Re: UsernameToken functionality in WSS4J

Forwarding email to the mailing list...

-- dims

--- "Eadie, Alex" <Alex.Eadie-l7vOTtBFAXBJio3rWQmXxw@xxxxxxxxxxxxxxxx> wrote:

> Hi Werner,
> 
>  
> 
> We are trying use wss4j's UsernameToken functionality as a step up from
> simple http authentication in our JBoss based application.
> 
>  
> 
> The implementation in WSSecurityEngine.handleUsernameToken() that is
> provided assumes that given a username from across the wire, the writer
> of the UsernameTokenCallBack can return the bonafide password.   However
> in our case we cannot provide the bonafide password, we can only
> ascertain whether a username/password combination is valid.  This is
> because the bonafide password is one-way hashed in our password
> database.   
> 
>  
> 
> However the implementation of handleUsernameToken() also assumes that
> the passwords sent across the wire are also one-way hashed.   This
> implies that it is not possible to get the password that came across the
> wire back into clear text.   Is this correct?
> 
>  
> 
> If this is the case how did you see integration with an application
> server working?  When neither the password coming across the wire nor
> the password available in the password database can be returned to clear
> text and hence compared to each other.
> 
>  
> 
> Is there any way the implementation can be modified to accommodate our
> situation?  This could be configurable using an additional parameter in
> the deployment XML?
> 
>  
> 
> Best Regards
> 
> Alex Eadie
> 
>  
> 
>  
> 
> Developer
> 
> Telstra IADev
> 
> Ph (02) 8255 3154
> 
> Level 8
> 
> 400 George St
> 
> Sydney
> 
>  
> 
> 


=====
Davanum Srinivas - http://webservices.apache.org/~dims/

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com