Howto proces SOAP Header with security info

Question

My incoming Soap messages contain security info in the soapenv:Header part.
However, I only need the contents of the Body element.
If I do NOT handle the Soap Message, then an Exception is thrown: something like: 'Do not know how to handle MustUnderstand'.
So something must be done with the Security info in the header, but I do not know how. Do I have to remove the header completely in the Soap handler, after checking the singning? If somebody can point me to some examples of Soap header processing for this case it would be helpful.
kind regs.
Harry

Answer 1

Hi Harry
The header in Soap Messages is optional. Is is used to carry security information, that is security on the level of the Soap message. So when the header of an incoming Soap message is 'handled', the header is of no use any longer and can (must) be discarded. Indeed discarded, because the rest of the handlers don't expect a header in the Soap message. They extract the 'contents' from the body of the Soap message, and deliver that to you backend system.
I will describe the header handling in the webservice: to get access to the Soap message in your code, you have to write a 'handler' Class. This Class should implement the Handler Interface or extend the abstract GenericHandler Class. To handle only the incoming Soap messages, the 'Requests', the method 'handleRequest' should be implemented. This handleRequest method has 1 parameter (mc) with type MessageContext. This parameter contains the original Soap message in Object format. You can access the original header information via:
SOAPMessageContext smc = (SOAPMessageContext)mc;
SOAPMessage message = smc.getMessage();
SOAPPart part = message.getSOAPPart();
SOAPEnvelope envelope = part.getEnvelope();
SOAPHeader header = envelope.getHeader();
With: Iterator iterator = header.getChildElements();
you can navigate through the header elements and do whatever you like. If you decide that security info in this header does not match the contents of the body for instance, you can issue an Exception and log it.
After processing the header you have to discard it with:
header.detachNode(); and let your handleRequest method return 'true'.
The rest of the webservice processing takes the contents from the body element, and delivers that to your application.
To let you webservice make use of your Handler, you have to name it in the web-services.xml as follows:
<webservices>
<handler-chains>
<handler-chain name="myChain">
<handler class-name="a.b.c.MyHandler" />
</handler-chain>
</handler-chains>
<web-service name="MyService">
<operations>
<operation ... handler-chain="myChain" .... />
</operations>
When the webservice 'MyService' gets a request, the handler 'MyHandler' is automatically invoked. you can have more handlers in a chain. Also you can declare more chains in your <webservices> section and refer to them from the <operation> elements.
Items of interest:
javax.xml.rpc.handler.soap.*
javax.xml.rpc.handler.*
javax.xml.namespace.*
javax.xml.soap.*
May be this of use for you :).