Problems with UsernameToken security scenario for a proxy service

yakovo's picture
Hi, I couldn't find an example of applying usernametoken auth. scenario to a proxy service, so I tried it by myself with no success: JDK = 1.5 Update 15 WSO2 ESB = 2.0.2 WIN XP Pro 2002 SP2 Scenario 1: Access WSO2 ESB GUI Admin to create a proxy service (http transport only) for an unsecured web service, hosted at Tomcat[6.0.18]+Axis2[1.4.1] bundle on the same host. Accessing the created proxy from a stand-alone java web service consumer works just fine. Scenario 2: Access WSO2 ESB GUI Admin to apply UsernameToken authentication to the proxy, created in scenario 1 and modify your stand-alone java web service consumer to provide a message sent with a proper security header. When choosing to apply UsernameToken authentication by going to Home > Manage > Service > List > Service Dashboard > Security for the service, and then checking UsernameToken from Basic Scenario list, regardless of permission settings (admin, everyone or whatever else created by your own) all calls to the proxy fail on General security error (WSSecurityEngine: Callback supplied no password for ). When choosing to apply UsernameToken authentication by using policy attachment with a custom callback handler, referenced from a policy file, all calls to the proxy fail on Read Timeout error, never reaching the target service, but failing somewhere at the ESB's front. Again, consumer messages have a valid security sctructure (varified by tcpmon). Has anyone ever succeeded to run this scenario?
yakovo's picture

The summary of issues

The summary of issues are: 1. General security error happens when a client sends a digest while the esb expects to get a plain password. I suggest to improve the error logs so that they would be more clear to undertsand. 2. For a digest scenario, a callback handler specified in proxy service's policy should be packaged as an OSGi bundle and deployed into plugins folder of the esb installation. Cheers.
library project main code
Learn Cloud
Learn
Cloud

The WSO2 Application Server is a reliable application server that can host your enterprise web applications. The WSO2 Application Server as a Service is offered in StratosLive, the WSO2 Platform as a Service. This article explains how a simple web application can be developed and deployed from Carbon Studio to the WSO2 Application Server...

Latest Webinar
Different groups within an organization need to monitor different Key Performance Indicators (KPIs) - An operations team will be interested in the response times of business services and loads of each service,..
Thursday, February 9th 2012, 09.00 AM (PST)

Thursday, February 9th 2012, 10.00 AM (GMT)