WSSE UsernameToken without HTTP basic auth?
Hi!
I've managed to implement a web service + a client that authenticates with WSSE UsernameToken.
My problem is that the client side is always including the HTTP Authorization header.
Something like:
Authorization: Basic a2VybWl0OnRoZWZyb2c=
Note, the WSSE data in the SOAP header is also included and looking ok.
How can I keep the client from including the http basic authentication data and only include wsse data? Is this possible? What am I missing?
My client is configured with
<config> <username/> </config>
I do the following in the client code:
URL securityURL = new File("resources/jboss-wsse-client.xml").toURI().toURL();
((StubExt)myServiceStub).setSecurityConfig(securityURL.toExternalForm());
((StubExt)myServiceStub).setConfigName("Standard WSSecurity Client");
Map<String, Object> reqContext = bp.getRequestContext();
reqContext.put(BindingProvider.USERNAME_PROPERTY, "kermit");
reqContext.put(BindingProvider.PASSWORD_PROPERTY, "thefrog");I guess that the client libraries will pick up the properties set on the request ctx and therefore assume that basic auth should be applied?
Is there a way supply the username/pwd info to the WSSecurityDispatcher without having the client libraries adding http auth?
I do get everything to work if I add the following to web.xml on the server side
<login-config> <auth-method>BASIC</auth-method> <realm-name>JBossWS</realm-name> </login-config>
but I would really like to only use wsse and not http basic authentication.
The following in org/jboss/ws/core/client/RemotingConnectionImpl.java may be what is causing the problem together with implementation of the createRemotingMetaData method:
static
{
metadataMap.put(Stub.USERNAME_PROPERTY, "http.basic.username");
metadataMap.put(Stub.PASSWORD_PROPERTY, "http.basic.password");
metadataMap.put(BindingProvider.USERNAME_PROPERTY, "http.basic.username");
metadataMap.put(BindingProvider.PASSWORD_PROPERTY, "http.basic.password");
}I'm currently using jbossws 2.0.1.GA
/Mikael
