Username/password token question... wss4j

Question

I have an axis webservice which requires client to send username/password tokens for authentication. my server
does the "authentication" with no problem (match client's username and password with server's password).
I have many users (that means many clients with different usernames and passwords) when the user calls
one of my allowed methods I want to know which user called that method.
I would appreciate if you help me finding out which "client"(user) is calling the allowed method.
I use wss4j to process username/password tokens.
In my wssd file I have following to show where my password checking will take place:
      <requestFlow>
        <handler type="java:org.apache.ws.axis.security.WSDoAllReceiver">
          <parameter name="passwordCallbackClass" value="com.alex.ws.callback.PWCallback"/>
          <parameter name="action" value="Timestamp UsernameToken"/>
        </handler>
      </requestFlow>In my Callnack class com.alex.ws.callback.PWCallback I have:
    public void handle(Callback[] callbacks)
            throws IOException, UnsupportedCallbackException {
        for (int i = 0; i < callbacks.length; i++) {
          System.out.println("1");
            if (callbacks[i] instanceof WSPasswordCallback) {
                WSPasswordCallback pc = (WSPasswordCallback) callbacks;
if (pc.getUsage() == WSPasswordCallback.KEY_NAME) {
pc.setKey(key);
} else {
pc.setPassword(UserStore.getPassword(pc.getIdentifer()));
} else {
throw new UnsupportedCallbackException(callbacks[i],
"Unrecognized Callback");
When the user sends SOAP message with Username/Password token
PWCallback class works fine and authentication is done with no problem.
One of my allowed method is :
public String doIt(String msg)
   System.out.println("Here is the message:"+msg);
  String username= "";
//some code to find the username
//of the sender. Please help me in here
   System.out.println("Here is the username that sent the msg:"+username);
}Can you help me to find out how I can find out the "username" of client within the allowed method.

Answer 1

While reading the API docs for WSS4j, I came across the section called "Reporting Security results to services/applications" in the summary for org.apache.ws.axis.security package.
link: http://ws.apache.org/wss4j/apidocs/org/apache/ws/axis/security/package-summary.html (almost bottom of page)
There is some example code of how to access the security result data from the server side WS implementation code. Here's the example code in case you miss it:
    public void ping(javax.xml.rpc.holders.StringHolder text,
        org.apache.ws.axis.oasis.ping.TicketType ticket)
        throws java.rmi.RemoteException {
        text.value = "Echo " + text.value.trim();
        // get the message context first
        MessageContext msgContext = MessageContext.getCurrentContext();
        Message reqMsg = msgContext.getRequestMessage();
        Vector results = null;
        // get the result Vector from the property
        if ((results =
            (Vector) msgContext.getProperty(WSHandlerConstants.RECV_RESULTS))
             == null) {
            System.out.println("No security results!!");
        System.out.println("Number of results: " + results.size());
        for (int i = 0; i < results.size(); i++) {
            WSHandlerResult hResult = (WSHandlerResult)results.get(i);
            String actor = hResult.getActor();
            Vector hResults = hResult.getResults();
            for (int j = 0; j < hResults.size(); j++) {
                   WSSecurityEngineResult eResult = (WSSecurityEngineResult) hResults.get(j);
                // Note: an encryption action does not have an associated principal
                 // only Signature and UsernameToken actions return a principal
                if (eResult.getAction() != WSConstants.ENCR) {
                    System.out.println(eResult.getPrincipal().getName());
    }