Announcement Announcement Module
Collapse
No announcement yet.
Getting hold of the sign certificate Page Title Module
Move Remove Collapse
X
Conversation Detail Module
Collapse
  • Filter
  • Time
  • Show
Clear All
new posts

  • Getting hold of the sign certificate

    I need to create an EndpointInterceptor that extracts the certificate used to validate the signature a in previoulsy executed wss4j-interceptor.
    Can the certificate be fetched from the MessageContext?

  • #2
    Originally posted by kriand View Post
    I need to create an EndpointInterceptor that extracts the certificate used to validate the signature a in previoulsy executed wss4j-interceptor.
    Can the certificate be fetched from the MessageContext?
    If I am understanding what you are asking, Wss4jSecurityInterceptor seems to be doing just that. If you step through it, you can see it extract the certificate from the request.

    Code:
        protected void validateMessage(SoapMessage soapMessage, MessageContext messageContext)
                throws WsSecurityValidationException {
            if (logger.isDebugEnabled()) {
                logger.debug("Validating message [" + soapMessage + "] with actions [" + validationActions + "]");
            }
    
            if (validationAction == WSConstants.NO_SECURITY) {
                return;
            }
    
            Document envelopeAsDocument = toDocument(soapMessage, messageContext);
    
            // Header processing
            WSSecurityEngine securityEngine = WSSecurityEngine.getInstance();
    
            try {
                Vector results = securityEngine
                        .processSecurityHeader(envelopeAsDocument, validationActor, validationCallbackHandler,
                                validationSignatureCrypto, validationDecryptionCrypto);

    Comment

    Working...
    X