common webservice interceptor and UsernameTokenValidation compatible with Spring-WS and CXF

Question

I have a scenario, where I want to configure a webservice security interceptor, and a UsernameTokenValidator and put this into say myws-security.jar. Which can be then be used by any webservice (be it CXF based or Spring-WS) that uses this jar. What would be the practice to deal with this scenario.

Would configuring an interceptor with org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor class , or org.springframework.ws.soap.security.wss4j.Wss4jSecurityInterceptor work for me in this case ?

score 0 · Answer 1 · answered Dec 07 '11 at 01:43

In both Spring-WS and CXF, you typically do not provide your own WSS interceptor, you simply configure the provided interceptor with an appropriate callback handler. So in your case if you create an appropriate callback handler(based on the type of securement action), which needs to inherit from javax.security.auth.callback.CallbackHandler, this callback handler can be reused in Spring-WS and Apache CXF:

In Spring-WS you would do something along these lines:

<bean id="wss4jSecurityInterceptor" class="org.springframework.ws.soap.security.wss4j.Wss4jSecurityInterceptor">
    <property name="validationCallbackHandler" ref="callBackHandler" />
    <property name="validationActions" value="UsernameToken" />
</bean>

And in Apache CXF:

<jaxws:endpoint address=".." id=".." implementor="#memberendpoint">
    <jaxws:inInterceptors>
        <bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
            <constructor-arg>
                <map>
                    <entry key="action" value="UsernameToken" />
                    <entry key="passwordType" value="PasswordDigest" />
                    <entry key="passwordCallbackRef">
                        <ref bean="callBackHandler" />
                    </entry>
                </map>
            </constructor-arg>
        </bean>
    </jaxws:inInterceptors>

And the common callbackhandler should work for you in both cases

common webservice interceptor and UsernameTokenValidation compatible with Spring-WS and CXF

1 Answers1