[jboss-user] [JBoss Web Services Development] - JBWS-2210 : CXF Username Token JAAS integration

[Sergey Beryozkin]

Sergey Beryozkin [http://community.jboss.org/people/sergeyb] created the discussion

"JBWS-2210 : CXF Username Token JAAS integration"

To view the discussion, visit: http://community.jboss.org/message/536321#536321

--------------------------------------------------------------
Hi

I've been looking recently at resolving JBWS-2210 [1].

The issue is to do with the fact that a WS-Security UsernameToken can not be currently used in JBoss CXF to integrate with the JBoss security subsystem for authentication and authorization decisions be made.

I've done some initial changes in CXF and started a discussion on the cxf dev list [2].

Here is the summary of the proposed approach.

The idea is to override a CXF WSS4JInInterceptor and provide a CallbachHandler to the WSS4J module which will ensure that an authentication occurs but also that a current SecurityContext is properly populated. The CXF interceptor which overrides CXF WSS4JInInterceptor is an abstract one [3], its job is to ensure that irrespectively of whether a current password is digested or not, the concrete subclass is requested to authenticate and populate a Subject.

CXF also includes an abstract AuthorizingInInterceptor[4] which requests a subclass for a list of expected roles and asks SecurityContext if a user is in role.

Given the above, here's how I'm thinking of resolving JBWS-2210 :

- provide a CXF interceptor (to be included in JBoss CXF) which will extend [3] and delegate to JBoss AuthenticationManager to populate a Subject
- provide a CXF interceptor (to be included in JBoss CXF) which will extend [4] and retrieve a list of expected roles;

JBoss CXF WS-Security UsernameToken-aware endpoints will include the above two interceptors if the authentication & authorization is needed.

At the moment I'm working on a system test validating the above approach.

If you have any comments then please let me know

cheers, Sergey

[1]  https://jira.jboss.org/jira/browse/JBWS-2210 https://jira.jboss.org/jira/browse/JBWS-2210
[2]  http://old.nabble.com/Using-WS-Security-UsernameToken-to-authenticate-users-and-populate--SecurityContexts-td28165583.html http://old.nabble.com/Using-WS-Security-UsernameToken-to-authenticate-users-and-populate--SecurityContexts-td28165583.html
[3]  http://svn.apache.org/repos/asf/cxf/trunk/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/AbstractWSS4JSecurityContextProvidingInterceptor.java http://svn.apache.org/repos/asf/cxf/trunk/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/AbstractWSS4JSecurityContextProvidingInterceptor.java
 [4]  http://svn.apache.org/repos/asf/cxf/trunk/rt/core/src/main/java/org/apache/cxf/interceptor/security/AbstractAuthorizingInInterceptor.java http://svn.apache.org/repos/asf/cxf/trunk/rt/core/src/main/java/org/apache/cxf/interceptor/security/AbstractAuthorizingInInterceptor.java




--------------------------------------------------------------

Reply to this message by going to Community
[http://community.jboss.org/message/536321#536321]

Start a new discussion in JBoss Web Services Development at Community
[http://community.jboss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2047]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/jboss-user/attachments/20100408/bd63762d/attachment.html