camel cxf ws-security implementation jboss eap - apache-camel

Question

I am trying to implement authentication and authorization for webservice using WS-Security UsernameToken .
Camel version 2.17
Jboss fuse 6.3
Jboss RAP 6.4.17
I have stored my username, password, and role in application realm of the JBoss EAP server.
Iam getting nullpointer in org.apache.wss4j.common.cache.EHCacheManagerHolder
am i missing anything in configuration?
Project location in GIT:
https://github.com/ravi21588/SO/tree/master/authenticationpoc
Soap Request with ws-secutiry headers :
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:exam="http://Example.org">
<soapenv:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken>
<wsse:Username>Harish</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">5p[#rnZc!mB[)]8{</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</soapenv:Header>
<soapenv:Body>
<exam:Add>
<!--Optional:-->
<exam:a>10</exam:a>
<!--Optional:-->
<exam:b>11</exam:b>
</exam:Add>
</soapenv:Body>
</soapenv:Envelope>
Server.log :
18:15:30,688 WARNING [org.apache.cxf.phase.PhaseInterceptorChain] (http-127.0.0.1:8443-1) Interceptor for {http://Example.org}CalculatorService#{http://Example.org}Add has thrown exception, unwinding now: java.lang.NullPointerException
at org.apache.wss4j.common.cache.EHCacheManagerHolder.getCacheManager(EHCacheManagerHolder.java:106)
at org.apache.cxf.ws.security.cache.EHCacheUtils.getCacheManager(EHCacheUtils.java:49) [cxf-rt-ws-security-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.ws.security.cache.CXFEHCacheReplayCache.<init>(CXFEHCacheReplayCache.java:37) [cxf-rt-ws-security-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.ws.security.wss4j.WSS4JUtils.getReplayCache(WSS4JUtils.java:126) [cxf-rt-ws-security-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.getReplayCache(WSS4JInInterceptor.java:637) [cxf-rt-ws-security-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.configureReplayCaches(WSS4JInInterceptor.java:404) [cxf-rt-ws-security-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessageInternal(WSS4JInInterceptor.java:237) [cxf-rt-ws-security-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:171) [cxf-rt-ws-security-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:80) [cxf-rt-ws-security-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308) [cxf-core-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121) [cxf-core-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:254) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:234) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:208) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:160) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:180) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:299) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:218) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:754) [jboss-servlet-api_3.0_spec-1.0.2.Final-redhat-2.jar:1.0.2.Final-redhat-2]
at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:274) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:295) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:231) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:149) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:169) [jboss-as-web-7.5.17.Final-redhat-4.jar:7.5.17.Final-redhat-4]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:151) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:97) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:102) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:856) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:656) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:926) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at java.lang.Thread.run(Thread.java:748) [rt.jar:1.8.0_151]
Server logs after vadim suggetion implementation:
10:01:40,322 WARNING [org.apache.cxf.phase.PhaseInterceptorChain] (http-127.0.0.1:8080-4) Interceptor for {http://Example.org}CalculatorService#{http://Example.org}Add has thrown exception, unwinding now: org.apache.cxf.interceptor.security.AuthenticationException: Authentication failed (details can be found in server log)
at org.apache.cxf.interceptor.security.JAASLoginInterceptor.handleMessage(JAASLoginInterceptor.java:171) [cxf-core-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308) [cxf-core-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121) [cxf-core-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:254) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:234) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:208) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:160) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:180) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:299) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:218) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:754) [jboss-servlet-api_3.0_spec-1.0.2.Final-redhat-2.jar:1.0.2.Final-redhat-2]
at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:274) [cxf-rt-transports-http-3.1.5.redhat-630310.jar:3.1.5.redhat-630310]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:295) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:231) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:149) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:169) [jboss-as-web-7.5.17.Final-redhat-4.jar:7.5.17.Final-redhat-4]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:151) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:97) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:102) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:856) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:656) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:926) [jbossweb-7.5.24.Final-redhat-1.jar:7.5.24.Final-redhat-1]
at java.lang.Thread.run(Thread.java:748) [rt.jar:1.8.0_151]

Answer 1

To do that you can use your own extension from org.apache.cxf.interceptor.security.JAASLoginInterceptor
In general it is very simple. You need to provide to JAASLoginInterceptor an instance of org.apache.cxf.interceptor.security.NamePasswordCallbackHandler.
You have to do 3 steps:
Step1: Interceptor:
package com.foo.security;
import javax.security.auth.callback.CallbackHandler;
import org.apache.cxf.interceptor.security.JAASLoginInterceptor;
import org.apache.cxf.interceptor.security.NamePasswordCallbackHandler;
public class CustomJAASLoginInterceptor extends JAASLoginInterceptor {
#Override
protected CallbackHandler getCallbackHandler(String name, String password) {
return new NamePasswordCallbackHandler(name, password, "setCredential");
}
}
Step2: Then in Camel-Cxf endpoint (or in CXF bus for it) define that interceptor:
<cxf-core:inInterceptors xmlns:cxf-core="http://cxf.apache.org/core">
<spring:bean id="authenticationInterceptor"
class="com.foo.security.CustomJAASLoginInterceptor">
</spring:bean>
</cxf-core:inInterceptors>
Step3: Again in the same Camel-Cxf endpoint (or in CXF bus for it) delegate message authentication out of WSS4J to JAASLoginInterceptor:
<cxf-core:properties>
<!-- delegate message authentication out of WSS4J to JAASLoginInterceptor -->
<spring:entry key="ws-security.validate.token" value="false" />
<!-- ... other properties -->
<cxf-core:properties>
After all it works seamlessly with JBoss EAP JAAS for users defined in EAP Application realm.
UPDATE 1:
It looks like you have to define in standalone.xml (or domain.xml) additional security domain and Login module for ApplicationRealm. I'm not sure which one is responsible for WebServices so, what I have in my standalone.xml
<subsystem xmlns="urn:jboss:domain:security:1.2">
...
<security-domain name="jboss-web-policy" cache-type="default">
<authentication>
<login-module code="RealmDirect" flag="optional">
<module-option name="realm" value="ApplicationRealm"/>
<module-option name="password-stacking" value="useFirstPass"/>
</login-module>
</authentication>
<authorization>
<policy-module code="Delegating" flag="required"/>
</authorization>
</security-domain>
<security-domain name="other" cache-type="default">
<authentication>
<login-module code="RealmDirect" flag="optional">
<module-option name="realm" value="ApplicationRealm"/>
<module-option name="password-stacking" value="useFirstPass"/>
</login-module>
<login-module code="Remoting" flag="optional">
<module-option name="password-stacking" value="useFirstPass"/>
</login-module>
</authentication>
<authorization>
<policy-module code="Web" flag="sufficient"/>
<policy-module code="Delegating" flag="sufficient"/>
</authorization>
</security-domain>
I do not see more differences in my working standalone.xml vs. default one provided with EAP installation.
UPDATE 2
So working WSSE header (built by SoapUI) looks like:
<soap:Header xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<wsse:Security soap:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:UsernameToken wsu:Id="UsernameToken-45417D5A3EF19629C315173319098351">
<wsse:Username>my_username</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">my_password</wsse:Password>
<wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">qY0N9DfYcd7kQfBkfNilRw==</wsse:Nonce>
<wsu:Created>2018-01-30T17:05:09.835Z</wsu:Created>
</wsse:UsernameToken>
</wsse:Security>
</soap:Header>
P.S. It also works with no nonce nor timestamp, but it is better to use them.