[ https://jira.jboss.org/jira/browse/JBESB-2759?page=com.atlassian.jira.plu... ] David Ward updated JBESB-2759: ------------------------------ Summary: SOAPProxy should propagate Basic Auth information to and from proxied web serivce (was: SOAPProxy should propagate Basic Auth information to proxied web serivce) Workaround Description: (was: Basic Auth support could be accomplished by specifying a MappedHeaderList property at the SOAPProxy action property level that also includes "Authorization", so that it will be passed along to the external web service.) Description: 1) Currently, HttpSOAPProxyTransport has a default MappedHeaderList of "SOAPAction, Content-Type, Accept". These get pulled from the ESB Message (because they originally came in as HttpRequest headers) and propagated to the new request that gets sent to the actual external endpoint. "Authorization" should be added to this list so Basic Auth security still works. The fix should be easy, basically changing this line: setAttribute(cloned_config, "MappedHeaderList", "SOAPAction, Content-Type, Accept"); to this: setAttribute(cloned_config, "MappedHeaderList", "SOAPAction, Content-Type, Accept, Authorization"); in HttpSOAPProxyTransport.java. That way people don't need to even think about configuring it. It just gets propagated if it's already in the incoming request. As far as response headers coming back from the external endpoint, that has been resolved in JBESB-2511. So this would already come back: WWW-Authenticate: Basic realm="Secure Area" 2) Both JBossRemotingGatewayListener and HttpGatewayLisener should return the response code as well, which for this would be: HTTP/1.0 401 Authorization Required If I recall correctly, HttpGatewayLisener does return them, but JBossRemotingGatewayListener doesn't. I think. Would have to go back and check. was: Currently, HttpSOAPProxyTransport has a default MappedHeaderList of "SOAPAction, Content-Type, Accept". These get pulled from the ESB Message (because they originally came in as HttpRequest headers) and propagated to the new request that gets sent to the actual external endpoint. "Authorization" should be added to this list so Basic Auth security still works. The fix should be easy, basically changing this line: setAttribute(cloned_config, "MappedHeaderList", "SOAPAction, Content-Type, Accept"); to this: setAttribute(cloned_config, "MappedHeaderList", "SOAPAction, Content-Type, Accept, Authorization"); in HttpSOAPProxyTransport.java. That way people don't need to even think about configuring it. It just gets propagated if it's already in the incoming request. Workaround: (was: [Workaround Exists]) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBESB-2759?page=com.atlassian.jira.plu... ] David Ward closed JBESB-2759. ----------------------------- Resolution: Done Committed revision 28581. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira