Re: why WSPasswordCallback.getPassword is null when I try my soap request

Thank you for the help robert but I really think there is something wrong here and I can't find no documentation  and nobody can answer me!

So have a look at this tutorial for example -   http://jkrzemie.files.wordpress.com/2011/02/ws.pdf


Or this page  http://wso2.org/library/3733   -  as you see here it;s written 

 

In the case of plain text, the behavior changes slightly. Here Rampart Engine passes both identifier and the password to the password callback handler and the callback handler does the actual validation. This is useful if the service store the hash of the passwords of clients and not the real passwords. In this case, as Rampart providing the password in the Username Token to the callback handler, it can do hashing operation on it and check the hashed value with the hashed password associated with the username' and there is also some a scheme (I have attached it) and Ican't understand why it doesn't work and what I'm doing wong. 




So I looked at your code but  I really have some things that I don't understand: 




public void handle (Callback[] callbacks) throws IOException,
UnsupportedCallbackException {
     


           WSPasswordCallback pwcb = (WSPasswordCallback) callbacks[i];
           if (pwcb.getIdentifer() == null) {
               pwcb.setPassword(passWordFromDB);

              //so you mean to check if the identifier is null and only then to set password - the hashed password from db!

            //and also I always sent the username (identifier and it's always different from null.       

    

           } 


else {
               System.out.println("found id, this could be used to get
the stored password from somewhere: " + pwcb.getIdentifer());
             //so  I get the identifier and what ?

            
           }
//?when to return 
       }
   }



________________________________
 From: robert lazarski <[email protected]>
To: [email protected]; Tania Marinova <[email protected]> 
Sent: Thursday, May 9, 2013 1:56 PM
Subject: Re: why WSPasswordCallback.getPassword is null when I try my soap request
 

On Thu, May 9, 2013 at 6:08 AM, Tania Marinova <[email protected]> wrote:
>
> i
>
> I have made axis 2 web service with rampart security
> but I constantly was receiving null point exception at this line
>
>      if((pwcb.getIdentifier().equals("bob")) &&
> pwcb.getPassword().equals("bobPW")) )
>
> so when I wrote this code
>
> if ( pwcb.getPassword()==null)
> {  throw new Exception ("passsssssssss is null:"+pwcb.getPassword());
>
> I saw at last that the problem is that pwcb.getPassword is null and I
> can't explain why Thank you in advance
>
>
> this is my soaprequest
>
> "<?xml version=\"1.0\" encoding=\"utf-8\"?>" +
>                 "<soapenv:Envelope " +
>
>
> "xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" " +
>                  "xmlns:nilo=\"http://nilo\">"+
>
>                   "<soapenv:Header>"+
>
>                   '<wsse:Security
> xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\"
> soapenv:mustUnderstand="1">'+
>                   '<wsse:UsernameToken
> xmlns:wsu="http://docs.oasisopen.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
> wsu:Id="123">'+
>                   '<wsse:Username>bob</wsse:Username>'+
>                  '<wsse:Password
> Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">bobPW</wsse:Password>'+
>                  '</wsse:UsernameToken>'+
>                   '</wsse:Security>'+
>                   "</soapenv:Header>"+
>                   "<soapenv:Body>" +
>                   "<nilo:getdataForChecking>" +
>                   '<nilo:data>'+tranXml+'</nilo:data>' +
>
>                    ' </nilo:getdataForChecking>'+
>
>                     '</soapenv:Body>' +
>                 '</soapenv:Envelope>';
>
>
>
>
>
> My PWCBHandler.java class
>
> public void handle(Callback[] callbacks) throws IOException,
> UnsupportedCallbackException {
>
>           for (int i = 0; i < callbacks.length; i++) {
>
>
>               //When the server side need to authenticate the user
>               WSPasswordCallback pwcb = (WSPasswordCallback)callbacks[i];
>
>
>                   if ( pwcb.getPassword()==null)
>                   {
>                       try {
>                         throw new Exception ("passsssssssss
> null:"+pwcb.getPassword());
>                     } catch (Exception e) {
>                         // TODO Auto-generated catch block
>                         e.printStackTrace();
>                     }
>
<snip>

My WSS knowledge is a bit dated but try this:

public void handle (Callback[] callbacks) throws IOException,
UnsupportedCallbackException {

       for (int i = 0; i < callbacks.length; i++) {
           System.out.println("in callback number: " + i + " , usage:
" + pwcb.getUsage());
           WSPasswordCallback pwcb = (WSPasswordCallback) callbacks[i];
           if (pwcb.getIdentifer() == null) {
               pwcb.setPassword(passWordFromDB);
           } else {
               System.out.println("found id, this could be used to get
the stored password from somewhere: " + pwcb.getIdentifer());
           }
       }
   }

My read on the docs and some code examples is that you set password in
this callback:

http://wso2.org/library/3733

"So let's look at how password callback handlers work. Whenever
Rampart Engine needs a password to create a username token, whether it
is to build a signature, validate username token or decrypt an
encrypted content, it will create a  WSPasswordCallback instance
setting the appropriate identifier which it extracts from the
<ramp:user> parameter of the Rampart configuration and pass it to the
password callback class via the handle method. Then password callback
fills the password relevant to the given identifier so that the
Rampart Engine can use it for further processing."
"
- R

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]