Why is WSPasswordCallback.getPassword null when I try my SOAP request - axis2

Question

I have made an Axis2 web service with Rampart security, but I was constantly receiving NullPointerException at this line:
if((pwcb.getIdentifier().equals("bob")) && pwcb.getPassword().equals("bobPW")) )
So I added this code:
if ( pwcb.getPassword()==null) {
throw new Exception ("passsssssssss is null:"+pwcb.getPassword());
}
Which threw the exception; so I know that the problem is that pwcb.getPassword is null, but don't understand why.
This is the SOAP request I'm sending:
<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:nilo="http://nilo">
<soapenv:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soapenv:mustUnderstand="1">
<wsse:UsernameToken xmlns:wsu="http://docs.oasisopen.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="123">
<wsse:Username>bob</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">bobPW</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</soapenv:Header>
<soapenv:Body>
<nilo:getdataForChecking>
<nilo:data>tranXml</nilo:data>
</nilo:getdataForChecking>
</soapenv:Body>
</soapenv:Envelope>
Here is the handle method that I'm using:
public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
for (int i = 0; i < callbacks.length; i++) {
//When the server side need to authenticate the user
WSPasswordCallback pwcb = (WSPasswordCallback)callbacks[i];
if ( pwcb.getPassword()==null) {
try {
throw new Exception ("passsssssssss null:"+pwcb.getPassword());
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
else {
try {
throw new Exception ("pass nooot null:"+pwcb.getPassword());
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
if(pwcb.getIdentifier().equals("bob") && pwcb.getPassword().equals("bobPW")) {
return;
}
//When the client requests for the password to be added in to the
//UT element
}
}

Answer 1

Whether WSPasswordCallback contains password depends on its usage field. For instance for usage USERNAME_TOKEN_UNKNOWN the password is set and callback handler is supposed to throw an exception, if it does not match username. For SIGNATURE on the other hand, the password field is empty and the callback needs to set it, so that the key can be retrieved from keystore.
You should verify in what scenario callback is called and react appropriately. For instance:
// Rampart expects us to do authentication in this case
if (pwcb.getUsage() == WSPasswordCallback.USERNAME_TOKEN_UNKNOWN) {
String password = passwordFor(pwcb.getIdentifier());
if (pwcb.getPassword().equals(password))
return;
throw new UnsupportedCallbackException(callback,
"password check failed for user " + pwcb.getIdentifier());
}
if (pwcb.getUsage() == WSPasswordCallback.SIGNATURE) {
pwcb.setPassword(passwordFor(pwcb.getIdentifier()));

Answer 2

The handler needs to know the password of the user that initiated the call. You do not have to do the comparison yourself.
Modifying this line from:
if((pwcb.getIdentifier().equals("bob")) && pwcb.getPassword().equals("bobPW")) )
to:
if (pwcb.getIdentifier().equals("bob"))
{
pwcb.setPassword("bobPW");
}