How to get authenticated user in web service methods using WSS4J interceptors
I have an Apache CXF service hosted in Spring. I am using WSS4J hooks to check the security of the username and password to access the server. Authentication works correctly, if I send wrong credentials from SoapUI, I cannot use the service as expected. If I send the correct credentials, the service works without issue. This is my config in spring context file.
<bean id="myPasswordCallback" class="cu.datys.sias.custom.ServerPasswordCallback"/>
<jaxws:endpoint id="siasEndpoint"
implementor="#siasImpl"
address="/sias">
<jaxws:features>
<!-- Soporte WS-Addressing -->
<!--<wsa:addressing xmlns:wsa="http://cxf.apache.org/ws/addressing" addressingRequired="true" usingAddressingAdvisory="true" allowDuplicates="true"/>-->
</jaxws:features>
<jaxws:inInterceptors>
<bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
<constructor-arg>
<map>
<entry key="action" value="UsernameToken" />
<entry key="passwordType" value="PasswordText" />
<entry key="passwordCallbackRef"
value-ref="myPasswordCallback" />
</map>
</constructor-arg>
</bean>
</jaxws:inInterceptors>
</jaxws:endpoint>
Now I need to be able to access my authenticated user in my service methods, something like this:
@WebResult(name = "UpdatePatternResponse", targetNamespace = "http://test.com/schemas/xsd/myservice/", partName = "UpdatePatternResponse")
@WebMethod(operationName = "UpdatePattern", action = "UpdatePattern")
@Generated(value = "org.apache.cxf.tools.wsdlto.WSDLToJava", date = "2015-02-19T12:49:59.491-05:00")
public test.com.schemas.xsd.myservice.UpdatePatternResponse updatePattern(
@WebParam(partName = "UpdatePatternRequest", name = "UpdatePatternRequest", targetNamespace = "http://test.com/schemas/xsd/myservice/")
test.com.schemas.xsd.myservice.UpdatePatternRequest updatePatternRequest
) throws SIASFaultMessage{
.
.
User myAuthenticatedUser = //HOW TO GET THE USER???
.....
.
.
.
}
How can I get authenticated user in my Apache CXF service methods?
source to share
I found this to be the only question related to such an important question, so I would like to share what I found for CXF 3.1.x.
The basic idea is the same as @ alfredo-a. Here is the code:
Message message=PhaseInterceptorChain.getCurrentMessage();
SecurityContext context=message.get(SecurityContext.class);
String userName=context.getUserPrincipal().getName();
Hope this helps someone.
Hooray!
source to share
I finally figured it out, thanks to this link:
Is there a way to access CXF messaging from a JAX-RS REST resource in CXF?
Here's how to get the username using WSSJ4 interceptors:
@WebResult(name = "UpdatePatternResponse", targetNamespace = "http://test.com/schemas/xsd/myservice/", partName = "UpdatePatternResponse")
@WebMethod(operationName = "UpdatePattern", action = "UpdatePattern")
@Generated(value = "org.apache.cxf.tools.wsdlto.WSDLToJava", date = "2015-02-19T12:49:59.491-05:00")
public test.com.schemas.xsd.myservice.UpdatePatternResponse updatePattern(
@WebParam(partName = "UpdatePatternRequest", name = "UpdatePatternRequest", targetNamespace = "http://test.com/schemas/xsd/myservice/")
test.com.schemas.xsd.myservice.UpdatePatternRequest updatePatternRequest
) throws SIASFaultMessage{
.
.
Message message = PhaseInterceptorChain.getCurrentMessage();
WSUsernameTokenPrincipal principal = (WSUsernameTokenPrincipal)message.get("wss4j.principal.result");
String userName = principal.getName();
.
.
.
}
source to share