Author: coheigea
Date: Fri Feb 21 17:03:29 2014
New Revision: 1570638
URL: http://svn.apache.org/r1570638
Log:
Adding content to the user guide
Modified:
webservices/wss4j/site/src/site/xdoc/newfeatures20.xml
Modified: webservices/wss4j/site/src/site/xdoc/newfeatures20.xml
URL:
http://svn.apache.org/viewvc/webservices/wss4j/site/src/site/xdoc/newfeatures20.xml?rev=1570638&r1=1570637&r2=1570638&view=diff
==============================================================================
--- webservices/wss4j/site/src/site/xdoc/newfeatures20.xml (original)
+++ webservices/wss4j/site/src/site/xdoc/newfeatures20.xml Fri Feb 21 17:03:29
2014
@@ -61,6 +61,41 @@ the token contains a "OneTimeUse" Condit
</ul>
</subsection>
+<subsection name="Encrypting passwords in Crypto property files">
+<p>
+A typical example of the contents of a Crypto properties file (for Signature
+creation) is as follows:
+</p>
+<ul>
+<li>org.apache.wss4j.crypto.provider=org.apache.wss4j.common.crypto.Merlin</li>
+<li>org.apache.wss4j.crypto.merlin.keystore.type=jks</li>
+<li>org.apache.wss4j.crypto.merlin.keystore.password=security</li>
+<li>org.apache.wss4j.crypto.merlin.keystore.alias=wss40</li>
+<li>org.apache.wss4j.crypto.merlin.keystore.file=keys/wss40.jks</li>
+</ul>
+<p>
+Note that the password used to load the keystore is in cleartext. One of the
+new features of Apache WSS4J 2.0.0 is the ability to instead store a (BASE-64
+encoded) encrypted version of the keystore password in the Crypto properties
+file. A new PasswordEncryptor interface is defined to allow for the
+encryption/decryption of passwords. A default implementation is now provided
+based on Jasypt called JasyptPasswordEncryptor, which uses
+"PBEWithMD5AndTripleDES".
+</p>
+<p>
+The WSPasswordCallback class has an additional "usage" called
+WSPasswordCallback.PASSWORD_ENCRYPTOR_PASSWORD, which is used to return the
+master password for use with the PasswordEncryptor implementation. When WSS4J
+is loading a Crypto implementation via a properties file, and it encounters a
+password encrypted in the format "ENC(encoded encrypted password)", it queries
+a CallbackHandler for a password via this WSPasswordCallback usage tag. It is
+possible to pass a custom PasswordEncryptor implementation to WSS4J via the
+new configuration tag ConfigurationConstants.PASSWORD_ENCRYPTOR_INSTANCE
+("passwordEncryptorInstance").
+</p>
+
+</subsection>
+
<subsection name="Miscellaneous new features">
<p>
Support was added in WSS4J 1.6.x to obtain a Kerberos ticket from a KDC (Key
