eclipse-ee4j / eclipse-ee4j/metro-wsit

Provide mechanism for WS-Policy alternative selection in WSIT client

Open
#356 0 comments 0 reactions 0 assignees View on GitHub
Component: policy ERR: Assignee Priority: Major Type: Improvement
Dominant language
Java
Stars
6
Forks
21
Avg merge
10h 2m
Merged PRs (30d)
1

Description

The suggested improvement is to enable WSIT-based client to participate in policy alternatives selection done by WSIT.

Currently the code in EffectiveAlternativeSelector.selectBestAlternative() chooses one of the alternatives to be used, based on their fitness and order. However the consuming code (WSIT-based client) has no means to provide its preference and thus influence the decision.

With such improvement WSIT clients will be able to choose the policy alternative to be used for particular request at runtime (i.e. it can switch to another alternative for the next request if needed).

Use case for that:
1) Suppose there is a Security Token Service that accepts several authentication: Username token, SAML holder-of-key token, SAML bearer token, etc.
2) The STS is described in a WSDL with WS-SecurityPolicy assertion that respectively has several alternatives.
3) WSIT-based client access this STS through its WSDL
4) the client needs to authn using Username and password and obtain a (SAML) token
5) a bit later the client needs to access the STS again, this time authenticating itself with the SAML token (e.g. to delegate it to another subject).
To achieve this the client should be able to choose which policy alternative to use for every request.

Currently recommended way to deal with multiple policy alternatives is to make a copy of the server WSDL, remove all but 1 of the alternatives and use this copy instead of the original one. However this approach:

* does not providing for dynamically (at runtime) switching/choosing of the policies
* is harder to maintain
#### Affected Versions
[2.1]

Source: [https://github.com/javaee/metro-wsit/issues/1583](https://github.com/javaee/metro-wsit/issues/1583)
Author: glassfishrobot

Contributor guide

Open the contributing guide

Research direction

Start at EffectiveAlternativeSelector.selectBestAlternative() and trace the WSIT client policy-consumption path; the issue names no source file or test. Define how a client preference is supplied per request, verify that it can select among the listed alternatives and switch on a later request, and add coverage for the runtime selection behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.