Axis2 username/password Authentication

[Alan Richardson]

Hi folks,

Does anyone know how to set up handlers and apply a username/password header to a SOAP message using an Axis2 based client?

For instance in Axis 1 I can do the following:

Service service = new Service();
Call call = (Call) service.createCall();
call.setClientHandlers(new WSDoAllSender(),null );
call.setProperty(WSHandlerConstants.ACTION, "UsernameToken");
call.setProperty(WSHandlerConstants.USER,user.getUserName() );
call.setProperty(WSHandlerConstants.PW_CALLBACK_CLASS,"serviceAccess.DIIPWCallback");
call.setProperty("password", user.getUserPassword());
 
call.setTargetEndpointAddress("http://localhost:8080/axis/services/WebService");
call.setOperationStyle(Style.RPC);
 
 .. etc ..
call.invoke ...

Is it possible to do something similar with the Axis2 / Rampart API? I can only find examples that retrieve the username/password information from XML based descriptors.

[Ulf Dittmer]

I'm guessing that there is a way to use Rampart programmatically instead of declaratively, but I've never felt the need to do that. Is there a particular reason you'd like to avoid using deployment descriptors?
[ May 18, 2007: Message edited by: Ulf Dittmer ]

[Alan Richardson]

I have a front-end website which consumes the services so when a user inputs a username and password it is saved in a session bean and bundled with each request. Hence the 'user.getUserName()' from the snippet of code above.

Might there be a way of using descriptors for multiple users?

[Alan Richardson]

I'm attempting to use the following (based on the example 11 provided with Rampart 1.1), with no joy.

RPCServiceClient serviceClient = new RPCServiceClient();
Options options = serviceClient.getOptions();
EndpointReference targetEPR = new EndpointReference(endpointURL);
options.setTo(targetEPR);
        
QName operation = new QName(namespace, operationName);
        
// Set the rampart parameters
options.setProperty(WSSHandlerConstants.OUTFLOW_SECURITY,getOutflowConfiguration());
options.setProperty("password", userPassword);
 
serviceClient.setOptions(options);
        
//Engage rampart
serviceClient.engageModule(new QName("rampart"));
        
Object[] response = serviceClient.invokeBlocking(operation,arguments,returnType);

        
private static Parameter getOutflowConfiguration() 
{
        OutflowConfiguration ofc = new OutflowConfiguration();
        ofc.setActionItems("UsernameToken");
        ofc.setUser(userName);
        ofc.setPasswordCallbackClass("com.learnpipe.webservice.authentication.DIIPWCallback");
        return ofc.getProperty();
    }

I receive the following error:
java.lang.NullPointerException at com.ctc.wstx.sw.BaseNsStreamWriter.doWriteDefaultNs(BaseNsStreamWriter.java:528)

I can't find much information about this, although I'm actually receiving the same error when sending non-authenticated messages, so the problem may not be related directly to Rampart. (I originally had Axis2-1.2 running but I had to roll back to Axis2-1.1.1 due to Rampart compatibility).

Any ideas?

[ May 21, 2007: Message edited by: Alan Sunley ]
[ May 21, 2007: Message edited by: Alan Sunley ]

[Chih-Chieh Huang]

You can find the answer from the following 2 links.

HTTP Transport


Re: AXIS2 1.1.1 problem with BASIC AUTH

[Ulf Dittmer]

Originally posted by Chih-Chieh Huang:
You can find the answer from the following 2 links.

HTTP Transport


Re: AXIS2 1.1.1 problem with BASIC AUTH

These links are about HTTP authentication, not WS-Security authentication (which is really the preferred way, considering the easy availability of Rampart).

[Alan Richardson]

I've been experimenting with the RPCServiceClient above and find that I can successfully invoke the service from a java application, but not from within a Tomcat webapp.

It doesn't like that I pass a filled Object array containing the webservice method arguments.

Object[] operationArguments = new Object[] { "userName", "userCode" };
 
Object[] response = serviceClient.invokeBlocking(opTestService, operationArguments, returnTypes);

However I can pass an empty Object array ( Object[] operationArguments = new Object[] { }; ) without problem. Not particularly useful since I do need to pass arguments.

Are there any know issues invoking a service this way?


Full error trace:

java.lang.NullPointerException
at com.ctc.wstx.sw.BaseNsStreamWriter.doWriteDefaultNs(BaseNsStreamWriter.java:528)
at com.ctc.wstx.sw.SimpleNsStreamWriter.writeDefaultNamespace(SimpleNsStreamWriter.java:111)
at com.ctc.wstx.sw.SimpleNsStreamWriter.writeNamespace(SimpleNsStreamWriter.java:119)
at org.apache.axiom.om.impl.MTOMXMLStreamWriter.writeNamespace(MTOMXMLStreamWriter.java:146)
at org.apache.axiom.om.impl.util.OMSerializerUtil.serializeStartpart(OMSerializerUtil.java:329)
at org.apache.axiom.om.impl.util.OMSerializerUtil.serializeStartpart(OMSerializerUtil.java:171)
at org.apache.axiom.om.impl.llom.OMElementImpl.internalSerialize(OMElementImpl.java:804)
at org.apache.axiom.om.impl.llom.OMElementImpl.internalSerializeAndConsume(OMElementImpl.java:837)
at org.apache.axiom.om.impl.llom.OMElementImpl.internalSerialize(OMElementImpl.java:808)
at org.apache.axiom.om.impl.llom.OMElementImpl.internalSerializeAndConsume(OMElementImpl.java:837)
at org.apache.axiom.om.impl.llom.OMElementImpl.internalSerialize(OMElementImpl.java:808)
at org.apache.axiom.om.impl.llom.OMElementImpl.internalSerializeAndConsume(OMElementImpl.java:837)
at org.apache.axiom.om.impl.llom.OMElementImpl.internalSerialize(OMElementImpl.java:808)
at org.apache.axiom.soap.impl.llom.SOAPEnvelopeImpl.internalSerialize(SOAPEnvelopeImpl.java:179)
at org.apache.axiom.om.impl.llom.OMElementImpl.internalSerializeAndConsume(OMElementImpl.java:837)
at org.apache.axiom.om.impl.llom.OMNodeImpl.serializeAndConsume(OMNodeImpl.java:417)
at org.apache.axis2.transport.http.SOAPOverHTTPSender$AxisSOAPRequestEntity.handleOMOutput(SOAPOverHTTPSender.java:190)
at org.apache.axis2.transport.http.SOAPOverHTTPSender$AxisSOAPRequestEntity.writeRequest(SOAPOverHTTPSender.java:232)
at org.apache.commons.httpclient.methods.EntityEnclosingMethod.writeRequestBody(EntityEnclosingMethod.java:495)
at org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:1973)
at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:993)
at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:397)
at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:170)
at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:396)
at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:346)
at org.apache.axis2.transport.http.AbstractHTTPSender.executeMethod(AbstractHTTPSender.java:541)
at org.apache.axis2.transport.http.SOAPOverHTTPSender.send(SOAPOverHTTPSender.java:119)
at org.apache.axis2.transport.http.CommonsHTTPTransportSender.writeMessageWithCommons(CommonsHTTPTransportSender.java:335)
at org.apache.axis2.transport.http.CommonsHTTPTransportSender.invoke(CommonsHTTPTransportSender.java:204)
at org.apache.axis2.engine.AxisEngine.send(AxisEngine.java:674)
at org.apache.axis2.description.OutInAxisOperationClient.send(OutInAxisOperation.java:237)
at org.apache.axis2.description.OutInAxisOperationClient.execute(OutInAxisOperation.java:202)
at org.apache.axis2.client.ServiceClient.sendReceive(ServiceClient.java:579)
at org.apache.axis2.client.ServiceClient.sendReceive(ServiceClient.java:508)
at org.apache.axis2.rpc.client.RPCServiceClient.invokeBlocking(RPCServiceClient.java:95)

[Nathan McDonald]

Spent three days trying to figure this out, and this was the top google result so figured i'd put my solution in here for future searchers.

To get this to work, i had to ensure that rampart WASN'T enabled, otherwise I got all sorts of ClassCastExceptions.


import org.apache.axiom.om.OMElement;
import org.apache.axiom.om.OMNamespace;
import org.apache.axiom.soap.impl.dom.SOAPHeaderBlockImpl;
import org.apache.axiom.soap.impl.dom.soap11.SOAP11Factory;
import org.apache.axiom.soap.impl.dom.soap11.SOAP11HeaderBlockImpl;
import org.apache.axis2.AxisFault;
import org.apache.axis2.client.ServiceClient;
import org.apache.axis2.databinding.types.NonNegativeInteger;
import org.apache.axis2.databinding.types.PositiveInteger;

...


String username, password;

...


ServiceClient client = stub._getServiceClient();
SOAP11Factory factory = new SOAP11Factory();
OMNamespace SecurityElementNamespace = factory.createOMNamespace("http://schemas.xmlsoap.org/ws/2002/04/secext", "wlm");

OMElement usernameTokenEl = factory.createOMElement("UsernameToken", SecurityElementNamespace);
OMElement usernameEl = factory.createOMElement("Username", SecurityElementNamespace);
OMElement passwordEl = factory.createOMElement("Password", SecurityElementNamespace);
usernameEl.setText(username);
passwordEl.setText(password);
usernameTokenEl.addChild(usernameEl);
usernameTokenEl.addChild(passwordEl);

SOAPHeaderBlockImpl block = new SOAP11HeaderBlockImpl("Security", SecurityElementNamespace, factory);
block.addChild(usernameTokenEl);

client.addHeader(block);