WS-Security Password Digest Policy implementation with CXF

This article will help to learn WS-Security Password Digest Policy implementation WSDL based approach. To implement 3 steps needs to be followed

Step 1: Add the following Password Digest policy xml snippet at the end of the service declaration in the WSDL

  <wsp:policy wsu:id="CalcPlaintextPolicy">
         <sp:supportingtokens>
             <wsp:policy>
                 <sp:usernametoken sp:includetoken=
                             "http://docs.oasis-open.org/ws-sx/
                                ws-securitypolicy/200702/
                                  IncludeToken/AlwaysToRecipient">
                     <wsp:policy>
                         <sp:hashpassword>
                     </sp:hashpassword></wsp:policy>
                 </sp:usernametoken>
             </wsp:policy>
         </sp:supportingtokens>
     </wsp:policy>

Example:

 <wsdl:service name="CalculatorService">
    <wsdl:port binding="impl:CalculatorSoapBinding" name="Calculator">
      <wsdlsoap:address location="http://localhost:8080/Calculator/services">
    </wsdlsoap:address></wsdl:port>
  </wsdl:service>
     <!-- STARTS AFTER THE SERVICE   -->
     <wsp:policy wsu:id="CalcPlaintextPolicy">
         <sp:supportingtokens>
             <wsp:policy>
                 <sp:usernametoken sp:includetoken="
				         http://docs.oasis-open.org/ws-sx/
				           ws-securitypolicy/200702/IncludeToken/
						   AlwaysToRecipient">
                     <wsp:policy>
                          <!-- MAIN CHANGE ON THE  WSDL IS  -->
                         <sp:hashpassword>
                     </sp:hashpassword></wsp:policy>
                 </sp:usernametoken>
             </wsp:policy>
         </sp:supportingtokens>
     </wsp:policy>  
    <!-- ENDS BEFORE THE WSDL DEFINITION -->

Step 2: Add the following policy reference snippet after the wsdl binding section of the WSDL

  <wsp:policyreference uri="#CalcPlaintextPolicy"> </wsp:policyreference>

Example:

  <wsdl:binding name="CalculatorSoapBinding" type="impl:Calculator">
    <!--- START OF THE POLICY REFERENCE  --> 
    <wsp:policyreference uri="#CalcPlaintextPolicy">
    <wsdlsoap:binding transport="http://schemas.xmlsoap.org/soap/http">
    <wsdl:operation name="add">
      <wsdlsoap:operation soapaction="">
      <wsdl:input name="addRequest">
        <wsdlsoap:body use="literal">
      </wsdlsoap:body></wsdl:input>
      <wsdl:output name="addResponse">
        <wsdlsoap:body use="literal">
      </wsdlsoap:body></wsdl:output>
    </wsdlsoap:operation></wsdl:operation>
    <wsdl:operation name="sub">
      <wsdlsoap:operation soapaction="">
      <wsdl:input name="subRequest">
        <wsdlsoap:body use="literal">
      </wsdlsoap:body></wsdl:input>
      <wsdl:output name="subResponse">
        <wsdlsoap:body use="literal">
      </wsdlsoap:body></wsdl:output>
    </wsdlsoap:operation></wsdl:operation>
    <wsdl:operation name="multi">
      <wsdlsoap:operation soapaction="">
      <wsdl:input name="multiRequest">
        <wsdlsoap:body use="literal">
      </wsdlsoap:body></wsdl:input>
      <wsdl:output name="multiResponse">
        <wsdlsoap:body use="literal">
      </wsdlsoap:body></wsdl:output>
    </wsdlsoap:operation></wsdl:operation>
    <wsdl:operation name="div">
      <wsdlsoap:operation soapaction="">
      <wsdl:input name="divRequest">
        <wsdlsoap:body use="literal">
      </wsdlsoap:body></wsdl:input>
      <wsdl:output name="divResponse">
        <wsdlsoap:body use="literal">
      </wsdlsoap:body></wsdl:output>
    </wsdlsoap:operation></wsdl:operation>
  </wsdlsoap:binding>
   <!--- END OF THE POLICY REFERENCE  -->
  </wsp:policyreference>
 </wsdl:binding>

Step 3: Use the below given snippet to configure the cxf-bean.xml.

Example:

<jaxws:endpoint address="/calculator" id="calculator" implementor="com.elan.calc.service.impl.CalculatorImpl">
  <jaxws:features>
   <bean class="org.apache.cxf.feature.LoggingFeature">
  </bean></jaxws:features>
  <jaxws:properties>
            <entry key="ws-security.username" value="wsuser">        
            <entry key="ws-security.callback-handler" value-ref="wsSecPasswordCallback">
        </entry></entry></jaxws:properties>   
 </jaxws:endpoint>
 <bean class="com.elan.calc.ws.service.PasswordCallbackHandler" id="wsSecPasswordCallback">
</bean>

Refer the Example: callbackhandler

package com.elan.calc.ws.service;
import java.io.IOException;


import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
import org.apache.ws.security.WSPasswordCallback;

public class PasswordCallbackHandler implements CallbackHandler {

 public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
  WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
  System.out.println("identifier: " + pc.getIdentifier());

  if (pc.getIdentifier().equals("wsuser")) {
   // set the password on the callback. This will later be compared to // the // password which was sent from the client.
   pc.setPassword("ws=USER");
  }
 }
}

WS Security namespaces used in the wsdl

 xmlns:wsp="http://www.w3.org/ns/ws-policy" 
 xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" 
 xmlns:wsaws="http://www.w3.org/2005/08/addressing" 
 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702" 
 xmlns:sp13="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200802"
 xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"

Your ws security plain Digest policy implementation is completed successfully!!! You can also download complete working code from the following location. Thanks for visiting my learning blog.

Download Source Code