Class AbstractWsSecurityInterceptor

java.lang.Object
org.springframework.ws.soap.security.AbstractWsSecurityInterceptor
All Implemented Interfaces:
org.springframework.core.Ordered, ClientInterceptor, EndpointInterceptor, SoapEndpointInterceptor
Direct Known Subclasses:
Wss4jSecurityInterceptor
public abstract class AbstractWsSecurityInterceptor extends Object implements SoapEndpointInterceptor, ClientInterceptor, org.springframework.core.Ordered
Interceptor base class for interceptors that handle WS-Security. Can be used on the server side, registered in a endpoint mapping; or on the client side, on the web service template.

Subclasses of this base class can be configured to secure incoming and secure outgoing messages. By default, both are on.

Fault responses are treated separately from regular responses: they are not secured or validated unless secureFault or validateFault is explicitly enabled, since existing WS-Security configurations may not expect to secure or validate the fault path.

Since:
1.0.0

  • Field Details

    • DEFAULT_ORDER

      public static final int DEFAULT_ORDER
      Default order for WS-Security interceptors, ensuring they run early. Any interceptor with a higher precedence than -200 will therefore run before security is applied.
      Since:
      3.1.9
      See Also:

    • logger

      protected final org.apache.commons.logging.Log logger
      Logger available to subclasses.

    • WS_SECURITY_NAME

      protected static final QName WS_SECURITY_NAME

  • Constructor Details

    • AbstractWsSecurityInterceptor

      public AbstractWsSecurityInterceptor()

  • Method Details

    • setValidateRequest

      public void setValidateRequest(boolean validateRequest)
      Indicates whether server-side incoming request are to be validated. Defaults to true.

    • setSecureResponse

      public void setSecureResponse(boolean secureResponse)
      Indicates whether server-side outgoing responses are to be secured. Defaults to true.

    • setSecureRequest

      public void setSecureRequest(boolean secureRequest)
      Indicates whether client-side outgoing requests are to be secured. Defaults to true.

    • setValidateResponse

      public void setValidateResponse(boolean validateResponse)
      Indicates whether client-side incoming responses are to be validated. Defaults to true.

    • setExceptionResolver

      public void setExceptionResolver(EndpointExceptionResolver exceptionResolver)
      Provide an EndpointExceptionResolver for resolving validation exceptions.

    • setSkipValidationIfNoHeaderPresent

      public void setSkipValidationIfNoHeaderPresent(boolean skipValidationIfNoHeaderPresent)
      Indicates whether validation is skipped for messages that carry no wsse:Security header. Defaults to false.

      On the server side, this applies to incoming requests, and the sender of a request decides whether to include the header. Enabling this therefore makes every validation action configured on this interceptor optional from the caller's point of view: a request that simply omits the header reaches the endpoint with no signature, encryption, timestamp or username token check applied. Do not enable this for endpoints that rely on WS-Security to authenticate or authorize their callers.

      On the client side, this applies to the validation of responses received from a server that the client chose to call, where accepting an unsecured reply is usually a deliberate interoperability decision rather than a trust boundary.

    • setSecureFault

      public void setSecureFault(boolean secureFault)
      Indicate whether server-side outgoing fault responses are to be secured. Defaults to false.

      Some clients, such as those built with WCF, require that fault responses carry the same WS-Security header (for instance a Timestamp) as regular responses.

      Since:
      5.1.0

    • setValidateFault

      public void setValidateFault(boolean validateFault)
      Indicate whether client-side incoming fault responses are to be validated. Defaults to false.
      Since:
      5.1.0

    • getOrder

      public int getOrder()
      Specified by:
      getOrder in interface org.springframework.core.Ordered

    • handleRequest

      public final boolean handleRequest(MessageContext messageContext, Object endpoint) throws Exception
      Validates a server-side incoming request. Delegates to validateMessage(SoapMessage,MessageContext) if the validateRequest property is true.
      Specified by:
      handleRequest in interface EndpointInterceptor
      Parameters:
      messageContext - the message context, containing the request to be validated
      endpoint - chosen endpoint to invoke
      Returns:
      true if the request was valid; false otherwise.
      Throws:
      Exception - in case of errors
      See Also:

    • handleResponse

      public final boolean handleResponse(MessageContext messageContext, Object endpoint) throws Exception
      Secures a server-side outgoing response. Delegates to secureMessage(org.springframework.ws.soap.SoapMessage, MessageContext) if the secureResponse property is true.
      Specified by:
      handleResponse in interface EndpointInterceptor
      Parameters:
      messageContext - the message context, containing the response to be secured
      endpoint - chosen endpoint to invoke
      Returns:
      true if the response was secured; false otherwise.
      Throws:
      Exception - in case of errors
      See Also:

    • handleFault

      public boolean handleFault(MessageContext messageContext, Object endpoint) throws Exception
      Secure a server-side outgoing fault response. Delegates to secureMessage(SoapMessage, MessageContext) if the secureFault property is true. Fault responses are not secured by default.
      Specified by:
      handleFault in interface EndpointInterceptor
      Parameters:
      messageContext - the message context, containing the fault response to be secured
      endpoint - chosen endpoint to invoke
      Returns:
      true if the fault response was secured, or securing it was not requested; false otherwise.
      Throws:
      Exception - in case of errors
      See Also:

    • afterCompletion

      public void afterCompletion(MessageContext messageContext, Object endpoint, @Nullable Exception ex)
      Description copied from interface: EndpointInterceptor
      Callback after completion of request and response (fault) processing. Will be called on any outcome of endpoint invocation, thus allows for proper resource cleanup.

      Note: Will be called if this interceptor's EndpointInterceptor.handleRequest(MessageContext, Object) method was invoked, whatever its outcome. In particular, it is called when handleRequest returned false or threw an exception, so that an interceptor can release whatever it had set up by then. This differs from EndpointInterceptor.handleResponse(MessageContext, Object) and EndpointInterceptor.handleFault(MessageContext, Object), which are only called when handleRequest returned.

      As with the EndpointInterceptor.handleResponse(MessageContext, Object) method, the method will be invoked on each interceptor in the chain in reverse order, so the first interceptor will be the last to be invoked.

      Specified by:
      afterCompletion in interface EndpointInterceptor
      Parameters:
      messageContext - contains both request and response messages, the response should contains a Fault
      endpoint - chosen endpoint to invoke
      ex - exception thrown on handler execution, if any

    • understands

      public boolean understands(SoapHeaderElement headerElement)
      Description copied from interface: SoapEndpointInterceptor
      Given a SoapHeaderElement, return whether or not this SoapEndpointInterceptor understands it.
      Specified by:
      understands in interface SoapEndpointInterceptor
      Parameters:
      headerElement - the header
      Returns:
      true if understood, false otherwise

    • handleRequest

      public final boolean handleRequest(MessageContext messageContext) throws WebServiceClientException
      Secures a client-side outgoing request. Delegates to secureMessage(SoapMessage, MessageContext) if the secureRequest property is true.
      Specified by:
      handleRequest in interface ClientInterceptor
      Parameters:
      messageContext - the message context, containing the request to be secured
      Returns:
      true if the response was secured; false otherwise.
      Throws:
      WebServiceClientException - in case of errors
      See Also:

    • handleResponse

      public final boolean handleResponse(MessageContext messageContext) throws WebServiceClientException
      Validates a client-side incoming response. Delegates to validateMessage(SoapMessage, MessageContext) if the validateResponse property is true.
      Specified by:
      handleResponse in interface ClientInterceptor
      Parameters:
      messageContext - the message context, containing the response to be validated
      Returns:
      true if the request was valid; false otherwise.
      Throws:
      WebServiceClientException - in case of errors
      See Also:

    • handleFault

      public boolean handleFault(MessageContext messageContext) throws WebServiceClientException
      Validates a client-side incoming fault response. Delegates to validateMessage(SoapMessage, MessageContext) if the validateFault property is true. Fault responses are not validated by default.
      Specified by:
      handleFault in interface ClientInterceptor
      Parameters:
      messageContext - the message context, containing the fault response to be validated
      Returns:
      true if the fault response was valid, or validating it was not requested; false otherwise.
      Throws:
      WebServiceClientException - in case of errors
      See Also:

    • afterCompletion

      public void afterCompletion(MessageContext messageContext, @Nullable Exception ex) throws WebServiceClientException
      Description copied from interface: ClientInterceptor
      Callback after completion of request and response (fault) processing. Will be called on any outcome, thus allows for proper resource cleanup.

      Note: Will only be called if this interceptor's ClientInterceptor.handleRequest(MessageContext) method has successfully completed.

      Specified by:
      afterCompletion in interface ClientInterceptor
      Parameters:
      messageContext - contains both request and response messages, the response should contains a Fault
      ex - exception thrown on handler execution, if any
      Throws:
      WebServiceClientException - in case of errors

    • handleSecurementException

      protected boolean handleSecurementException(WsSecuritySecurementException ex, MessageContext messageContext)
      Handles an securement exception. Default implementation logs the given exception, and returns false.
      Parameters:
      ex - the validation exception
      messageContext - the message context
      Returns:
      true to continue processing the message, false (the default) otherwise

    • handleValidationException

      protected boolean handleValidationException(WsSecurityValidationException ex, MessageContext messageContext)
      Handles an invalid SOAP message. Default implementation logs the given exception, delegates to the set exceptionResolver if any, or creates a SOAP 1.1 Client or SOAP 1.2 Sender Fault with the exception message as fault string, and returns false.
      Parameters:
      ex - the validation exception
      messageContext - the message context
      Returns:
      true to continue processing the message, false (the default) otherwise

    • handleFaultException

      protected boolean handleFaultException(WsSecurityFaultException ex, MessageContext messageContext)
      Handles a fault exception.Default implementation logs the given exception, and creates a SOAP Fault with the properties of the given exception, and returns false.
      Parameters:
      ex - the validation exception
      messageContext - the message context
      Returns:
      true to continue processing the message, false (the default) otherwise

    • validateMessage

      protected abstract void validateMessage(SoapMessage soapMessage, MessageContext messageContext) throws WsSecurityValidationException
      Abstract template method. Subclasses are required to validate the request contained in the given SoapMessage, and replace the original request with the validated version.
      Parameters:
      soapMessage - the soap message to validate
      Throws:
      WsSecurityValidationException - in case of validation errors

    • secureMessage

      protected abstract void secureMessage(SoapMessage soapMessage, MessageContext messageContext) throws WsSecuritySecurementException
      Abstract template method. Subclasses are required to secure the response contained in the given SoapMessage, and replace the original response with the secured version.
      Parameters:
      soapMessage - the soap message to secure
      Throws:
      WsSecuritySecurementException - in case of securement errors

    • cleanUp

      protected abstract void cleanUp()