I will asume you have already set up a web service with WSF/Spring (just WSF for brevity) + WS-Signature (using rampart) and that you know about spring security, I will only show how to add an axis2 handler to WSF to intercept incoming web services operations and authenticate them using spring security and WS-Signature.

Axis2 Handler for Spring Security Integration

import util.ServiceContext;
import org.apache.axis2.AxisFault;
import org.apache.axis2.context.MessageContext;
import org.apache.axis2.engine.Handler;
import org.apache.axis2.handlers.AbstractHandler;
import org.apache.ws.security.WSSecurityEngineResult;
import org.apache.ws.security.handler.WSHandlerConstants;
import org.apache.ws.security.handler.WSHandlerResult;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import javax.security.auth.Subject;
import java.security.cert.X509Certificate;
import java.util.Iterator;
import java.util.List;

/**
* Executed in a custom phase after the security phase has been proccesed
*
* Creado por: jaime
* 28/12/11
*/
public class SpringSecurityHandler extends AbstractHandler {

@Override
public InvocationResponse invoke(MessageContext msgContext) throws AxisFault {


//  get xmldsig and authenticate
List<Object> results = (List<Object>) msgContext.getProperty(WSHandlerConstants.RECV_RESULTS);
if (results == null) {
return InvocationResponse.ABORT;
}


for (Iterator iter = results.iterator(); iter.hasNext(); ) {
WSHandlerResult hr = (WSHandlerResult) iter.next();
if (hr == null || hr.getResults() == null) {
return InvocationResponse.ABORT;
}
for (Iterator it = hr.getResults().iterator(); it.hasNext(); ) {
WSSecurityEngineResult er = (WSSecurityEngineResult) it.next();
if (er != null && er.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE) instanceof X509Certificate) {
X509Certificate x509Cert= (X509Certificate) er.get(WSSecurityEngineResult.TAG_X509_CERTIFICATE);

// TODO check against database

SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(x509Cert, null));


return InvocationResponse.CONTINUE;
}
}
}
return InvocationResponse.ABORT;
}

}

axis2Config.xml (Displaying only modified parts)

<bean id="axis2InFaultPhaseOrder">
<property name="phaseOrderType" value="InFaultFlow"></property>
<property name="phases">
<list>
<ref bean="axis2AddressingPhase"/>
<ref bean="security"/>
<ref bean="springSecurityCheckPhase"/>
<ref bean="preDispatchPhase"/>
<bean id="InFaultDispatchPhase">
<property name="name" value="Dispatch"></property>
<property name="clazz" value="org.apache.axis2.engine.DispatchPhase"></property>
<property name="handlers">
<list>
<ref bean="RequestURI"/>
<ref bean="SOAPAction"/>
<ref bean="RequestURIOperation"/>
<ref bean="SOAPMessageBody"/>
<ref bean="HTTPLocationBased"/>
</list>
</property>
</bean>
</list>
</property>
</bean>

<bean id="axis2InPhaseOrder">
<property name="phaseOrderType" value="InFlow"></property>
<property name="phases">
<list>
<ref bean="axis2TransportPhase"/>
<ref bean="axis2AddressingPhase"/>
<ref bean="security"/>
<ref bean="springSecurityCheckPhase"/>
<ref bean="preDispatchPhase"/>
<bean id="InDispatchPhase">
<property name="name" value="Dispatch"></property>
<property name="clazz" value="org.apache.axis2.engine.DispatchPhase"></property>
<property name="handlers">
<list>
<ref bean="RequestURI"/>
<ref bean="SOAPAction"/>
<ref bean="RequestURIOperation"/>
<ref bean="SOAPMessageBody"/>
<ref bean="HTTPLocationBased"/>
</list>
</property>
</bean>

</list>
</property>
</bean>



....

<!-- add a handler in the Security phase after SecurityInHandler-->

<bean id="springSecurityHandlerBean">
<property name="name" value="SpringSecurityHandler"></property>
<property name="clazz" value="com.kprtech.service.ws.security.SpringSecurityHandler"></property>
</bean>

<bean id="springSecurityCheckPhase">
<property name="name" value="SpringSecurityCheckPhase" />
<property name="handlers">
<list>
<ref bean="springSecurityHandlerBean"/>
</list>
</property>
</bean>

The last part of xml is creating a new phase with a handler (SpringSecurityHandler) and attaching it to axis2InPhaseOrder and axis2InFaultPhaseOrder after the Security proccesing of rampart.
]]> http://elespaciodejaime.wordpress.com/2011/12/29/wsfspring-axis2-spring-security-with-ws-signature/feed/ 0 elespaciodejaime http://elespaciodejaime.wordpress.com/2011/12/16/beware-of-using-your-own-threadpooltaskexecutor-and-autowired-dependencies/ http://elespaciodejaime.wordpress.com/2011/12/16/beware-of-using-your-own-threadpooltaskexecutor-and-autowired-dependencies/#comments Fri, 16 Dec 2011 19:32:32 +0000 elespaciodejaime http://elespaciodejaime.wordpress.com/?p=452 ]]> I just want to share my experience after debugging a bug caused because my own implementation of ThreadPoolTaskExecutor was using @Autowired dependencies and so initializing to early the autowired beans, which caused that @Transactional, @PreAuthorize annotations wasn’t applying its proxies.

I had something like this:

public class MyThreadPoolTaskExecutor extends ThreadPoolTaskExecutor {

@Autowired
SecurityService securityService; // this initializes SecurityService bean too early

@Override
public <T> Future<T> submit(final Callable<T> task) {
securityService.doSomething();
...
...
}
}

But it should be something like:

public class MyThreadPoolTaskExecutor extends ThreadPoolTaskExecutor {

@Override
public <T> Future<T> submit(final Callable<T> task) {

// get access through a statically exposed spring context.

ServiceContext.getBean("securityService").doSomething();
...
...
}
}

public class ServiceContext implements ApplicationContextAware {

private static ApplicationContext applicationContext;


@Override
public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
this.applicationContext = applicationContext;
}

/**
* Get the bean from the Spring application context.
*
* @param beanName
* @return
*/
public static Object getBean(String beanName) {
if (applicationContext == null) {
throw new IllegalStateException(
"No Spring web application context found");
}
if (!applicationContext.containsBean(beanName)) {
{
throw new IllegalArgumentException("Spring bean not found: "
+ beanName);
}
}
return applicationContext.getBean(beanName);
}


}

It seems to be related to the fact that autowired dependencies (other beans) of beans of type org.springframework.beans.factory.InitializingBean don’t get proxied correctly

Create a base GWT Module:

BaseGWTModule.gwt.xml

<module rename-to="basegwt">

<inherits name='com.google.gwt.user.User'/>
<inherits name='com.smartgwt.SmartGwtNoSmartClient'/>

</module>

Create a module for only serving smartgwt /sc folder:

SmartGWTResourcesModule.gwt.xml

<module rename-to='smartgwt'>
<inherits name='com.smartgwt.SmartGwt'/>
</module>

Create several modules like this one:

SmartGWTSampleModule.gwt.xml

<module rename-to="gwtmodule">

<inherits name='com.kprtech.gwt.BaseGWTModule'/>

<entry-point class='com.example.EntryPoint'/>

</module>

Then in the html use something like:

index.jsp

<script type="text/javascript" language="javascript" src="gwtmodule/gwtmodule.nocache.js"></script>
<script> var isomorphicDir = "smartgwt/sc/"; </script>

http://www.wikilearning.com/tutorial/tutorial_de_java-el_depurador_de_java_jdb/3938-52

Definitivamente puede servir si eres de esos a los que de vez en cuando les gusta hacer las cosas desde una línea de comandos. Sin embargo, no lo recomiendo para producción.

Esto es:

Prueba de la realización de una interfaz:

public class Data {
}

public interface DataProvider {

/**
* @param encodedData
* @return
* @should extract data in a platform specific way
*/
Data extractData(String encodedData);

}

public class DataProviderTest {
/**
* @verifies extract data in a platform specific way
* @see DataProvider#extractData(String)
*/
@org.junit.Test
public void extractData_shouldExtractDataInAPlatformSpecificWay() throws Exception {
//TODO auto-generated
Assert.fail("Not yet implemented");
}
}

Prueba de la implementación

public interface DataProvider {

/**
* @param encodedData
* @return
* @should extract data in a platform specific way
*/
Data extractData(String encodedData);

}

public class DataProvideImpl1 implements DataProvider {

/**
* @param encodedData
* @return
* @should extract data in a platform specific way
*/
@Override
public Data extractData(String encodedData) {
return null;

}

/**
* @should do something impl specific
*/
void implementationSpeficMethod() {

}
}

public class DataProvideImpl1Test {

/**
* @verifies extract data in a platform specific way
* @see DataProvideImpl1#extractData(String)
*/
@org.junit.Test
public void extractData_shouldExtractDataInAPlatformSpecificWay() throws Exception {
//TODO auto-generated
Assert.fail("Not yet implemented");
}
/**
* @verifies do something impl specific
* @see DataProvideImpl1#implementationSpeficMethod()
*/
@org.junit.Test
public void implementationSpeficMethod_shouldDoSomethingImplSpecific() throws Exception {
//TODO auto-generated
Assert.fail("Not yet implemented");
}

}

Y pues dado que la aplicación debería girar en torno a los servicios (métodos) provistos por las interfaces, y como recomienda la metodología TDD al sugerir que debemos programar concentrados en el cumplimiento de las interfaces (realizaciones) , pues parece bastante claro que nuestro principal y derepente único interés debería ser hacer que se cumpla el contrato de cada uno de los métodos de las interfaces,por lo cual es exactamente eso lo que deberían probar nuestros método y no tendrían por qué hacer algo como (ahora mismo no se me ocurre una excepción a esta regla):

</pre>
/**
* @verifies do something impl specific
* @see DataProvideImpl1#implementationSpeficMethod()
*/
@org.junit.Test
public void implementationSpeficMethod_shouldDoSomethingImplSpecific() throws Exception {
//TODO auto-generated
Assert.fail("Not yet implemented");
}
<pre>

Pero si es así surge un problema, qué sucede cuando tenemos más de una implementación, de qué manera nombramos a la clase de pruebas, está claro que no podría ser InterfazBajoPruebaTest, debido a que hay más de una implementación y el código en la clase InterfazBajoPruebaTest solo debería probar código para una implementación.

public interface DataProvider {

/**
* @param encodedData
* @return
* @should extract data in a platform specific way
*/
Data extractData(String encodedData);

}

public class DataProvideImpl1 implements DataProvider {

/**
* @param encodedData
* @return
* @should extract data in a platform specific way
*/
@Override
public Data extractData(String encodedData) {
return null;

}

/**
* @should do something impl specific
*/
void implementationSpeficMethod() {

}
}

public class DataProviderImpl2 implements DataProvider{

/**
* @param encodedData
* @return
* @should extract data in a platform specific way
*/
@Override
public Data extractData(String encodedData) {
return null;
}
}

public class DataProviderTest {
/**
* @verifies extract data in a platform specific way
* @see DataProvider#extractData(String)
*/
@org.junit.Test
public void extractData_shouldExtractDataInAPlatformSpecificWay() throws Exception {
//TODO auto-generated
Assert.fail("Not yet implemented");
}
}

Por lo tanto sugiero como solución a este problema. Utilizar el nombre de las implementaciones para las clases de prueba pero solo los métodos de la interfaz implementada para la creación de los métodos de pruebas, esto es, no se deberían probar los métodos que no sean parte del contrato establecido por la interfaz.

public interface DataProvider {

/**
* @param encodedData
* @return
* @should extract data in a platform specific way
*/
Data extractData(String encodedData);

}

public class DataProvideImpl1 implements DataProvider {

/**
* @param encodedData
* @return
* @should extract data in a platform specific way
*/
@Override
public Data extractData(String encodedData) {
return null;

}

/**
* do something impl specific (not tested)
*/
void implementationSpeficMethod() {

}
}

public class DataProvideImpl1Test {

/**
* @verifies extract data in a platform specific way
* @see DataProvideImpl1#extractData(String)
*/
@org.junit.Test
public void extractData_shouldExtractDataInAPlatformSpecificWay() throws Exception {
//TODO auto-generated
Assert.fail("Not yet implemented");
}

}

public class DataProviderImpl2 implements DataProvider{

/**
* @param encodedData
* @return
* @should extract data in a platform specific way
*/
@Override
public Data extractData(String encodedData) {
return null;
}
}
public class DataProviderImpl2Test {
/**
* @verifies extract data in a platform specific way
* @see DataProviderImpl2#extractData(String)
*/
@org.junit.Test
public void extractData_shouldExtractDataInAPlatformSpecificWay() throws Exception {
//TODO auto-generated
Assert.fail("Not yet implemented");
}
}