Role Authorization using apache cxf.

[kopparapu v kiran kumar]

Hi,

I'm new to Apache CXF and WebServices. I need to authorize the user based on their role to decide whether he can access the web service method or not.

On the net we have only how to write use the SimpleAuthorizingInterceptor but we don't have any source for the client to test this authorization concept.

I have written some web service like this:

@WebMethod(operationName = "sayHiToUser", action = "urn:SayHiToUser")
		@RequestWrapper(className = "com.test.biz.services.jaxws.SayHiToUser", localName = "sayHiToUser", targetNamespace = "http://services.biz.test.com/")
		@ResponseWrapper(className = "com.test.biz.services.jaxws.SayHiToUserResponse", localName = "sayHiToUserResponse", targetNamespace = "http://services.biz.test.com/")
public String sayHiToUser(User user) {
		System.out.println("sayHiToUser called");
        users.put(users.size() + 1, user);
        return "Hello "  + user.getName();
	}

in the spring beans.xml file i have mentioned the information like this:

<jaxws:endpoint id="helloworld"
		implementor="com.test.biz.services.HelloWorldImpl" wsdlLocation="wsdl/helloworldimpl.wsdl"
		address="/helloworld">
		<jaxws:features>
			<bean class="org.apache.cxf.feature.LoggingFeature" />
		</jaxws:features>
		 <jaxws:inInterceptors>
   			<ref bean="authorizationInterceptor"/>
 		</jaxws:inInterceptors>
	</jaxws:endpoint>
	
	<bean id="authorizationInterceptor" class="org.apache.cxf.interceptor.security.SimpleAuthorizingInterceptor">
     <property name="methodRolesMap">
      <map>
        <entry key="sayHi" value="friend"/>
        <entry key="sayHiToUser" value="snoopie"/>  
      </map>
   </property> 
</bean>

And I generated the wsdl using eclipse Java2WSDL option.
When I'm tyring to access this service from the client I'm getting UNAUTHORIZED..

Here is my client code:

JaxWsProxyFactoryBean factory1 = new JaxWsProxyFactoryBean();    	 
Map<String, String> rolesMap = new HashMap<String, String>();
rolesMap.put("sayHi", "friend");
rolesMap.put("sayHiToUser", "snoopie");
SimpleAuthorizingInterceptor sai = new SimpleAuthorizingInterceptor();
sai.setMethodRolesMap(rolesMap);
factory1.getInInterceptors().add(sai);
factory1.setServiceClass(HelloWorld.class);
HelloWorld client = (HelloWorld)factory1.create();
client.sayHiToUser(new User("test"));

Here are my doubts:
1. Is my client is the correct one to access the webservice?
2. How do I pass the role information to the webservice while calling a web method?

Don't consider typos or compilation issues. This code is working fine if i remove the authorization bean in the beans.xml file.

How do I achieve the authorization provided by the apache cxf.

Please help me to solve this issue...