In addition to my previous comment, there is one scenario in our application. We have Metro based WS-Security enabled web service and its implementation is based on WS-Security using Symmetric Keys. I am trying to hit the service using Apache CXF client but its not working. Is there any compatibility issues with these technologies or is there any way out for this.

DeKapx

This is really a very good tutorial. Sometimes back I explore WS-Security using Metro – WSIT. There ‘re multiple types of WS-Security can be created using Metro for example:
1. Message Security using Mutual Certificate
2. Message Security using Symmetric Keys.

and few more. Is there any possibility to create such types of WS-Security using Apache CXF. Any information on this will be a great help.

Thanks in advance.
DeKapx

One thing which I did not realize and got confused is when ‘passwordType’ is ‘PasswordText’, responsibility to validate password lies with the CallbackHandler.

I was trying to send wrong password from client and expecting the call to be rejected by WebService. But it was not happening.

After some google found information on CXF wiki page

http://cwiki.apache.org/CXF20DOC/ws-security.html

This note is present under ‘Username Token Authentication’ section, “Note that for the special case of a plain-text password (or any other yet unknown password type), the password validation is delegated to the callback class”.

After reading this I modified ServerPasswordCallback.handle () method, so that the code looks something like:

    public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {

        WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
        // Set the password on the callback. This will be compared to the
        //     password which was sent from the client.
        // We can call pc.getIdentifer() right here to check the username
        //     if we want each client to have it's own password.

        if (!pc.getPassword().equals(password)) {
			throw new SecurityException ("Password is invalid");
		}
    }

After this modification in ServerPasswordCallback, service started responding in correct way. Failed for wrong password and get valid response with correct password.

Thank you for your help! Following your examples definitely cleared up a lot of my questions.

-Ben

I’m somewhat familiar with CXF, but am really having trouble understanding how to implement WS-Security. Thank you for your time!

This is a great tutorial. Does anyone know if a tutorial like this one exists for a JAXRS (RESTful) service. In my service I pass simple XML back and forth. I try using what is shown here in this tutorial and get a bunch of SOAP errors.

Thanks.

Thanks.

-Ben