#53 clear text password

[Anonymous]

in PWCBHandler there is a clear text password. I am not certain what that is and if it introduces a security whole

if("client".equals(id)) {
pwcb.setPassword("apache");
} else if("service".equals(id)) {
pwcb.setPassword("apache");
}

[Jeffrey Robble]

Logged In: YES
user_id=1951185
Originator: NO

The Apache Rampart security example uses this sort of security mechanism in the examples provided. The password is used to gain access to a keystore in which user keys are stored. Changes may be made to read the keystore password from an encrypted file.

In the future a username/password scheme may be more desirable.