Access to security headers in JAX-WS custom handler - header

Question

I want to implement custom handler that will check if request contains all required security headers.
The "head" part of the request looks as follows:
<soapenv:Header xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<header1>value of header one</header1>
<header2>value of header two</header2>
<wsse:Security soap:mustUnderstand="1" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken>
<wsse:Username>X</wsse:Username>
<wsse:Password>X</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</soapenv:Header>
I tried to get access to the seciurity header and I can't.
First way which I tried was:
public class MyCustomHandler implements
SOAPHandler<SOAPMessageContext> {
public boolean handleMessage(SOAPMessageContext smc) {
SOAPMessage message = smc.getMessage();
SOAPHeader header = message.getSOAPHeader();
Iterator iterator = header.getChildElements();
while (iterator.hasNext()) {
SOAPElement element = (SOAPElement) iterator.next();
log.debug(element.getValue());
log.debug(element.getLocalName());
}
return true;
}
public boolean handleFault(SOAPMessageContext smc) {
logToSystemOut(smc);
return true;
}
public void close(MessageContext messageContext) {
}
...
Unfortunetaly the "while" loop logged only header1 and header2 but there is nothing about "Seciurity".
I tried also getChilds(Qname) but it also does not work.

Answer 1

You might want to try using the SOAPPart of the message:
if (!((Boolean) messageContext.get(SOAPMessageContext.MESSAGE_OUTBOUND_PROPERTY)).booleanValue()) {
SOAPPart msg = messageContext.getMessage().getSOAPPart();
XPathFactory xPathFactory = XPathFactory.newInstance();
XPath xPath = xPathFactory.newXPath();
final Map<String, String> namespaceMap = new HashMap<String, String>();
namespaceMap.put("soap", "http://schemas.xmlsoap.org/soap/envelope/");
namespaceMap.put("wsse", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");
NamespaceContext nsContext = new NamespaceContext() {
#Override
public Iterator<String> getPrefixes(String namespaceURI) {
List<String> prefixes = new ArrayList<String>();
for (String url : namespaceMap.values()) {
if (url.equals(namespaceURI)) {
prefixes.add(url);
}
}
return prefixes.iterator();
}
#Override
public String getPrefix(String namespaceURI) {
return getPrefixes(namespaceURI).next();
}
#Override
public String getNamespaceURI(String prefix) {
return namespaceMap.get(prefix);
}
};
xPath.setNamespaceContext(nsContext);
String userName = (String) xPath.evaluate("/soap:Envelope/soap:Header/wsse:Security/wsse:UsernameToken/wsse:Username/text()", msg,
XPathConstants.STRING);
String password = (String) xPath.evaluate("/soap:Envelope/soap:Header/wsse:Security/wsse:UsernameToken/wsse:Password/text()", msg,
XPathConstants.STRING);
}
I also added a check for "only inbound" messages. You don't want to check for security-stuff on you replies I assume.
Does this work for you (I just typed this down. Didnt really test it so you might have a compile issue)?