the plain text passwords on the server side (@see Rampart Poli= cy Sample01). Now, because of the deprecation it does not seem to be possible to validate plaintext password= , especially when the server side callback handler does not have access to = the plain text password to validate against the password on the incoming re= quest. It seems like CXF has a way to plugin custom validators for WSS4J 1.6.x to support this model (http://= coheigea.blogspot.com/2011/06/custom-token-validation-in-apache-cxf.html).

I would appreciate any thoughts from the community. Maybe I a= m missing something.

Thanks

Sumit

--_000_3357D2C72D9A0345A66DFB0B043C04166C9B0864FFXSEXC1cgifede_--