Return-Path: X-Original-To: apmail-axis-java-user-archive@www.apache.org Delivered-To: apmail-axis-java-user-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 3A3FAE953 for ; Thu, 7 Mar 2013 17:27:27 +0000 (UTC) Received: (qmail 79181 invoked by uid 500); 7 Mar 2013 17:27:25 -0000 Delivered-To: apmail-axis-java-user-archive@axis.apache.org Received: (qmail 78946 invoked by uid 500); 7 Mar 2013 17:27:23 -0000 Mailing-List: contact java-user-help@axis.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: java-user@axis.apache.org Delivered-To: mailing list java-user@axis.apache.org Received: (qmail 78906 invoked by uid 99); 7 Mar 2013 17:27:22 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 07 Mar 2013 17:27:22 +0000 X-ASF-Spam-Status: No, hits=2.2 required=5.0 tests=HTML_MESSAGE,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: local policy) Received: from [208.200.184.20] (HELO smtp.cgifederal.com) (208.200.184.20) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 07 Mar 2013 17:27:17 +0000 X-Sender-IP: 10.128.16.52 X-Sender-Reputation: None X-IronPort-AV: E=Sophos;i="4.84,803,1355115600"; d="scan'208,217";a="53916872" Received: from unknown (HELO FFX-S-EX-A2.cgifederal.com) ([10.128.16.52]) by smtp.cgifederal.com with ESMTP/TLS/AES128-SHA; 07 Mar 2013 12:29:00 -0500 Received: from FFX-S-EX-A5.cgifederal.com (10.128.16.58) by FFX-S-EX-A2.cgifederal.com (10.128.16.52) with Microsoft SMTP Server (TLS) id 14.2.247.3; Thu, 7 Mar 2013 12:26:57 -0500 Received: from FFX-S-EX-C1.cgifederal.com ([169.254.2.35]) by FFX-S-EX-A5.cgifederal.com ([10.128.16.58]) with mapi id 14.02.0247.003; Thu, 7 Mar 2013 12:26:57 -0500 From: "Shah, Sumit (CGI Federal)" To: "java-user@axis.apache.org" , "java-dev@axis.apache.org" Subject: RE: Rampart and WSS4J 1.6.x - USERNAME_TOKEN validation in Rampart WS-Password Callback Handler Thread-Topic: Rampart and WSS4J 1.6.x - USERNAME_TOKEN validation in Rampart WS-Password Callback Handler Thread-Index: Ac4Z4rq21a3y+t7bRRmh1yayD0r2QQBdNowg Date: Thu, 7 Mar 2013 17:26:55 +0000 Message-ID: <3357D2C72D9A0345A66DFB0B043C04166C9B15D8@FFX-S-EX-C1.cgifederal.com> References: <3357D2C72D9A0345A66DFB0B043C04166C9B0864@FFX-S-EX-C1.cgifederal.com> In-Reply-To: <3357D2C72D9A0345A66DFB0B043C04166C9B0864@FFX-S-EX-C1.cgifederal.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.16.36.136] Content-Type: multipart/alternative; boundary="_000_3357D2C72D9A0345A66DFB0B043C04166C9B15D8FFXSEXC1cgifede_" MIME-Version: 1.0 X-Virus-Checked: Checked by ClamAV on apache.org --_000_3357D2C72D9A0345A66DFB0B043C04166C9B15D8FFXSEXC1cgifede_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I did a little research and found that in the Rampart trunk, there is a cha= nge to address the issue below (also filed under https://issues.apache.org/= jira/browse/RAMPART-374). The change is to introduce a custom RampartUserna= meTokenValidator which is plugged in via the RampartMessageData. I am tryin= g to make this change to Rampart 1.6.2 branch/tag since we are on Rampart 1= .6.2. I tried the following steps: 1. SVN Checkout 1.6.2 tag http://svn.apache.org/repos/asf/axis/axis2/= java/rampart/tags/v1.6.2 2. I tried building this in Eclipse using 'MVN Install'. I get the following error when doing so. I would appreciate if you can plea= se point me to build this correctly. I was able to build the trunk correctl= y(using the same steps), but somehow unable to build this tag. [INFO] Scanning for projects... [INFO] --------------------------------------------------------------------= ---- [INFO] Reactor Build Order: [INFO] [INFO] Apache Rampart [INFO] Rampart - Policy [INFO] Rampart - Trust [INFO] Rampart - Core [INFO] Rampart - Test Suite [INFO] Rampart - Mar [INFO] Rampart - Trust-Mar [INFO] Rampart - Integration [INFO] Rampart - Samples [INFO] [INFO] --------------------------------------------------------------------= ---- [INFO] Building Apache Rampart 1.6.2 [INFO] --------------------------------------------------------------------= ---- [INFO] [INFO] --- maven-remote-resources-plugin:1.1:process (default) @ rampart-pr= oject --- [INFO] Setting property: classpath.resource.loader.class =3D> 'org.codehaus= .plexus.velocity.ContextClassLoaderResourceLoader'. [INFO] Setting property: velocimacro.messages.on =3D> 'false'. [INFO] Setting property: resource.loader =3D> 'classpath'. [INFO] Setting property: resource.manager.logwhenfound =3D> 'false'. [WARNING] Invalid POM for org.apache.axis2:axis2-kernel:jar:1.6.2, transiti= ve dependencies (if any) will not be available, enable debug logging for mo= re details [WARNING] Invalid POM for org.apache.axis2:mex:jar:impl:1.6.2, transitive d= ependencies (if any) will not be available, enable debug logging for more d= etails [WARNING] Invalid POM for org.apache.axis2:axis2-mtompolicy:jar:1.6.2, tran= sitive dependencies (if any) will not be available, enable debug logging fo= r more details [WARNING] Invalid POM for org.apache.axis2:addressing:mar:1.6.2, transitive= dependencies (if any) will not be available, enable debug logging for more= details [WARNING] Invalid POM for org.apache.ws.commons.axiom:axiom-dom:jar:1.2.13,= transitive dependencies (if any) will not be available, enable debug loggi= ng for more details [WARNING] Invalid project model for artifact [addressing:org.apache.axis2:1= .6.2]. It will be ignored by the remote resources Mojo. [WARNING] Invalid project model for artifact [axiom-dom:org.apache.ws.commo= ns.axiom:1.2.13]. It will be ignored by the remote resources Mojo. [WARNING] Invalid project model for artifact [axis2-kernel:org.apache.axis2= :1.6.2]. It will be ignored by the remote resources Mojo. [WARNING] Invalid project model for artifact [axis2-mtompolicy:org.apache.a= xis2:1.6.2]. It will be ignored by the remote resources Mojo. [WARNING] Invalid project model for artifact [mex:org.apache.axis2:1.6.2]. = It will be ignored by the remote resources Mojo. [INFO] [INFO] --- maven-install-plugin:2.3:install (default-install) @ rampart-pro= ject --- [INFO] Installing D:\dev\git\workspace\rampart-v1.6.2\v1.6.2\pom.xml to C:\= Users\sumshah\.m2\repository\org\apache\rampart\rampart-project\1.6.2\rampa= rt-project-1.6.2.pom [INFO] [INFO] --------------------------------------------------------------------= ---- [INFO] Building Rampart - Policy 1.6.2 [INFO] --------------------------------------------------------------------= ---- [WARNING] The POM for org.apache.axis2:axis2-kernel:jar:1.6.2 is invalid, t= ransitive dependencies (if any) will not be available, enable debug logging= for more details [WARNING] The POM for org.apache.axis2:mex:jar:impl:1.6.2 is invalid, trans= itive dependencies (if any) will not be available, enable debug logging for= more details [WARNING] The POM for org.apache.axis2:axis2-mtompolicy:jar:1.6.2 is invali= d, transitive dependencies (if any) will not be available, enable debug log= ging for more details [WARNING] The POM for org.apache.axis2:addressing:mar:1.6.2 is invalid, tra= nsitive dependencies (if any) will not be available, enable debug logging f= or more details [WARNING] The POM for org.apache.ws.commons.axiom:axiom-dom:jar:1.2.13 is i= nvalid, transitive dependencies (if any) will not be available, enable debu= g logging for more details [INFO] [INFO] --- maven-remote-resources-plugin:1.1:process (default) @ rampart-po= licy --- [WARNING] Invalid project model for artifact [addressing:org.apache.axis2:1= .6.2]. It will be ignored by the remote resources Mojo. [WARNING] Invalid project model for artifact [axiom-dom:org.apache.ws.commo= ns.axiom:1.2.13]. It will be ignored by the remote resources Mojo. [WARNING] Invalid project model for artifact [axis2-kernel:org.apache.axis2= :1.6.2]. It will be ignored by the remote resources Mojo. [WARNING] Invalid project model for artifact [axis2-mtompolicy:org.apache.a= xis2:1.6.2]. It will be ignored by the remote resources Mojo. [WARNING] Invalid project model for artifact [mex:org.apache.axis2:1.6.2]. = It will be ignored by the remote resources Mojo. [INFO] [INFO] --- maven-resources-plugin:2.4:resources (default-resources) @ rampa= rt-policy --- [INFO] Using 'UTF-8' encoding to copy filtered resources. [INFO] Copying 1 resource [INFO] Copying 3 resources [INFO] [INFO] --- maven-compiler-plugin:2.0:compile (default-compile) @ rampart-po= licy --- Compiling 89 source files to D:\dev\git\workspace\rampart-v1.6.2\v1.6.2\mod= ules\rampart-policy\target\classes [INFO] --------------------------------------------------------------------= ---- [INFO] Reactor Summary: [INFO] [INFO] Apache Rampart .................................... SUCCESS [0.972s] [INFO] Rampart - Policy .................................. FAILURE [0.725s] [INFO] Rampart - Trust ................................... SKIPPED [INFO] Rampart - Core .................................... SKIPPED [INFO] Rampart - Test Suite .............................. SKIPPED [INFO] Rampart - Mar ..................................... SKIPPED [INFO] Rampart - Trust-Mar ............................... SKIPPED [INFO] Rampart - Integration ............................. SKIPPED [INFO] Rampart - Samples ................................. SKIPPED [INFO] --------------------------------------------------------------------= ---- [INFO] BUILD FAILURE [INFO] --------------------------------------------------------------------= ---- [INFO] Total time: 2.349s [INFO] Finished at: Thu Mar 07 12:25:09 EST 2013 [INFO] Final Memory: 17M/328M [INFO] --------------------------------------------------------------------= ---- [ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plug= in:2.0:compile (default-compile) on project rampart-policy: Compilation fai= lure: Compilation failure: [ERROR] error: error reading C:\Users\sumshah\.m2\repository\org\apache\axi= s2\axis2-kernel\1.6.2\axis2-kernel-1.6.2.jar; error in opening zip file [ERROR] error: error reading C:\Users\sumshah\.m2\repository\org\apache\axi= s2\mex\1.6.2\mex-1.6.2-impl.jar; error in opening zip file [ERROR] error: error reading C:\Users\sumshah\.m2\repository\org\apache\axi= s2\axis2-mtompolicy\1.6.2\axis2-mtompolicy-1.6.2.jar; error in opening zip = file [ERROR] error: error reading C:\Users\sumshah\.m2\repository\org\apache\ws\= commons\axiom\axiom-dom\1.2.13\axiom-dom-1.2.13.jar; error in opening zip f= ile [ERROR] -> [Help 1] [ERROR] [ERROR] To see the full stack trace of the errors, re-run Maven with the -e= switch. [ERROR] Re-run Maven using the -X switch to enable full debug logging. [ERROR] [ERROR] For more information about the errors and possible solutions, pleas= e read the following articles: [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailu= reException [ERROR] [ERROR] After correcting the problems, you can resume the build with the co= mmand [ERROR] mvn -rf :rampart-policy From: Shah, Sumit (CGI Federal) Sent: Tuesday, March 05, 2013 3:48 PM To: java-user@axis.apache.org Subject: Rampart and WSS4J 1.6.x - USERNAME_TOKEN validation in Rampart WS-= Password Callback Handler WSS4j 1.6.x deprecated the use of WSPasswordCallback.USERNAME_TOKEN_UNKNOWN= (http://coheigea.blogspot.com/2011/02/usernametoken-processing-changes-in.= html) which was one of the methods to validate the plain text passwords on = the server side (@see Rampart Policy Sample01). Now, because of the deprec= ation it does not seem to be possible to validate plaintext password, espec= ially when the server side callback handler does not have access to the pla= in text password to validate against the password on the incoming request. = It seems like CXF has a way to plugin custom validators for WSS4J 1.6.x to = support this model (http://coheigea.blogspot.com/2011/06/custom-token-valid= ation-in-apache-cxf.html). I would appreciate any thoughts from the community. Maybe I am missing some= thing. Thanks Sumit --_000_3357D2C72D9A0345A66DFB0B043C04166C9B15D8FFXSEXC1cgifede_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I did a little researc= h and found that in the Rampart trunk, there is a change to address the iss= ue below (also filed under https://issue= s.apache.org/jira/browse/RAMPART-374). The change is to introduce a cus= tom RampartUsernameTokenValidator which is plugged in via the RampartMessag= eData. I am trying to make this change to Rampart 1.6.2 branch/tag since we are on Rampart 1.6.2. I tried the fol= lowing steps:

1.&n= bsp;      SVN Checkout 1= .6.2 tag http://svn.apache.org/repos/asf/axis/axis2/java/rampart/tags/v1.6.2

2.&n= bsp;      I tried buildi= ng this in Eclipse using ‘MVN Install’.

 

I get the following er= ror when doing so. I would appreciate if you can please point me to build t= his correctly. I was able to build the trunk correctly(using the same steps= ), but somehow unable to build this tag.

 

 

[INFO] Scanning for projects...=

[INFO] ------------------------= ------------------------------------------------

[INFO] Reactor Build Order:=

[INFO]

[INFO] Apache Rampart

[INFO] Rampart - Policy<= span style=3D"font-size:10.0pt;font-family:Consolas">

[INFO] Rampart - Trust

[INFO] Rampart - Core

[INFO] Rampart - Test Suite=

[INFO] Rampart - Mar

[INFO] Rampart - Trust-Mar<= /p>

[INFO] Rampart - Integration

[INFO] Rampart - Samples=

[INFO]    &= nbsp;           &nbs= p;             =             &nb= sp;            =             &nb= sp;     

[INFO] ------------------------= ------------------------------------------------

[INFO] Building Apache Rampart = 1.6.2

[INFO] ------------------------= ------------------------------------------------

[INFO]

[INFO] --- maven-remote-resourc= es-plugin:1.1:process (default) @ rampart-project ---

[INFO] Setting property: classp= ath.resource.loader.class =3D> 'org.codehaus.plexus.velocity.ContextClas= sLoaderResourceLoader'.

[INFO] Setting property: veloci= macro.messages.on =3D> 'false'.

[INFO] Setting property: resour= ce.loader =3D> 'classpath'.

[INFO] Setting property: resour= ce.manager.logwhenfound =3D> 'false'.

[WARNING] Invalid POM for org.a= pache.axis2:axis2-kernel:jar:1.6.2, transitive dependencies (if any) will n= ot be available, enable debug logging for more details

[WARNING] Invalid POM for org.a= pache.axis2:mex:jar:impl:1.6.2, transitive dependencies (if any) will not b= e available, enable debug logging for more details<= o:p>

[WARNING] Invalid POM for org.a= pache.axis2:axis2-mtompolicy:jar:1.6.2, transitive dependencies (if any) wi= ll not be available, enable debug logging for more details

[WARNING] Invalid POM for org.a= pache.axis2:addressing:mar:1.6.2, transitive dependencies (if any) will not= be available, enable debug logging for more details<= o:p>

[WARNING] Invalid POM for org.a= pache.ws.commons.axiom:axiom-dom:jar:1.2.13, transitive dependencies (if an= y) will not be available, enable debug logging for more details

[WARNING] Invalid project model= for artifact [addressing:org.apache.axis2:1.6.2]. It will be ignored by th= e remote resources Mojo.

[WARNING] Invalid project model= for artifact [axiom-dom:org.apache.ws.commons.axiom:1.2.13]. It will be ig= nored by the remote resources Mojo.

[WARNING] Invalid project model= for artifact [axis2-kernel:org.apache.axis2:1.6.2]. It will be ignored by = the remote resources Mojo.

[WARNING] Invalid project model= for artifact [axis2-mtompolicy:org.apache.axis2:1.6.2]. It will be ignored= by the remote resources Mojo.

[WARNING] Invalid project model= for artifact [mex:org.apache.axis2:1.6.2]. It will be ignored by the remot= e resources Mojo.

[INFO]

[INFO] --- maven-install-plugin= :2.3:install (default-install) @ rampart-project ---

[INFO] Installing D:\dev\git\wo= rkspace\rampart-v1.6.2\v1.6.2\pom.xml to C:\Users\sumshah\.m2\repository\or= g\apache\rampart\rampart-project\1.6.2\rampart-project-1.6.2.pom

[INFO]    &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;     

[INFO] ------------------------= ------------------------------------------------

[INFO] Building Rampart - Polic= y 1.6.2

[INFO] ------------------------= ------------------------------------------------

[WARNING] The POM for org.apach= e.axis2:axis2-kernel:jar:1.6.2 is invalid, transitive dependencies (if any)= will not be available, enable debug logging for more details

[WARNING] The POM for org.apach= e.axis2:mex:jar:impl:1.6.2 is invalid, transitive dependencies (if any) wil= l not be available, enable debug logging for more details

[WARNING] The POM for org.apach= e.axis2:axis2-mtompolicy:jar:1.6.2 is invalid, transitive dependencies (if = any) will not be available, enable debug logging for more details

[WARNING] The POM for org.apach= e.axis2:addressing:mar:1.6.2 is invalid, transitive dependencies (if any) w= ill not be available, enable debug logging for more details

[WARNING] The POM for org.apach= e.ws.commons.axiom:axiom-dom:jar:1.2.13 is invalid, transitive dependencies= (if any) will not be available, enable debug logging for more details

[INFO]

[INFO] --- maven-remote-resourc= es-plugin:1.1:process (default) @ rampart-policy ---

[WARNING] Invalid project model= for artifact [addressing:org.apache.axis2:1.6.2]. It will be ignored by th= e remote resources Mojo.

[WARNING] Invalid project model= for artifact [axiom-dom:org.apache.ws.commons.axiom:1.2.13]. It will be ig= nored by the remote resources Mojo.

[WARNING] Invalid project model= for artifact [axis2-kernel:org.apache.axis2:1.6.2]. It will be ignored by = the remote resources Mojo.

[WARNING] Invalid project model= for artifact [axis2-mtompolicy:org.apache.axis2:1.6.2]. It will be ignored= by the remote resources Mojo.

[WARNING] Invalid project model= for artifact [mex:org.apache.axis2:1.6.2]. It will be ignored by the remot= e resources Mojo.

[INFO]

[INFO] --- maven-resources-plug= in:2.4:resources (default-resources) @ rampart-policy ---

[INFO] Using 'UTF-8' encoding t= o copy filtered resources.

[INFO] Copying 1 resource

[INFO] Copying 3 resources<= /p>

[INFO]

[INFO] --- maven-compiler-plugi= n:2.0:compile (default-compile) @ rampart-policy ---

Compiling 89 source files to D:= \dev\git\workspace\rampart-v1.6.2\v1.6.2\modules\rampart-policy\target\clas= ses=

[INFO] ------------------------= ------------------------------------------------

[INFO] Reactor Summary:<= span style=3D"font-size:10.0pt;font-family:Consolas">

[INFO]

[INFO] Apache Rampart .........= ........................... SUCCESS [0.972s]

[INFO] Rampart - Policy .......= ........................... FAILURE [0.725s]

[INFO] Rampart - Trust ........= ........................... SKIPPED

[INFO] Rampart - Core .........= ........................... SKIPPED

[INFO] Rampart - Test Suite ...= ........................... SKIPPED

[INFO] Rampart - Mar ..........= ........................... SKIPPED

[INFO] Rampart - Trust-Mar ....= ........................... SKIPPED

[INFO] Rampart - Integration ..= ........................... SKIPPED

[INFO] Rampart - Samples ......= ........................... SKIPPED

[INFO] ------------------------= ------------------------------------------------

[INFO] BUILD FAILURE

[INFO] ------------------------= ------------------------------------------------

[INFO] Total time: 2.349s

[INFO] Finished at: Thu Mar 07 = 12:25:09 EST 2013

[INFO] Final Memory: 17M/328M

[INFO] ------------------------= ------------------------------------------------

[ERROR] Failed to execute goal = org.apache.maven.plugins:maven-compiler-plugin:2.0:compile (default-compile= ) on project rampart-policy: Compilation failure: Compilation failure:

[ERROR] error: error reading C:= \Users\sumshah\.m2\repository\org\apache\axis2\axis2-kernel\1.6.2\axis2-ker= nel-1.6.2.jar; error in opening zip file

[ERROR] error: error reading C:= \Users\sumshah\.m2\repository\org\apache\axis2\mex\1.6.2\mex-1.6.2-impl.jar= ; error in opening zip file

[ERROR] error: error reading C:= \Users\sumshah\.m2\repository\org\apache\axis2\axis2-mtompolicy\1.6.2\axis2= -mtompolicy-1.6.2.jar; error in opening zip file=

[ERROR] error: error reading C:= \Users\sumshah\.m2\repository\org\apache\ws\commons\axiom\axiom-dom\1.2.13\= axiom-dom-1.2.13.jar; error in opening zip file=

[ERROR] -> [Help 1]

[ERROR]

[ERROR] To see the full stack t= race of the errors, re-run Maven with the -e switch.

[ERROR] Re-run Maven using the = -X switch to enable full debug logging.

[ERROR]

[ERROR] For more information ab= out the errors and possible solutions, please read the following articles:<= /span>

[ERROR] [Help 1] = http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException

[ERROR]

[ERROR] After correcting the pr= oblems, you can resume the build with the command

[ERROR]   mvn <goa= ls> -rf :rampart-policy

 

 

 

From: Shah, Su= mit (CGI Federal)
Sent: Tuesday, March 05, 2013 3:48 PM
To: java-user@axis.apache.org
Subject: Rampart and WSS4J 1.6.x - USERNAME_TOKEN validation in Ramp= art WS-Password Callback Handler

 

WSS4j 1.6.x deprecated the use of WSPasswordCallback.USERNAME_TOKEN_UNKNOWN (http://coheigea.b= logspot.com/2011/02/usernametoken-processing-changes-in.html) which was= one of the methods to validate the plain text passwords on the server side (@see Rampart Policy Sample01). No= w,  because of the deprecation it does not seem to be possible to vali= date plaintext password, especially when the server side callback handler d= oes not have access to the plain text password to validate against the password on the incoming request. It seem= s like CXF has a way to plugin custom validators for WSS4J 1.6.x to support= this model (http://coheigea.blogspot.com/2011/06/custom-t= oken-validation-in-apache-cxf.html).

 

I would appreciate any thoughts from the community. Maybe I a= m missing something.

 

Thanks

Sumit

--_000_3357D2C72D9A0345A66DFB0B043C04166C9B15D8FFXSEXC1cgifede_--