Check SOAP Security Header

[Andrew Prinoli]

Sorry it's a very simple question :
what is the shortest way to check if an Axis Message object has or not a security header?
And how to check if an Axis Message object has or not an UsernameToken?

thanks a lot in advance

[Jimmy Clark]

You can create a sub-class of the javax.xml.rpc.handler.GenericHandler class and register the "handler" class in the service's deployment descriptor. The SOAP Engine will create an instance of this class and it will process security headers and Username Tokens for the service's messages.

In the Java world, it is called a "handler."

In the .NET world, the equivalent is called a "SOAP Extension."
[ November 13, 2008: Message edited by: James Clark ]

[Andrew Prinoli]

Sorry,
my aim is to do that in a standalone program ,which receives with its own handlers a MessageContext object , and check is there is UsernameToken or not , and check if WssSecurity header or not..using wss4j and axis libraries (without a real webservice..)..

[Jimmy Clark]

If your SOAP message is intended for a Java standalone program and you are not using an Axis SOAP Engine, then you can use the javax.xml.soap classes to extract the SOAPMessage and check the envelope for the headers that you are interested in. You will need to write the code for this and integrate it into the standalone application.

Sounds interesting!
[ November 13, 2008: Message edited by: James Clark ]

[Andrew Prinoli]

thanks a lot..
It's for my degree project...I have to implement an automatic secure web service generator starting from formal description of protocols (with SPI calculus)..
andrew