[WSS-321] Cannot configure for no password element expected using Spring configuration

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.6.3
• Fix Version/s: 1.6.4
• Component/s: WSS4J Core, WSS4J Handlers
• Environment: Ubuntu 10.04. ServiceMix 4.
• Assignee: Colm O hEigeartaigh
• Reporter: Paul Richardson
• Created: 20/Oct/11 10:50
• Updated: 06/Dec/11 10:31
• Resolved: 21/Oct/11 09:41

Description

We don't wish to have a Password element in the inbound SOAP request.
WSSecurityUtil.decodeAction() parses the actions that are put in the Spring xml file. We have "UsernameToken", so decodeAction sets the internal representation of the expected WS Security elements to a list with the single value: WSConstants.UT(0x01).

When a SOAP message arrives, UsernameTokenProcessor.handleToken() is called which sets the expected action to WSConstants.UT_NOPASSWORD (0x2000) because there is no password element.Thus when WSHandler.checkReceiverResultsAnyOrder() which checks that the list of expected actions and received actions are the same, it fails and the debug output is 'Security processing failed (actions mismatch)".

Yes, we could override the Processor to get around this, but we were hoping to take advantage of the recent changes which meant that we just needed to implement our own Validator.