[ https://jira.jboss.org/jira/browse/JBWS-2833?page=com.atlassian.jira.plug... ] Morten Andersen updated JBWS-2833: ---------------------------------- Description: When exposing a webservice using the "@WebServiceProvider" annotation, and protecting it with WSSE username token the WebServiceContext#userPrincipal is not set. The WEB-INF/jboss-wsse-server.xml is configured as described here: http://www.jboss.org/community/wiki/JBossWS-WS-Securityoptions#POJO_Endpo... Although this does not really seem to be enough, as it is also required to have META-INF/standard-jaxws-endpoint-config.xml file with only the "Standard WSSecurity Endpoint" on the server to actually enforce the authentication of the username token. Attached: * wstest.war: example war - exposing one webservice (compiled from the content of server.zip) * server.zip: source for the wstest.war * client.zip: simple client for the server, sending a username token. Reproducing the problem: 1) deploy wstest.war to a jboss 5.1.0 2) open the run.sh in the client.zip, and set the JBOSS_5 to fit your installation. It the server is not listening on 8080, modify the url in the client source (WsExampleClient.java). 3) compile and run the client, by running ./run.sh 4) inspect the server log. If this says: "[INFO] Principal = null" we have the problem (expected principal = admin) Server code: * service: server.zip:src/main/java/org/example/WsExample.java * wsdl: server.zip:src/main/webapp/WEB-INF/wsdl * wsse-config: server.zip:src/main/webapp/WEB-INF/jboss-wsse-server.xml * wsse-config2: server.zip:src/main/webapp/META-INF/standard-jaxws-endpoint-config.xml It seems that "wsse-config2" is required. If this is not present, it is possible for the client to send any client credentials it want (or leave them out) and it will still get admission to the service. Other areas where this has been discussed: * http://www.jboss.org/index.html?module=bb&op=viewtopic&t=127582&a... * http://www.jboss.org/community/wiki/jbosssecuritytokenservice#comment-2075 (in relation to the same problem in the JBoss STS) Should be assigned to Darran Lofthouse. was: When exposing a webservice using the "@WebServiceProvider" annotation, and protecting it with WSSE username token the WebServiceContext#userPrincipal is not set. The WEB-INF/jboss-wsse-server.xml is configured as described here: http://www.jboss.org/community/wiki/JBossWS-WS-Securityoptions#POJO_Endpo... Although this does not really seem to be enough, as it is also required to have META-INF/standard-jaxws-endpoint-config.xml file with only the "Standard WSSecurity Endpoint" on the server to actually enforce the authentication of the username token. Attached: * wstest.war: example war - exposing one webservice (compiled from the content of server.zip) * server.zip: source for the wstest.war * client.zip: simple client for the server, sending a username token. Reproducing the problem: 1) deploy wstest.war to a jboss 5.1.0 2) open the run.sh in the client.zip, and set the JBOSS_5 to fit your installation. It the server is not listening on 8080, modify the url in the client source (WsExampleClient.java). 3) compile and run the client, by running ./run.sh 4) inspect the server log. If this says: "[INFO] Principal = null" we have the problem (expected principal = admin) Server code: * service: server.zip:src/main/java/org/example/WsExample.java * wsdl: server.zip:src/main/webapp/WEB-INF/wsdl * wsse-config: server.zip:src/main/webapp/WEB-INF/jboss-wsse-server.xml * wsse-config2: server.zip:src/main/webapp/META-INF/standard-jaxws-endpoint-config.xml It seems that "wsse-config2" is required. If this is not present, it is possible for the client to send any client credentials it want (or leave them out) and it will still get admission to the service. Other areas where this has been discussed: * http://www.jboss.org/index.html?module=bb&op=viewtopic&t=127582&a... * http://www.jboss.org/community/wiki/jbosssecuritytokenservice#comment-2075 (in relation to the same problem in the JBoss STS) Added reference to Darran Lofthouse as per request in the forums. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/JBWS-2833?page=com.atlassian.jira.plug... ] Morten Andersen commented on JBWS-2833: --------------------------------------- Hi Darran, I am sorry if my description was not clear. The issue is that the WebServiceContext#userPrincipal is not set. I.e. a POJO like this: @Resource protected WebServiceContext context; @Override public Source invoke(Source request) { try { LOG.info("Principal = " + context.getUserPrincipal()); will print: "Principal = null" even if protected by correctly configured WSSE. The expected behaviour is something like: "Principal = admin" (if using the admin user in the username token). I hope this makes it clearer? -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira