[WSS-255] Add support for enforcing a text or digest password type when processing a UsernameToken

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.5.9
• Fix Version/s: 1.6
• Assignee: Colm O hEigeartaigh
• Reporter: Colm O hEigeartaigh
• Created: 29/Nov/10 16:44
• Updated: 30/Nov/10 12:43
• Resolved: 30/Nov/10 12:43

Description

The UsernameTokenProcessor does not currently enforce the "passwordType" property on the inbound side. This task is to add a configuration switch (default to false for backwards compatibility) which enforces the "passwordType" property on an inbound Username Token. This functionality gives the receiver the ability to make sure that the received token is e.g. password digest, and not plaintext.

Issue Links

• is related to: CXF-2150 Web service provider using UsernameToken profile should throw an exception if SOAP client's password type <> web service provider's.