[
https://issues.apache.org/jira/browse/CXF-8327?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Colm O hEigeartaigh resolved CXF-8327.
--------------------------------------
Resolution: Fixed
> UsernameTokenInterceptor doesn't set soap:actor
> -----------------------------------------------
>
> Key: CXF-8327
> URL: https://issues.apache.org/jira/browse/CXF-8327
> Project: CXF
> Issue Type: Bug
> Components: WS-* Components
> Affects Versions: 3.3.7
> Reporter: Ibrahim M. Ghazal
> Assignee: Colm O hEigeartaigh
> Priority: Major
> Fix For: 3.4.0, 3.3.8
>
>
> I have a WSDL with the following wsp:policy:
> {code:xml}
> <wsp:UsingPolicy wsdl:Required="true" />
> <wsp:Policy wsu:Id="MyPolicy">
> <sp:SupportingTokens>
> <wsp:Policy>
> <sp:UsernameToken
>
> sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient";>
> <wsp:Policy>
> <sp:WssUsernameToken10 />
> </wsp:Policy>
> </sp:UsernameToken>
> </wsp:Policy>
> </sp:SupportingTokens>
> </wsp:Policy>
> {code}
> I create the binding using the following:
> {code:java}
> JAXWSSpringClientProxyFactoryBean factory = new
> JAXWSSpringClientProxyFactoryBean();
> // set service class, wsdl location, etc. on factory
> factory.getProperties().put(SecurityConstants.ACTOR, "myactor");
> factory.getProperties().put(SecurityConstants.USERNAME, "myusername");
> factory.getProperties().put(SecurityConstants.PASSWORD, "mypassword");
> {code}
> The above code results in the following SOAP header, which has the correct
> username and password but is missing the actor:
> {code:xml}
> <soap:Header>
> <wsse:Security
> xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";
> soap:mustUnderstand="1">
> <wsse:UsernameToken
> xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd";
> wsu:Id="UsernameToken-019185dc-94b7-4e62-b0fb-93577736a912">
> <wsse:Username>myusername</wsse:Username>
> <wsse:Password
> Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText";>mypassword</wsse:Password>
> </wsse:UsernameToken>
> </wsse:Security>
> </soap:Header>
> {code}
> The expected output header should also include {{soap:actor="myactor"}}
> attribute in the {{wsse:Security}} element.
> I believe this can be fixed by setting the actor in the
> [AbstractTokenInterceptor.findSecurityHeader|https://github.com/apache/cxf/blob/113e426f6b717925736433fe04a1b72f801dd574/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/AbstractTokenInterceptor.java#L151]
> method.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
