[CXF-5521] Setting SecurityConstants.STS_TOKEN_ON_BEHALF_OF as CallbackHander requires better documentation.

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0-milestone1, 2.7.8
• Fix Version/s: 2.6.12, 2.7.9, 3.0.0-milestone2
• Component/s: Documentation
• Estimated Complexity: Unknown
• Assignee: Colm O hEigeartaigh
• Reporter: Rebecca Searls
• Created: 23/Jan/14 21:26
• Updated: 11/Jul/14 12:50
• Resolved: 24/Jan/14 11:59

Description

Using: cxf-tr-ws-security-2.7.8

The current documentation states that SecurityConstants.STS_TOKEN_ON_BEHALF_OF
declared with "a CallbackHandler object to use to obtain the token"

A very specific CallbackHandler implementation is required. It MUST be
an implementation that supports processing DelegationCallback as input and
generating a org.w3c.dom.Element.

Existing examples are
org.apache.cxf.ws.security.trust.delegation.ReceivedTokenCallbackHandler
org.apache.cxf.ws.security.trust.delegation.WSSUsernameCallbackHandler

The code in org.apache.cxf.ws.security.trust.AbstractSTSClient requires this.

814 DelegationCallback callback = new DelegationCallback(message);
815 ((CallbackHandler)delegationObject).handle(new Callback[]

{callback}

);
816 return callback.getToken();