questions about ExtractUsernamePasswordFromWssToken

[Cantor, Scott]

On 8/1/13 7:51 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:
>
>Of course, an actual profile of WS-S could constrain that to one
>password per token.  But the schema doesn't.

And since we really have no profile to hand here, the action code right
now is nothing but an example, not anything targeted at a specific use
case.

>Strictly speaking, at the Java level it's not 100% safe, and it's always
>kinda bothered me a little that we do that all over the place, i.e.
>assume something looked up with QName X implements interface Y.  As far
>as our own code goes it is safe, since we know we don't violate that
>rule, but in general it's an iffy proposition.

It's not clear we have control over that because anybody can override our
configuration, right? If we assume we control the object provider
registrations, then I guess we control it.

>But there's probably no
>better alternative - at least Chad couldn't come up with one when he
>designed it, and I don't have one now.  The issue is bridging the world
>of XML, where types/elements are uniquely identified by QNames, and the
>Java language, where types are identified by classes/interfaces.  At the
>very least there has to be a translation somewhere, somehow.  I guess
>you could say we took the simple(st) approach of casting via pretty
>strong assumptions based on interface constants.

Once can always check before casting, so it's a question of how much work
to do to avoid cases that aren't supposed to come up. Much like checking
for nulls in some layers of code.

-- Scott