using user name and password in a webservice call

Question

I am writing java web services that need to accept user name and password from the caller for internal authentication before prviding the response. What is the standard way (or best practice) to do that? is it in the SOAP header or should it be supplied as one of the message parameters? where can I find code examples for that? Thank you.

Which WS stack you are using ?

Santosh
– Santosh

2011-09-20 13:02:07 +00:00
Commented Sep 20, 2011 at 13:02 — Santosh
– Santosh, Commented Sep 20, 2011 at 13:02

beny23 · Accepted Answer · 2011-09-19 19:06:15Z

1

The standard way for providing username and passwords is using WS-Security, which provides security information in the SOAP header:

<SOAP-ENV:Header>
  <wsse:Security SOAP-ENV:mustUnderstand="1"
    xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
    <wsse:UsernameToken 
      wsu:Id="UsernameToken-29477163"
      xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
      <wsse:Username>username</wsse:Username>
      <wsse:Password>verySecret</wsse:Password>
    </wsse:UsernameToken>
  </wsse:Security>
</SOAP-ENV:Header>

WSS4J implements the WS-Security headers for Java.

answered Sep 19, 2011 at 19:06

beny23

35.1k6 gold badges85 silver badges86 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

James-Jesse Drinkard · Accepted Answer · 2011-09-19 19:08:08Z

0

I like the java5 EE tutorials for these kinds of things, there are code samples and links to resources. http://download.oracle.com/javaee/5/tutorial/doc/bncbx.html

Another really good website for the security side of things in more depth is: OWasp at: https://www.owasp.org/index.php/Main_Page They are the experts in web security IMHO. We used their api's at a bank I worked at recently.

HTH, James

answered Sep 19, 2011 at 19:08

James-Jesse Drinkard

15.8k16 gold badges120 silver badges141 bronze badges

Comments

Bhaskar · Accepted Answer · 2011-09-19 19:08:51Z

0

Username and password are generally sent as parts in the http headers.JAX-WS provides constants USERNAME_PROPERTY and PASSWORD_PROPERTY for easy handling of these properties on the server.You will have to write a http handler for accessing these values.

void authenticate(HttpExchange ex){
  Headers headers = ex.getRequestHeaders();
 headers.get(BindingProvider.USERNAME_PROPERTY)
 headers.get(BindingProvider.PASSWORD_PROPERTY)
}

Call this method from the public void handle(HttpExchange ex) method of your Httphandler.

edited Sep 19, 2011 at 19:08

answered Sep 19, 2011 at 18:53

Bhaskar

7,5235 gold badges42 silver badges52 bronze badges

Collectives™ on Stack Overflow

using user name and password in a webservice call

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related