questions about ExtractUsernamePasswordFromWssToken

[Cantor, Scott]

On 8/1/13 3:24 PM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:

>(Scott had asked me about his AuthN work and this is the somewhat
>related reply.)
>
>I was looking at ExtractUsernamePasswordFromWssToken and an iterator
>caught my attention, mostly because I try not to use iterators. Lines
>117 -125.

I didn't really update this code much, FWIW, I just tweaked it. I'm
tracking things by making sure I have a unit test for anything "done" and
using Jira, so if it's not closed or resolved or unit tested, you know I'm
not really working on it yet.

>My question was : does the WS-Security UsernameToken Profile 1.1 allow
>more than one <Password/> element to be present ? Probably not, based
>on the, err, spec, so I went looking for a schema, but did not find
>one. So the next question is : how do I find out for sure ? And then,
>should I really care ?

I have no idea, but the answer is you'd have to read the WS-Sec username
token profile at OASIS I suspect.

>I looked for the V2 analogy but did not find it, and wondered where
>should I look in V2 ?

Doesn't exist. Chad I think threw in some WSS actions just as examples but
they're not really core work right now, and I don't intend to spend time
on them for the moment.

>I also wondered if the cast on line 120 is safe, I think so, but have
>a note to verify.

It's "safe" because the collection of XMLObjects is pulled using
getUnknownXMLObjects(Password.ELEMENT_NAME) and by implication if we have
object providers registered for that element type, we assume they
implement the Password XMLObject interface. Whether that's a good model to
follow I don't know. I'm not that familiar with the XMLObject code and
patterns for using them in Java, it's generally something I have to work
on a lot because I'm used to my own code, which is somewhat different.

-- Scott