Java SOAP webservice authentication engine

Question

I am building a Java webservice (wsdl) that will be consumed via SOAP. I need to implement a form of authentication in each method of the webservice so that each request is tested if the source is someone with permission.

I tried to follow this tutorial, but I didn’t get good results. My test code looked like this:

@WebMethod(operationName = "autentica")
public String autentica() {
    MessageContext mContext = wsContext.getMessageContext();

    Map http_headers = (Map) mContext.get(MessageContext.HTTP_REQUEST_HEADERS);
    List userList = (List) http_headers.get("Username");
    List passList = (List) http_headers.get("Password");

    String username = "";
    String password = "";

    if(userList != null) {
        username = userList.get(0).toString();
        System.out.println("User: " + userList.get(0).toString());
    }

    if(passList != null) {
        password = passList.get(0).toString();
        System.out.println("Pass: " + passList.get(0).toString());
    }

    if (username.equals("admin") && password.equals("admin")){
        return "Hello World JAX-WS - Valid User!";
    }else{
        return "Unknown User!";
    }
}

To consume the tested webservice with SOAPUI and an Ionic app using angular Soap 3.0 and in both headings came as null, causing it to be returned "Unknown User!"

Could someone tell me what I’m doing wrong or another form of authentication that I can use?

EDIT

IONIC App

Code used in the Ionic app to request for the webservice:

$soap.setCredentials("admin","admin");
$soap.post(url, "autentica").then(
    function(response) {
        console.log(response);
    }
);

Console output: Unknown User!

Soapui

Setting the authentication settings:

Return of the requisition:

<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
   <S:Body>
      <ns2:autenticaResponse xmlns:ns2="http://service.natal.rn.gov.br/">
          <return>Unknown User!</return>
      </ns2:autenticaResponse>
   </S:Body>
</S:Envelope>

Answer 1

The most likely answer is that you is not inserting the headers User and Password at the time of calling the webservice.

In section 3 of tutorial that you indicated, is described as doing it the right way. In section 4 it shows how HTTP headers should reach the server.

Regarding the use of angular-Soap, the README.Md of the same indicates in example 5, how to configure credentials the way he thinks it should be:

$soap.setCredentials("username","password");

Which in the end is something like:

xmlHttp.setRequestHeader("Authorization", "Basic " + SOAPClient._toBase64(SOAPClient.userName + ":" + SOAPClient.password));

Which is nothing like your way of passing password and user.

It seems that SOAPUI recommends doing almost the same thing: https://www.soapui.org/soap-and-wsdl/authenticating-soap-requests.html

They are based on the method HTTP Basic Authentication.

I don’t recommend using custom HTTP headers, because in the past browsers didn’t accept, and whenever someone needed to access yours webservice, you will need to write a much larger manual to understand exactly which is the correct mode. I prefer to use cookies, their behavior is standardized.

Some prefer to use HTTP Basic Authentication, it is also valid.

It’s been a while since I worked with SOAP, at that time, the ideal would be to use SAML and WS-Security. Not that I recommend it, just to let you know that it’s also an option. In a way, it’s a beautiful family of specifications. Most developers abandoned SOAP to use REST, the cause of it is a mystery ;)