Digest Authenticated HTTP Relay

Hello,

I have an HTTP client authentication which I do not have source for but provides some crucial webservices functionality. However, it does not support authentication in any way (it is in beta phase). I have to if possible begin working with it before it will have authentication built in.

Meanwhile the webservice I need to access happens to require digest authentication.

So, I am trying to work out how to get around this little mismatch. I know that I can extend java.net.Authenticator to hardcode the user name and password:

-

import java.net.*;

class MyAuthenticatorextends Authenticator{

private String username, password;

public MyAuthenticator(String user, String pass){

username = user;

password = pass;

}

protected PasswordAuthentication getPasswordAuthentication(){

returnnew PasswordAuthentication(username, password.toCharArray());

}

}

-

Authenticator.setDefault(new MyAuthenticator("blahblah","doodeedah") );

-

So far so good.

But I am struggling to concieve how I can use that too my advantage.

I was hoping to build a program that listened on localhost, relayed to the webservices address, then piped the response back through to localhost. But a java.net.Socket does not seem to care what you do with Authenticator. Is there a way to force it into effect?

I suppose this is a little vague, but I don't think it will do anything but confuse everyone if i post my mess of testing code. So I guess I am just wondering where to start over? Any advice appreciated.

I hope this is a good forum to post too on this topic, if not please tell me where to go instead.

thank you,

joewlarson

[2272 byte] By [joewlarsona] at [2007-10-2 2:03:16]
# 1
woops: "I have an HTTP client authentication " should be "I have an HTTP client application" /thanks
joewlarsona at 2007-7-15 19:44:37 > top of Java-index,Security,Other Security APIs, Tools, and Issues...
# 2

As readable from the name, the HTTP (Digest) authentication, acts in HTTP context where socket methods alone are too generic to be proper for it.

You can either take some out of the box products (j2ee ? kill an ant with a tank ) which will take care of the authentication for you or do it yourself as it is not complicated :

The dialoge can be carried out setting the http headers on an instance of java.net.HttpURLConnection.

read the rfc example: ftp://ftp.isi.edu/in-notes/rfc2617.txt

You will first submitt the request to get 401 error with the challenge HTTP header from the server; (see 3-5 of the above rfc). Then build the proper response and put it in the headers (using setRequestProperty(...) ) of a second request on which the "Authorization" header is set properly with the challenge response.

babakNa at 2007-7-15 19:44:37 > top of Java-index,Security,Other Security APIs, Tools, and Issues...