CXF Web服务服务器委托向内部Web服务调用的请求凭据

Question

How can I pass through the credentials (basic auth) from a getting request to a new request to another Webservice ?

I didn't find any property bag which can share data between the interceptors in a single request.

for clarification:

• client [with basic auth cred] --> request --> WS-1
• ** WS-1 --> request --> WS-2 and pass thru the credentials from the original client
• ** WS-1 --> request --> WS-3 (with no creds)
• WS-1 --> response --> client

Answer 1

Hope with this solution, i dont run in sec. trouble ?

What i have done:

Adding a inInterceptor the read out credentials and remote ip

    AuthorizationPolicy policy = message.get(AuthorizationPolicy.class);

    if (policy == null) {
        sendErrorResponse(message, HttpURLConnection.HTTP_UNAUTHORIZED);
        return;
    }


    message.put("request_usr", policy.getUserName());
    message.put("request_pwd", policy.getPassword());

Manipulate the CXF generated WebServiceClient to change the contructors return value like

/**
 * 
 * @return returns WebServiceClass
 */
@WebEndpoint(name = "WebServiceClassSoap")
public WebServiceClassSoap getWebServiceClassSoap() {
    return dynamicAuthorisation(super.getPort(WebServiceClassSoap,
            WebServiceClassSoap.class));
} 

private WebServiceClassSoap  dynamicAuthorisation (WebServiceClassSoap  service) {
    return dynamicAuthorisation(service, 
                PhaseInterceptorChain.getCurrentMessage().get("request_usr").toString(),
                PhaseInterceptorChain.getCurrentMessage().get("request_pwd").toString());
}


private WebServiceClassSoap  dynamicAuthorisation (WebServiceClassSoap  service, String username, String password) {

    Client client = ClientProxy.getClient(service);
    HTTPConduit http = (HTTPConduit) client.getConduit();

    AuthorizationPolicy auth = http.getAuthorization();

    auth.setUserName(username);
    auth.setPassword(password);

    http.setAuthorization(auth);

    return service;
}

Leaving the http-conf:conduit in beans.xml

    <http-conf:conduit name="{http://schemas.foobar.com/websvc/WebServiceClass/}WebServiceClassSoap.http-conduit">
        <http-conf:authorization>
                <!-- 
                <sec:UserName>${webservices.username}@${webservices.domain}</sec:UserName>
                <sec:Password>${webservices.password}</sec:Password>
                -->
                <sec:AuthorizationType>Basic</sec:AuthorizationType>
        </http-conf:authorization>
        <http-conf:client AllowChunking="false" ConnectionTimeout="30000" />            
</http-conf:conduit>

Thanks to Apache CXF: Forwarding an information from an interceptor to the actual webservice implementation =)