4 Replies Latest reply on Jan 15, 2014 11:17 AM by junymathew

Authenticating with WS-Security Username Token / Password Digest against Jboss Container

junymathew Dec 16, 2013 4:36 PM

We are planning to develop a Webservice with User Name Token + password Digest WS Security policy enabled. We will be using Jboss EAP 6.1 as our Application server.I have got some sample Web Services up and running but they are using Custom Password call back handlers and I am just hardcoding the password in it. I am able to run those webservices using SOAP UI as client.

Where I fail to find materials / path forward is for doing Container Authentication with the Username and Password Digest that I receive

It would be really helpful if someone can guide me on this or direct me to appropriate reading materials.

Regards

1. Re: Authenticating with WS-Security Username Token / Password Digest against Jboss Container

junymathew Dec 19, 2013 12:53 PM (in response to junymathew)

I was able to get Authentication done against an LDAP with Clear Text password. Is there any way I can authenticate the Username token and the Password Digest i receive against an LDAP server?
Actions
2. Re: Authenticating with WS-Security Username Token / Password Digest against Jboss Container

pvivacqua Dec 20, 2013 7:33 AM (in response to junymathew)

Hi Juny,

Novell has a library for LDAP connection that makes it easy to implement the autentication you are looking for: http://www.novell.com/documentation/developer/jldap/jldapenu/data/a9032ak.html After receiving your usernameToken all you have to do is try to bind this credentials to the LDAP server, if it succeds your user is auteticated.
Actions
3. Re: Authenticating with WS-Security Username Token / Password Digest against Jboss Container

asoldano Jan 15, 2014 4:13 AM (in response to junymathew)

You can set a security domain for your deployment and use the JAAS integration to authenticate against that. Have a look at the documentation / example at https://docs.jboss.org/author/display/JBWS/WS-Security#WS-Security-Authenticationandauthorization
Actions
4. Re: Authenticating with WS-Security Username Token / Password Digest against Jboss Container

junymathew Jan 15, 2014 11:17 AM (in response to asoldano)

Hi Alessio,
Thanks for the message. I had got it working as per your examples as I mentioned the above. The outstanding clarifications that we have is as below

1. Using Password Digest i am not able to have Jboss Authenticate against an LDAP using Integrated JAAS. LDAP seems to require a clear text password. Is there anyway we can use password digests and a Jboss Security domain configured against an LDAP?

2. If not using the message digest, Is there any way for enforcing that the passwords be encrypted? is there any other Interceptor which I can configure which will decrypt the password and then send it for authentication against configured JBOSS Security domain? Are there any examples or guidelines for doing so?

Thanking you in advance.

Regards
Juny
Actions

Go to original post