JAX-WS and BASIC authentication, when user names and passwords are in a database.

Question

Hi, I'm new to JAX-WS and there's a thing which I don't understand.

There's a ton of tutorials available on how to set up JAX-WS security, but in pretty much all cases BindingProvider.USERNAME_PROPERTY and BindingProvider.PASSWORD_PROPERTY are stored in some .xml file(depending on the container I believe) - they are "hardcoded" that is. And that's what I don't get. How can I authenticate a web service client by comparing BindingProvider.USERNAME_PROPERTY and BindingProvider.PASSWORD_PROPERTY with a user name and password that's in a database? I tried setting BindingProvider.USERNAME_PROPERTY and BindingProvider.PASSWORD_PROPERTY on the client side like this:

ShopingCartService scs = new ShopingCartService(wsdlURL, name);
     ShopingCart sc = scs.getShopingCartPort();
     Map requestContext = ((BindingProvider)sc).getRequestContext();
     requestContext.put(BindingProvider.USERNAME_PROPERTY, userName);
     requestContext.put(BindingProvider.PASSWORD_PROPERTY, password);
        sc.someFunctionCall();

And then, on the server side retrieving like this:

@Resource
    WebServiceContext wsContext;

    @WebMethod
    public void someFunctionCall() {
        MessageContext mc = wsContext.getMessageContext();
        mc.get(BindingProvider.USERNAME_PROPERTY);
        mc.get(BindingProvider.PASSWORD_PROPERTY);
    }

But I always get null, I didn't set up anything in xml, web service works just fine, except I can't get those variables :(

I'm running both on java 1.6, tomcat 6 and JAX-WS from https://jax-ws.dev.java.net/.

Any help with authenticating users with passwords from a database is greatly appreciated, Thanks.

Answer 1

BindingProvider.USERNAME_PROPERTY and BindingProvider.PASSWORD_PROPERTY are matching HTTP Basic Authentication mechanism that enable authentication process at the HTTP level and not at the application nor servlet level.

Basically, only the HTTP server will know the username and the password (and eventually application according to HTTP/application server specification, such with Apache/PHP). With Tomcat/Java, add a login config BASIC in your web.xml and appropriate security-constraint/security-roles (roles that will be later associated to users/groups of real users).

<login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>YourRealm</realm-name>
</login-config>

Then, connect the realm at the HTTP server (or application server) level with the appropriate user repository. For tomcat you may look at JAASRealm, JDBCRealm or DataSourceRealm that may suit your needs.

http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html