I have a relatively
straightforward problem and am getting lost in the architecture of AXIS.
When my web
service is called, there is a special HTTP Header being sent called
"ImpersonatedUser" that I must pass all the way through AXIS-land and set
somewhere where my POJOs can use it to perform other operations as an
administrator (but present myself to the user as the value of his/her
"ImpersonatedUser").
My first thought was
to stuff it in the MessageContext and pull it out later on, or to
store this user's name as an
org.apache.axis.security.AuthenticatedUser and put it in a SecurityProvider of
my creation.
In both of these
scenarios, what I do not understand is how to pull this data out "on the other
end" after it is stored in the MessageContext/SecurityProvider. I have traced
the code of the RPCProvider down to where my method is called:
objRes =
invokeMethod(msgContext,
operation.getMethod(),
obj, argValues);
operation.getMethod(),
obj, argValues);
Now.....do I hack
the class apart and add another parameter to the argValues array? Add another
call to "invokeMethod" to set this username? Both these ideas make me
shudder, so I think I must be misunderstanding the AXIS architecture an
bit. How do I tell the Provider to do something in my implementation class
that was not explicitly part of the web service request?
I checked the docs
and have looked through the SimpleAuthorizationHandler and
SimpleAuthenticationHandler, but I think what I am doing is not well served by
these Handlers, as they just throw Exceptions for unauthorized users and quietly
return when there are no problems. I need something to happen on the
SoapBindingImpl side of things.
Any guidance is much
appreciated!
-Greg
