cxf-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Eoghan Glynn (JIRA)" <j...@apache.org>
Subject [jira] Created: (CXF-435) Involve application in trust evaulation on 401 via callback
Date Thu, 22 Feb 2007 17:40:05 GMT
Involve application in trust evaulation on 401 via callback
-----------------------------------------------------------

                 Key: CXF-435
                 URL: https://issues.apache.org/jira/browse/CXF-435
             Project: CXF
          Issue Type: Sub-task
          Components: Transports
            Reporter: Eoghan Glynn
         Assigned To: Eoghan Glynn


Allow the application to specify a spring-loaded callback class to be notified when a 401
challenge is received.

This callback would be passed any relevant information that can be gleaned from the URLConnection,
i.e.:
- for HTTP: just the IP address of the challenging peer
- for HTTPS: the server cert & principal, ciphersuite etc.

The callback participates in the trust evaluation by deciding whether or not to hand out the
basic auth creds over this connection, and also to provide those creds dynamically (e.g. by
prompting the user) if not explicitly configured.

However the callback cannot cause a renegotiation of the TLS handshake (to use for example
stronger crypto) as the underlying SSLSocket is not available via the HttpsURLConnection interface,
so SSLSocket.startHandshake() cannot be called.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.


Mime
View raw message