Author: asoldano Date: 2014-10-30 12:12:20 -0400 (Thu, 30 Oct 2014) New Revision: 19042 Added: stack/cxf/branches/jbossws-cxf-4.3.x/modules/testsuite/cxf-tests/src/test/java/org/jboss/test/ws/jaxws/samples/wsse/policy/jaas/UsernameAuthorizationDigestEjbTestCase.java stack/cxf/branches/jbossws-cxf-4.3.x/modules/testsuite/cxf-tests/src/test/resources/jaxws/samples/wsse/policy/jaas/ejb-digest/ Modified: stack/cxf/branches/jbossws-cxf-4.3.x/ stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/JBossWSInvoker.java stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/AutenticationMgrSubjectCreatingInterceptor.java stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/SubjectCreatingInterceptor.java stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/SubjectCreatingPolicyInterceptor.java stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/SubjectCreator.java Log: Merged revisions 19030,19032-19033,19040-19041 via svnmerge from https://svn.jboss.org/repos/jbossws/stack/cxf/trunk ....... r19030 | jim.ma | 2014-10-24 16:14:55 +0200 (Fri, 24 Oct 2014) | 1 line [JBWS-3843]:EJB3 Web Service returns Invalid User on parallel invocations ....... r19032 | jim.ma | 2014-10-27 09:01:58 +0100 (Mon, 27 Oct 2014) | 1 line [JBWS-3843]:Add org.jboss.as.webservices.server.integration dependency to load UsernameTokenCallback ....... r19033 | asoldano | 2014-10-27 19:26:59 +0100 (Mon, 27 Oct 2014) | 2 lines [JBWS-3843] Making the test more robust... ;) ....... r19040 | asoldano | 2014-10-30 16:15:39 +0100 (Thu, 30 Oct 2014) | 2 lines [JBWS-3843] Adding comment explaining the workaround; proper fix will come in PicketBox ....... r19041 | asoldano | 2014-10-30 16:21:54 +0100 (Thu, 30 Oct 2014) | 2 lines [JBWS-3843] More workaround comments ....... Property changes on: stack/cxf/branches/jbossws-cxf-4.3.x ___________________________________________________________________ Modified: svnmerge-integrated - /stack/cxf/trunk:1-18594,18609-18612,18616-18619,18621,18625-18652,18656-18658,18661,18663,18665-18668,18671-18683,18685-18687,18689-18693,18695,18698,18701,18703-18704,18706-18710,18712-18713,18715,18717-18721,18726-18730,18732,18735-18737,18742,18745-18746,18750-18752,18755-18759,18762,18770,18777-18779,18781-18787,18796,18798,18805-18808,18811-18814,18816,18822-18824,18832-18835,18837,18839-18840,18842-18843,18845,18847-18848,18852,18856-18857,18859-18864,18866,18883-18884,18933,18947,19024-19026,19028,19034-19037 + /stack/cxf/trunk:1-18594,18609-18612,18616-18619,18621,18625-18652,18656-18658,18661,18663,18665-18668,18671-18683,18685-18687,18689-18693,18695,18698,18701,18703-18704,18706-18710,18712-18713,18715,18717-18721,18726-18730,18732,18735-18737,18742,18745-18746,18750-18752,18755-18759,18762,18770,18777-18779,18781-18787,18796,18798,18805-18808,18811-18814,18816,18822-18824,18832-18835,18837,18839-18840,18842-18843,18845,18847-18848,18852,18856-18857,18859-18864,18866,18883-18884,18933,18947,19024-19026,19028,19030,19032-19041 Modified: svn:mergeinfo - /stack/cxf/branches/asoldano:14032-14050,14068 /stack/cxf/branches/jaspi:18054-18409 /stack/cxf/branches/ropalka:16301-16305,16966-17008 /stack/cxf/branches/ropalka_JBWS-3550:16747-16757 /stack/cxf/trunk:18609,18616-18619,18629,18695,18710,18715,18798,18814,18816,18847,18852,18856,18860-18864,18866,18883-18884,18933,18947,19024-19025,19028,19036-19037 + /stack/cxf/branches/asoldano:14032-14050,14068 /stack/cxf/branches/jaspi:18054-18409 /stack/cxf/branches/ropalka:16301-16305,16966-17008 /stack/cxf/branches/ropalka_JBWS-3550:16747-16757 /stack/cxf/trunk:18609,18616-18619,18629,18695,18710,18715,18798,18814,18816,18847,18852,18856,18860-18864,18866,18883-18884,18933,18947,19024-19025,19028,19030,19032-19033,19036-19037,19040-19041 Modified: stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/JBossWSInvoker.java =================================================================== --- stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/JBossWSInvoker.java 2014-10-30 15:21:54 UTC (rev 19041) +++ stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/JBossWSInvoker.java 2014-10-30 16:12:20 UTC (rev 19042) @@ -42,6 +42,7 @@ import java.lang.reflect.Method; import java.util.List; +import javax.security.auth.callback.CallbackHandler; import javax.xml.ws.WebServiceContext; import org.apache.cxf.Bus; @@ -56,6 +57,7 @@ import org.apache.cxf.service.invoker.Invoker; import org.apache.cxf.service.invoker.MethodDispatcher; import org.apache.cxf.service.model.BindingOperationInfo; +import org.jboss.security.auth.callback.CallbackHandlerPolicyContextHandler; import org.jboss.ws.api.util.ServiceLoader; import org.jboss.wsf.spi.classloading.ClassLoaderProvider; import org.jboss.wsf.spi.deployment.Endpoint; @@ -126,7 +128,31 @@ } else if (o != null) { params = new MessageContentsList(o); } - return invoke(exchange, targetBean, adjustMethodAndParams(md.getMethod(bop), exchange, params), params); + if (factory != null) + { + targetBean = this.getServiceObject(exchange); + } + + //[JBWS-3843] workaround: set the CallbackHandler threadlocal again; as a matter of fact, if that's in the Exchange, + //DIGEST auth is being used and that will cause the EJB layer to re-do authentication because of the bug + CallbackHandler cbHandler = exchange.getInMessage().get(CallbackHandler.class); + Object obj = null; + try + { + if (cbHandler != null) + { + CallbackHandlerPolicyContextHandler.setCallbackHandler(cbHandler); + } + obj = invoke(exchange, targetBean, adjustMethodAndParams(md.getMethod(bop), exchange, params), params); + } + finally + { + if (cbHandler != null) + { + CallbackHandlerPolicyContextHandler.setCallbackHandler(null); + } + } + return obj; } /** Modified: stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/AutenticationMgrSubjectCreatingInterceptor.java =================================================================== --- stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/AutenticationMgrSubjectCreatingInterceptor.java 2014-10-30 15:21:54 UTC (rev 19041) +++ stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/AutenticationMgrSubjectCreatingInterceptor.java 2014-10-30 16:12:20 UTC (rev 19042) @@ -72,7 +72,7 @@ throw Messages.MESSAGES.unsupportedTokenType(token.getTokenType()); } UsernameToken ut = (UsernameToken) token; - subject = helper.createSubject(authenticationManger, ut.getName(), ut.getPassword(), ut.isHashed(), ut.getNonce(), ut.getCreatedTime()); + subject = helper.createSubject(authenticationManger, ut.getName(), ut.getPassword(), ut.isHashed(), ut.getNonce(), ut.getCreatedTime(), message); } else @@ -83,7 +83,7 @@ throw Messages.MESSAGES.couldNotGetSubjectInfo(); } WSUsernameTokenPrincipal up = (WSUsernameTokenPrincipal) p; - subject = helper.createSubject(authenticationManger, up.getName(), up.getPassword(), up.isPasswordDigest(), up.getNonce(), up.getCreatedTime()); + subject = helper.createSubject(authenticationManger, up.getName(), up.getPassword(), up.isPasswordDigest(), up.getNonce(), up.getCreatedTime(), message); } Principal principal = getPrincipal(context.getUserPrincipal(), subject); Modified: stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/SubjectCreatingInterceptor.java =================================================================== --- stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/SubjectCreatingInterceptor.java 2014-10-30 15:21:54 UTC (rev 19041) +++ stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/SubjectCreatingInterceptor.java 2014-10-30 16:12:20 UTC (rev 19042) @@ -104,7 +104,7 @@ UsernameToken ut = (UsernameToken)token; Subject subject = createSubject(ut.getName(), ut.getPassword(), ut.isHashed(), - ut.getNonce(), ut.getCreatedTime()); + ut.getNonce(), ut.getCreatedTime(), msg); SecurityContext sc = doCreateSecurityContext(context.getUserPrincipal(), subject); msg.put(SecurityContext.class, sc); @@ -152,7 +152,7 @@ Subject subject = null; try { - subject = createSubject(name, password, isDigest, nonce, created); + subject = createSubject(name, password, isDigest, nonce, created, msg); } catch (Exception ex) { @@ -240,9 +240,9 @@ } - public Subject createSubject(String name, String password, boolean isDigest, String nonce, String created) + public Subject createSubject(String name, String password, boolean isDigest, String nonce, String created, Message msg) { - return helper.createSubject(sdc.get(), name, password, isDigest, nonce, created); + return helper.createSubject(sdc.get(), name, password, isDigest, nonce, created, msg); } public void setPropagateContext(boolean propagateContext) Modified: stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/SubjectCreatingPolicyInterceptor.java =================================================================== --- stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/SubjectCreatingPolicyInterceptor.java 2014-10-30 15:21:54 UTC (rev 19041) +++ stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/SubjectCreatingPolicyInterceptor.java 2014-10-30 16:12:20 UTC (rev 19042) @@ -81,7 +81,7 @@ throw Messages.MESSAGES.unsupportedTokenType(token.getTokenType()); } UsernameToken ut = (UsernameToken) token; - subject = createSubject(sdc, ut.getName(), ut.getPassword(), ut.isHashed(), ut.getNonce(), ut.getCreatedTime()); + subject = createSubject(sdc, ut.getName(), ut.getPassword(), ut.isHashed(), ut.getNonce(), ut.getCreatedTime(), message); } else @@ -92,19 +92,19 @@ throw Messages.MESSAGES.couldNotGetSubjectInfo(); } WSUsernameTokenPrincipal up = (WSUsernameTokenPrincipal) p; - subject = createSubject(sdc, up.getName(), up.getPassword(), up.isPasswordDigest(), up.getNonce(), up.getCreatedTime()); + subject = createSubject(sdc, up.getName(), up.getPassword(), up.isPasswordDigest(), up.getNonce(), up.getCreatedTime(), message); } Principal principal = getPrincipal(context.getUserPrincipal(), subject); message.put(SecurityContext.class, createSecurityContext(principal, subject)); } - protected Subject createSubject(SecurityDomainContext sdc, String name, String password, boolean isDigest, String nonce, String creationTime) + protected Subject createSubject(SecurityDomainContext sdc, String name, String password, boolean isDigest, String nonce, String creationTime, Message msg) { Subject subject = null; try { - subject = helper.createSubject(sdc, name, password, isDigest, nonce, creationTime); + subject = helper.createSubject(sdc, name, password, isDigest, nonce, creationTime, msg); } catch (Exception ex) { Modified: stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/SubjectCreator.java =================================================================== --- stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/SubjectCreator.java 2014-10-30 15:21:54 UTC (rev 19041) +++ stack/cxf/branches/jbossws-cxf-4.3.x/modules/server/src/main/java/org/jboss/wsf/stack/cxf/security/authentication/SubjectCreator.java 2014-10-30 16:12:20 UTC (rev 19042) @@ -34,6 +34,7 @@ import javax.security.auth.callback.CallbackHandler; import org.apache.cxf.common.security.SimplePrincipal; +import org.apache.cxf.message.Message; import org.jboss.security.auth.callback.CallbackHandlerPolicyContextHandler; import org.jboss.security.plugins.JBossAuthenticationManager; import org.jboss.ws.common.utils.DelegateClassLoader; @@ -62,7 +63,7 @@ private boolean decodeNonce = true; - public Subject createSubject(SecurityDomainContext ctx, String name, String password, boolean isDigest, String nonce, String created) + public Subject createSubject(SecurityDomainContext ctx, String name, String password, boolean isDigest, String nonce, String created, Message msg) { if (isDigest) { @@ -75,6 +76,7 @@ CallbackHandler handler = new UsernameTokenCallbackHandler(nonce, created, decodeNonce); CallbackHandlerPolicyContextHandler.setCallbackHandler(handler); + msg.put(CallbackHandler.class, handler); } // authenticate and populate Subject @@ -126,7 +128,7 @@ return subject; } //TODO:refactor this - public Subject createSubject(JBossAuthenticationManager manager, String name, String password, boolean isDigest, String nonce, String created) + public Subject createSubject(JBossAuthenticationManager manager, String name, String password, boolean isDigest, String nonce, String created, Message msg) { if (isDigest) { @@ -139,6 +141,7 @@ CallbackHandler handler = new UsernameTokenCallbackHandler(nonce, created, decodeNonce); CallbackHandlerPolicyContextHandler.setCallbackHandler(handler); + msg.put(CallbackHandler.class, handler); } // authenticate and populate Subject Copied: stack/cxf/branches/jbossws-cxf-4.3.x/modules/testsuite/cxf-tests/src/test/java/org/jboss/test/ws/jaxws/samples/wsse/policy/jaas/UsernameAuthorizationDigestEjbTestCase.java (from rev 19030, stack/cxf/trunk/modules/testsuite/cxf-tests/src/test/java/org/jboss/test/ws/jaxws/samples/wsse/policy/jaas/UsernameAuthorizationDigestEjbTestCase.java) =================================================================== --- stack/cxf/branches/jbossws-cxf-4.3.x/modules/testsuite/cxf-tests/src/test/java/org/jboss/test/ws/jaxws/samples/wsse/policy/jaas/UsernameAuthorizationDigestEjbTestCase.java (rev 0) +++ stack/cxf/branches/jbossws-cxf-4.3.x/modules/testsuite/cxf-tests/src/test/java/org/jboss/test/ws/jaxws/samples/wsse/policy/jaas/UsernameAuthorizationDigestEjbTestCase.java 2014-10-30 16:12:20 UTC (rev 19042) @@ -0,0 +1,175 @@ +/* + * JBoss, Home of Professional Open Source. + * Copyright 2014, Red Hat Middleware LLC, and individual contributors + * as indicated by the @author tags. See the copyright.txt file in the + * distribution for a full listing of individual contributors. + * + * This is free software; you can redistribute it and/or modify it + * under the terms of the GNU Lesser General Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this software; if not, write to the Free + * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA + * 02110-1301 USA, or see the FSF site: http://www.fsf.org. + */ +package org.jboss.test.ws.jaxws.samples.wsse.policy.jaas; + +import java.io.File; +import java.net.URL; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.LinkedList; +import java.util.List; +import java.util.Map; +import java.util.concurrent.Callable; +import java.util.concurrent.ExecutorService; +import java.util.concurrent.Executors; +import java.util.concurrent.Future; + +import javax.xml.namespace.QName; +import javax.xml.ws.BindingProvider; +import javax.xml.ws.Service; + +import junit.framework.Test; + +import org.apache.cxf.ws.security.SecurityConstants; +import org.jboss.shrinkwrap.api.asset.StringAsset; +import org.jboss.wsf.stack.cxf.security.authentication.callback.UsernameTokenCallback; +import org.jboss.wsf.test.JBossWSCXFTestSetup; +import org.jboss.wsf.test.JBossWSTest; +import org.jboss.wsf.test.JBossWSTestHelper; +import org.jboss.wsf.test.JBossWSTestHelper.BaseDeployment; + +/** + * WS-Security Policy username ejb endpoint test case leveraging JAAS container integration and using digest passwords. + * WS-SecurityPolicy 1.2 used for policies in the included wsdl contract. + * + * @author alessio.soldano(a)jboss.com + * @author <a href="mailto:ema@redhat.com"/>Jim Ma<a> + * @since 26-May-2011 + */ +public final class UsernameAuthorizationDigestEjbTestCase extends JBossWSTest +{ + private final String serviceURL = "http://" + getServerHost() + ":8080/jaxws-samples-wsse-policy-username-jaas-ejb-digest/SecurityService/EJBServiceImpl"; + private QName serviceName = new QName("http://www.jboss.org/jbossws/ws-extensions/wssecuritypolicy";, "SecurityService"); + + public static BaseDeployment<?>[] createDeployments() + { + List<BaseDeployment<?>> list = new LinkedList<BaseDeployment<?>>(); + list.add(new JBossWSTestHelper.JarDeployment("jaxws-samples-wsse-policy-username-jaas-ejb-digest.jar") { + { //[JBWS-3843] workaround: add org.jboss.as.webservices.server.integration dependency to load UsernameTokenCallback for UsernamePasswordLoginModule + // This dependency should actually never be set for a user deployment, being it an internal server thing. To be properly replaced after changes in PicketBox. + archive + .setManifest(new StringAsset("Manifest-Version: 1.0\n" + "Dependencies: org.jboss.ws.cxf.jbossws-cxf-client,org.jboss.as.webservices.server.integration\n")) + .addClass(org.jboss.test.ws.jaxws.samples.wsse.policy.jaas.EJBServiceImpl.class) + .addClass(org.jboss.test.ws.jaxws.samples.wsse.policy.jaas.ServiceIface.class) + .addClass(org.jboss.test.ws.jaxws.samples.wsse.policy.jaxws.GreetMe.class) + .addClass(org.jboss.test.ws.jaxws.samples.wsse.policy.jaxws.GreetMeResponse.class) + .addClass(org.jboss.test.ws.jaxws.samples.wsse.policy.jaxws.SayHello.class) + .addClass(org.jboss.test.ws.jaxws.samples.wsse.policy.jaxws.SayHelloResponse.class) + .addAsManifestResource( + new File(JBossWSTestHelper.getTestResourcesDir() + "/jaxws/samples/wsse/policy/jaas/ejb-digest/META-INF/jaxws-endpoint-config.xml"), + "jaxws-endpoint-config.xml") + .addAsManifestResource( + new File(JBossWSTestHelper.getTestResourcesDir() + "/jaxws/samples/wsse/policy/jaas/ejb-digest/META-INF/wsdl/SecurityService.wsdl"), + "wsdl/SecurityService.wsdl") + .addAsManifestResource( + new File(JBossWSTestHelper.getTestResourcesDir() + "/jaxws/samples/wsse/policy/jaas/ejb-digest/META-INF/wsdl/SecurityService_schema1.xsd"), + "wsdl/SecurityService_schema1.xsd"); + } + }); + return list.toArray(new BaseDeployment<?>[list.size()]); + } + + public static Test suite() + { + JBossWSCXFTestSetup testSetup; + testSetup = new JBossWSCXFTestSetup(UsernameAuthorizationDigestEjbTestCase.class, JBossWSTestHelper.writeToFile(createDeployments())); + Map<String, String> authenticationOptions = new HashMap<String, String>(); + authenticationOptions.put("usersProperties", getResourceFile("jaxws/samples/wsse/policy/jaas/digest/WEB-INF/jbossws-users.properties").getAbsolutePath()); + authenticationOptions.put("rolesProperties", getResourceFile("jaxws/samples/wsse/policy/jaas/digest/WEB-INF/jbossws-roles.properties").getAbsolutePath()); + authenticationOptions.put("hashAlgorithm", "SHA"); + authenticationOptions.put("hashEncoding", "BASE64"); + authenticationOptions.put("hashCharset", "UTF-8"); + authenticationOptions.put("hashUserPassword", "false"); + authenticationOptions.put("hashStorePassword", "true"); + authenticationOptions.put("storeDigestCallback", UsernameTokenCallback.class.getName()); + authenticationOptions.put("unauthenticatedIdentity", "anonymous"); + testSetup.addSecurityDomainRequirement("JBossWS", authenticationOptions); + return testSetup; + } + + public void test() throws Exception + { + URL wsdlURL = new URL(serviceURL + "?wsdl"); + Service service = Service.create(wsdlURL, serviceName); + ServiceIface proxy = (ServiceIface)service.getPort(ServiceIface.class); + setupWsse(proxy, "kermit"); + assertEquals("Secure Hello World!", proxy.sayHello()); + } + + //JBWS-3843 + public void testConcurrent() throws Exception + { + ExecutorService executor = Executors.newFixedThreadPool(20); + + List<Callable<String>> taskList = new ArrayList<Callable<String>>(); + for (int i = 0; i < 20; i++) + { + taskList.add(new TestRunner()); + } + List<Future<String>> resultList = executor.invokeAll(taskList); + boolean passed = true; + for (Future<String> future : resultList) + { + passed = passed && future.get().equals("Secure Hello World!"); + } + assertTrue("Unexpected response from concurrent invocation", passed); + + } + + public class TestRunner implements Callable<String> + { + public String call() throws Exception + { + URL wsdlURL = new URL(serviceURL + "?wsdl"); + Service service = Service.create(wsdlURL, serviceName); + ServiceIface proxy = (ServiceIface)service.getPort(ServiceIface.class); + setupWsse(proxy, "kermit"); + return proxy.sayHello(); + + } + + } + + public void testUnauthenticated() throws Exception + { + URL wsdlURL = new URL(serviceURL + "?wsdl"); + Service service = Service.create(wsdlURL, serviceName); + ServiceIface proxy = (ServiceIface)service.getPort(ServiceIface.class); + setupWsse(proxy, "kermit"); + try + { + proxy.greetMe(); + fail("User kermit shouldn't be authenticated."); + } + catch (Exception e) + { + //OK + } + } + + private void setupWsse(ServiceIface proxy, String username) + { + ((BindingProvider)proxy).getRequestContext().put(SecurityConstants.USERNAME, username); + ((BindingProvider)proxy).getRequestContext().put(SecurityConstants.CALLBACK_HANDLER, + "org.jboss.test.ws.jaxws.samples.wsse.policy.jaas.UsernameDigestPasswordCallback"); + } +}