Encrypting the password before authetication - spring-security

Question

I have to authenticate a SOAP message that sends passwords in plain text with the encrypted password from the database. We use HTTPS for all traffic so the entire message in encrypted.
Anyway, I have implemented the following SI configuration, which works until Spring tries to match the passwords. Since the SOAP password is plain text and the db passowrd is encrypted, I must encrypt the password before Spring authenticates. I have service methods to do this already implemented.
<bean id="SOAPSecurityValidationCallbackHandler" class="org.springframework.ws.soap.security.wss4j.callback.SpringSecurityPasswordValidationCallbackHandler">
<property name="userDetailsService" ref="userDetailsService"/>
</bean>
<bean id="userDetailsService" class="com.ps.snt.ws.security.SNTUserDetailsService" />
UserDetailsService implementation:
public class SNTUserDetailsService implements UserDetailsService {
#Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
System.out.println("In security callback " + username);
boolean valid = true;
Integer zoneID = null;
StringBuffer errorMessages = new StringBuffer();
if(StringUtils.isEmpty(username)) {
// TODO wil lthis ever happen, does framework check first?
errorMessages.append("Username token cannot be empty");
valid = false;
} else {
Pattern pattern = Pattern.compile("^[\\w]+#+\\d\\d\\d\\d\\d");
Matcher matcher = pattern.matcher(username);
if(!matcher.matches()) {
valid = false;
errorMessages.append("Username token must be in the format 'user#zone'.");
}
else {
String[] parts = username.split("#");
username = parts[0];
zoneID = Integer.parseInt(parts[1]);
}
}
if(valid && username != null && zoneID != null) {
LoginService loginService = new LoginService();
ApplicationUserDO user = loginService.getUserByUsername(zoneID.toString(), username);
boolean enabled = true;
boolean accountNonExpired = true;
boolean credentialsNonExpired = true;
boolean accountNonLocked = true;
List<GrantedAuthority> grantedAuths = new ArrayList<GrantedAuthority>();
grantedAuths.add(new GrantedAuthorityImpl("ROLE_USER"));
UserDetails userDetails = new User(user.getUsername(),
user.getPassword(),
enabled,
accountNonExpired,
credentialsNonExpired,
accountNonLocked,
grantedAuths );
return userDetails;
} else {
System.out.println("Authetnication failed!");
throw new UsernameNotFoundException("Epic fail!");
}
}
}
The user details service does what its supposed to - it returns a user with the password from the database.
I tried overidding handleUSernameTokenPrincipal in SpringSecurityPasswordValidationCallbackHandler to set the password to the encrypted version, but this method never gets called. Overriding handleUsername is not useful as I do not have access to the original password.
I would like to keep the details service and use this callback, but I need to set the password in the principal to the encrypted version before authentication.
Ideally I would want to set the password after validation of the SOAP header but before the user details service is called. Not sure if I can do this with another interceptor, but I do not want to parse through XML and et it that way. I would like to do it in a somewhat safe manner.

Answer 1

I found a solution using an authentication manager on the callback:
<bean id="SOAPSecurityValidationCallbackHandler"
class="org.springframework.ws.soap.security.xwss.callback.SpringPlainTextPasswordValidationCallbackHandler">
<property name="authenticationManager" ref="CommonAuthenticationManager" />
</bean>
The AuthenticationManager interface must implement one method - authenticate:
public class CommonAuthenticationManager implements AuthenticationManager {
public Authentication authenticate(Authentication auth)
throws AuthenticationException {
String username = auth.getName();
String password = (String) auth.getCredentials();
... encrypt password
... validate against DB
// this will be available in the message flow to any channel
return new UsernamePasswordAuthenticationToken(auth.getName(),
auth.getCredentials(), grantedAuths);
}
}