Sergey,
So far I've concluded that the CallbackHandler has to populate the
Spring
Security SecurityContext, such as (exclude the hacked up code):
public class PasswordCallbackHandler
implements CallbackHandler
{
public void handle(Callback[] arg0)
throws IOException, UnsupportedCallbackException
{
for (Callback callback : arg0)
{
if (callback instanceof WSPasswordCallback)
{
WSPasswordCallback passwordCallback = (WSPasswordCallback)
callback;
if (validUser(passwordCallback)
{
// Register with Spring Security so annotated methods
(@RolesAllowed)
// will allow appropriate users. There must be a nice
way
of doing this
// through the Spring context files!
SecurityContextHolder.getContext().setAuthentication(
new UsernamePasswordAuthenticationToken(
passwordCallback.getIdentifer(),
passwordCallback.getPassword(),
new GrantedAuthority[] {
new GrantedAuthorityImpl("ADMIN") } ));
return;
}
}
}
}
throw new RuntimeException("Invallid user");
}
}
The WS method can then be annotated with @RoledAllowed({"ADMIN"}).
But this isn't very clean however given WS Security doesn't provide
any
roles, what else can be done? It would be nice to put the above into
Sprnig though so the user & role ("GrantedAuthority") mappings can be
defined in XML. Is there something for this already?
John Baker
--
Web SSO
IT Infrastructure
Deutsche Bank London
URL: http://websso.cto.gt.intranet.db.com
John-M Baker <[EMAIL PROTECTED]>
01/07/2008 12:35
Please respond to
[email protected]
To
[email protected]
cc
[email protected]
Subject
Re: CXF and Acegisecurity
Sergey,
The problem seems to lie between enabling WS-Security on CXF (which
isn't
a problem) and wiring this into Spring Secuirty. Look at the
following:
Caused by:
org
.springframework.security.AuthenticationCredentialsNotFoundException:
An Authentication object was not found in the SecurityContext
at
org
.springframework
.security
.intercept
.AbstractSecurityInterceptor
.credentialsNotFound(AbstractSecurityInterceptor.java:342)
at
org
.springframework
.security
.intercept
.AbstractSecurityInterceptor
.beforeInvocation(AbstractSecurityInterceptor.java:254)
at
org
.springframework
.security
.intercept
.method
.aopalliance
.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:63)
at
org
.springframework
.aop
.framework
.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:
171)
at
org
.springframework
.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
That appears after successful authentication with WS-Security, and CXF
trying to invoke a method that's annotated with @RolesAllowed.
John Baker
--
Web SSO
IT Infrastructure
Deutsche Bank London
URL: http://websso.cto.gt.intranet.db.com
"Sergey Beryozkin" <[EMAIL PROTECTED]>
01/07/2008 10:14
Please respond to
[email protected]
To
<[email protected]>
cc
<[email protected]>
Subject
Re: CXF and Acegisecurity
Cool, thanks for a link. These links can get added to the wiki.
I hope that in your project, where you combine JAX-RS and JAX-WS in
one
resource class, the single piece of
Spring Security config should suffice, not sure though. let us know
please
how it goes
Cheers, Sergey
----- Original Message -----
From: "John-M Baker" <[EMAIL PROTECTED]>
To: <[email protected]>
Cc: <[email protected]>
Sent: Tuesday, July 01, 2008 10:09 AM
Subject: Re: CXF and Acegisecurity
There's also a good example here:
http://www.jroller.com/habuma/entry/method_level_security_in_spring
I'm currently looking at what is required to wire Spring security
into
the
WS-Security module!
John Baker
--
Web SSO
IT Infrastructure
Deutsche Bank London
URL: http://websso.cto.gt.intranet.db.com
"Sergey Beryozkin" <[EMAIL PROTECTED]>
01/07/2008 10:06
Please respond to
[email protected]
To
<[email protected]>
cc
Subject
Re: CXF and Acegisecurity
Hi
Are there any docs specifically on implementing CXF REST With
Acegisecurity? Google didnt return anything obvious.. A simple
example
showing how to secure a couple methods would be handy.
have a look here please :
http://static.springframework.org/spring-security/site/reference/html/ns-config.html#ns-method-security
It's a Spring Security module which you're after. It should be
possible
to
use AOP-like expressions to specify what kind of security
credentials need to be applied to various methods in your resource
class...
Cheers, Sergey
Thanks,
John Baker
--
Web SSO
IT Infrastructure
Deutsche Bank London
URL: http://websso.cto.gt.intranet.db.com
---
This e-mail may contain confidential and/or privileged
information. If
you are not the intended recipient (or have received this
e-mail in error) please notify the sender immediately and delete
this
e-mail. Any unauthorized copying, disclosure or distribution
of the material in this e-mail is strictly forbidden.
Please refer to http://www.db.com/en/content/eu_disclosures.htm for
additional EU corporate and regulatory disclosures.
----------------------------
IONA Technologies PLC (registered in Ireland)
Registered Number: 171387
Registered Address: The IONA Building, Shelbourne Road, Dublin 4,
Ireland
---
This e-mail may contain confidential and/or privileged information.
If
you are not the intended recipient (or have received this
e-mail in error) please notify the sender immediately and delete this
e-mail. Any unauthorized copying, disclosure or distribution
of the material in this e-mail is strictly forbidden.
Please refer to http://www.db.com/en/content/eu_disclosures.htm for
additional EU corporate and regulatory disclosures.
----------------------------
IONA Technologies PLC (registered in Ireland)
Registered Number: 171387
Registered Address: The IONA Building, Shelbourne Road, Dublin 4,
Ireland
---
This e-mail may contain confidential and/or privileged information.
If you
are not the intended recipient (or have received this e-mail in error)
please notify the sender immediately and delete this e-mail. Any
unauthorized copying, disclosure or distribution of the material in
this
e-mail is strictly forbidden.
Please refer to http://www.db.com/en/content/eu_disclosures.htm for
additional EU corporate and regulatory disclosures.
---
This e-mail may contain confidential and/or privileged information.
If you are not the intended recipient (or have received this e-mail
in error) please notify the sender immediately and delete this e-
mail. Any unauthorized copying, disclosure or distribution of the
material in this e-mail is strictly forbidden.
Please refer to http://www.db.com/en/content/eu_disclosures.htm for
additional EU corporate and regulatory disclosures.
