Unable to do HTTP basic authentication for SOAP requests when JAXB is used for tranformation

[bhaskarsk]

I am using JAXB binding to convert xml string to Java Objects, I followed the similar approach as mentioned in the quickstart ( switchyard-quickstart-demo-policy-security-basic),

service name is ISampleServicesPortType, for the transformer i am using jaxb.

<transform:transform.jaxb from="java:com.alu.ipprd.aor.core.tm.sample.objs.Response" to="{urn:com.alu.ipprd.aor.core.tm.svcs:tm-services:0.0.0}callResponse"/>

    <transform:transform.jaxb from="{urn:com.alu.ipprd.aor.core.tm.svcs:tm-services:0.0.0}call" to="java:com.alu.ipprd.aor.core.tm.sample.objs.Request"/>

Soap request in not authenticated in this case and is processed successfully. Switchyard.xml as below.

<?xml version="1.0" encoding="UTF-8"?>
<switchyard xmlns="urn:switchyard-config:switchyard:1.0" xmlns:bean="urn:switchyard-component-bean:config:1.0" xmlns:jms="urn:switchyard-component-camel-jms:config:1.0" xmlns:sca="http://docs.oasis-open.org/ns/opencsa/sca/200912" xmlns:soap="urn:switchyard-component-soap:config:1.0" xmlns:transform="urn:switchyard-config:transform:1.0">
  <sca:composite name="aor-ipprd-plf-core-tm-binding" targetNamespace="urn:com.alu.ipprd.aor.core.tm.svcs:tm-services:0.0.0">
    <sca:component name="Component">
      <bean:implementation.bean requires="authorization" class="com.alu.ipprd.aor.core.tm.sample.svcs.SampleServices"/>
      <sca:service name="ISampleServices" requires="clientAuthentication confidentiality">
        <sca:interface.java interface="com.alu.ipprd.aor.core.tm.sample.svcs.ISampleServices"/>
      </sca:service>
    </sca:component>
    <sca:service name="ISampleServicesPortType" promote="Component/ISampleServices">
      <sca:interface.wsdl interface="META-INF/ISampleServices.wsdl#wsdl.porttype(ISampleServicesPortType)"/>
      <soap:binding.soap name="soap1">
        <soap:messageComposer unwrapped="true"/>
        <soap:wsdl>META-INF/ISampleServices.wsdl</soap:wsdl>
        <soap:contextPath>aor-ipprd-plf-core-tm-binding</soap:contextPath>
      </soap:binding.soap>
    </sca:service>
    <sca:component name="Component1">
      <bean:implementation.bean requires="authorization" class="org.switchyard.quickstarts.demo.policy.security.basic.WorkServiceBean"/>
      <sca:service name="WorkService" requires="clientAuthentication confidentiality">
        <sca:interface.java interface="org.switchyard.quickstarts.demo.policy.security.basic.WorkService"/>
      </sca:service>
    </sca:component>
    <sca:service name="WorkService" promote="Component1/WorkService">
      <sca:interface.wsdl interface="WorkService.wsdl#wsdl.porttype(WorkService)"/>
      <soap:binding.soap name="soap1">
        <soap:messageComposer unwrapped="true"/>
        <soap:wsdl>WorkService.wsdl</soap:wsdl>
        <soap:contextPath>aor-ipprd-plf-core-tm-binding1</soap:contextPath>
      </soap:binding.soap>
    </sca:service>
  </sca:composite>
  <transforms>
    <transform:transform.jaxb from="java:com.alu.ipprd.aor.core.tm.sample.objs.Response" to="{urn:com.alu.ipprd.aor.core.tm.svcs:tm-services:0.0.0}callResponse"/>
    <transform:transform.jaxb from="{urn:com.alu.ipprd.aor.core.tm.svcs:tm-services:0.0.0}call" to="java:com.alu.ipprd.aor.core.tm.sample.objs.Request"/>
    <transform:transform.java from="java:org.switchyard.quickstarts.demo.policy.security.basic.WorkAck" to="java:org.switchyard.quickstarts.demo.policy.security.basic.Work" class="org.switchyard.quickstarts.demo.policy.security.basic.Transformers"/>
    <transform:transform.java from="java:org.switchyard.quickstarts.demo.policy.security.basic.WorkAck" to="{urn:switchyard-quickstart-demo:policy-security-basic:0.1.0}doWorkResponse" class="org.switchyard.quickstarts.demo.policy.security.basic.Transformers"/>
    <transform:transform.java from="{urn:switchyard-quickstart-demo:policy-security-basic:0.1.0}doWork" to="java:org.switchyard.quickstarts.demo.policy.security.basic.Work" class="org.switchyard.quickstarts.demo.policy.security.basic.Transformers"/>
  </transforms>
  <domain>
    <properties>
      <property name="org.switchyard.handlers.messageTrace.enabled" value="true"/>
    </properties>
    <securities>
      <security callbackHandler="org.switchyard.security.callback.handler.NamePasswordCallbackHandler" name="defined" rolesAllowed="friend"/>
    </securities>
  </domain>
</switchyard>

And in the bean service as below

@Requires(security = {CONFIDENTIALITY, CLIENT_AUTHENTICATION, AUTHORIZATION})
@Service(ISampleServices.class)
public class SampleServices implements ISampleServices {


  public Response call(Request request) {
  Response response = new Response();
  response.setName("test");
   return response;
  }

Does the JAXB tranformation removes the authentication part???

[jorgemoralespou_2]

Hi,

I think that the quickstart is very missleading. (Just an opinion).

Basic authentication is handled by the container, that means that you'll be sending in your SOAP request an HTTP header of "Authorization" that the container will use to get the correct user. That user will be directly available in the SwitchYard SecurityContext.

Transformations are for the message payload, and in your case (or any other basic auth example) the payload should not contain anything related to authentication, but the envelope`s body of the message.

The only relevant part in the quickstart to authentication really are: https://github.com/jboss-switchyard/quickstarts/blob/master/demos/policy-security-basic/src/main/java/org/switchyard/quickstarts/demo/policy/security/basic/WorkServiceBean.java#L39 and quickstarts/switchyard.xml at master · jboss-switchyard/quickstarts · GitHub

Also @Requires annotation is deprecated AFAIK, and not needed. This should be configured as a declarative policy in the switchyard.xml. 

I would encourage you to open a JIRA for this quickstart as it is very poorly documented. 

[tsaravananthangavel]

Hi Jorge, We understand the payload shouldn't have any authentication related details. In fact for both SOAP Requests [That going to use JAXB or JAVA transform on switchyard/server side] we send Authorization in Http Header. What we face is, for incoming request that using java transform, the security validation flow is happening. For the Requests that using JAXB transform the security validation functionality is escaped on server side. Do we have an policy-security-basic or other security use case for the soap request that using jaxb transform instead of java transform?

[tsaravananthangavel]

Mostly Removal of PortType from Generated References will help at this time as an workaround for jaxb based wsdl generated SOAP services.

Generated SY Content By Plugin:

   <sca:service name="ISampleServicesPortType" promote="Component/ISampleServices">

      <sca:interface.wsdl interface="META-INF/ISampleServices.wsdl#wsdl.porttype(ISampleServicesPortType)"/>

Generated  WSDL Manual Update From:

                <wsdl:portType name="ISampleServicesPortType">

<wsdl:binding name="ISampleServicesSoapBinding" type="tns:ISampleServicesPortType">

Update SY Content to:   

                <sca:service name="ISampleServices" promote="Component/ISampleServices">

      <sca:interface.wsdl interface="META-INF/ISampleServices.wsdl#wsdl.porttype(ISampleServices)"/>

Generated  WSDL Manual Update To:

                  <wsdl:portType name="ISampleServices">

<wsdl:binding name="ISampleServicesSoapBinding" type="tns:ISampleServices">