great writing and I got almost everything working…
One thing though: if I set uo de thes ecurity like you explain, I get while calling the service:

com.company.auth.service.ServerPasswordCallback cannot be cast to java.lang.String

And I don’t see what’s happening…
Do you have a clue?

This tutorial was of immense help. I did learn a few new things. Keep up the good work and help beginners like us.

Thanks a lot for the previous tutorial, and this security tutorial. It got me up and running CXF on Tomcat in no time.

Hi Dipesh,

Thanks too, for your handling of wrong client password. It saved me a lot of time searching over CXF documentation.

You dudes rock!

Can you tell me where from this “cxf-extension-soap.xml” and ‘cxf-servlet.xml” have come as you have not mentioned any where about these files.

What should i write in these files?

Manoj

In addition to my previous comment, there is one scenario in our application. We have Metro based WS-Security enabled web service and its implementation is based on WS-Security using Symmetric Keys. I am trying to hit the service using Apache CXF client but its not working. Is there any compatibility issues with these technologies or is there any way out for this.

DeKapx

This is really a very good tutorial. Sometimes back I explore WS-Security using Metro – WSIT. There ‘re multiple types of WS-Security can be created using Metro for example:
1. Message Security using Mutual Certificate
2. Message Security using Symmetric Keys.

and few more. Is there any possibility to create such types of WS-Security using Apache CXF. Any information on this will be a great help.

Thanks in advance.
DeKapx

One thing which I did not realize and got confused is when ‘passwordType’ is ‘PasswordText’, responsibility to validate password lies with the CallbackHandler.

I was trying to send wrong password from client and expecting the call to be rejected by WebService. But it was not happening.

After some google found information on CXF wiki page

http://cwiki.apache.org/CXF20DOC/ws-security.html

This note is present under ‘Username Token Authentication’ section, “Note that for the special case of a plain-text password (or any other yet unknown password type), the password validation is delegated to the callback class”.

After reading this I modified ServerPasswordCallback.handle () method, so that the code looks something like:

    public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {

        WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
        // Set the password on the callback. This will be compared to the
        //     password which was sent from the client.
        // We can call pc.getIdentifer() right here to check the username
        //     if we want each client to have it's own password.

        if (!pc.getPassword().equals(password)) {
			throw new SecurityException ("Password is invalid");
		}
    }

After this modification in ServerPasswordCallback, service started responding in correct way. Failed for wrong password and get valid response with correct password.