Facing authentication cache issue with generated Client STUB for server

168 Views Asked by At

I found a peculiar issue while using client stub which was generated in past using JAX-WS(wsimport) for SSRS server. Once the test connection is successful with configured username and password, then all the subsequent connection passes, even for the incorrect configuration.

Application uses default Authenticator to set credentials.
    Authenticator.setDefault(
        new Authenticator() {
          @Override
          protected PasswordAuthentication getPasswordAuthentication() {
            return new PasswordAuthentication(
               getUserName(),getPassword().toCharArray());
          }
        });

Later, I dig deeper and found out that sun package HttpURLConnection uses the cached authorization key for connection from the AuthCache implementation. Worth to mention that it is part of sun package.

package sun.net.www.protocol.http;

public class AuthCacheImpl implements AuthCache {
...
...
}

Now, current project is running with JDK11 which restricts to use the protected classes from sun package.

Now, the client stub is fairly straightforward to understand.

ReportingService2010 reportingService2010 = new ReportingService2010(reportServerUrl);

ReportingService2010Soap reportingService2010Soap = reportingService2010.getReportingService2010Soap();

reportingService2010Soap.listChildern(itemPath,isRecursive);

Request from above mentioned code calls the HttpURLConnection implementation of sun package and tries to read the auth key from cache whether it exists or not. If yes, than use it without considering new credentials and connects, else add the auth key to the AuthCache for future usage.

package sun.net.www.protocol.http;

public class HttpURLConnection extends java.net.HttpURLConnection {
...
...

private AuthenticationInfo getServerAuthentication (AuthenticationHeader authhdr) {
...
...
 serverAuthKey = AuthenticationInfo.getServerAuthKey(url, realm, authScheme,
                                               getAuthenticatorKey());
            ret = AuthenticationInfo.getServerAuth(serverAuthKey);
...
...

}

...
...

}

Is there any way to handle this issue ? Or any other alternative ?

PS - restart of server clears the cache but thats an ugly option.

0

There are 0 best solutions below