Accessing username/password from within web service (JAX-WS)?

Question

We are implementing a web service that is going to act as an intermediary layer between the clients and another application. Our requirements for the web service state that we need to send the username and password in the SOAP header using standard WS-Security.

The web service implementation needs to take the information passed in through the method call and combine that with the username and password in order to call the other application, and this is where my problem starts.

I cannot figure out an easy way to get to the username and password from the SOAP header within my web service implementation. I can get to the user principal (username) through the injected WebServiceContext, but I don't see any easy way to get the password.

I can get to the SOAPHeader and could probably parse the XML to get the password element, but this seems like a very messy way to solve this problem.

I'm not as knowledgeable about JAX-WS and WS-Security as I'd like to be. I'm hoping that I'm missing something that obvious to somebody else - maybe I need to implement some kind of handler?

Answer 1

The easiest approach is to pull the username and password from the SOAP header by specifying it as a parameter to your JAX-WS method:

@WebMethod
public String performAction( @WebParam(name="credentials", header=true)
                             Credentials credentials,
                             @WebParam( name="...")....

You could also create a SOAPHandler:

public class AuthenticationHandler implements SOAPHandler<SOAPMessageContext>
{
    //Implement appropriate methods here
}

This is registered in standard-jaxws-endpoint-config.xml:

<jaxws-config xmlns="urn:jboss:jaxws-config:2.0" 
              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
              xmlns:javaee="http://java.sun.com/xml/ns/javaee"
              xsi:schemaLocation="urn:jboss:jaxws-config:2.0 jaxws-config_2_0.xsd">
   <endpoint-config>
      <config-name>WebService Endpoint</config-name>
      <pre-handler-chains>
         <javaee:handler-chain>
            <javaee:protocol-bindings>##SOAP11_HTTP</javaee:protocol-bindings>
            <javaee:handler>
                <javaee:handler-name>AuthHandler</javaee:handler-name>
                <javaee:handler-class>com.example.AuthenticationHandler</javaee:handler-class>
            </javaee:handler>
         </javaee:handler-chain>
      </pre-handler-chains>
   </endpoint-config>
</jaxws-config>