title: HTTP basic authentication through CXF interceptor not working
body: <p>I'm having some trouble setting the HTTP Authorization header for a web service request using Apache CXF. I have my client setup through spring:</p>
  
  <pre><code>&lt;bean id="loggingInInterceptor" class="org.apache.cxf.interceptor.LoggingInInterceptor" /&gt;
  &lt;bean id="loggingOutInterceptor" class="org.apache.cxf.interceptor.LoggingOutInterceptor" /&gt;
  
  &lt;bean id="myHTTPAuthInterceptor" class="my.app.MyHTTPAuthInterceptor" autowire="constructor" /&gt;
  
  &lt;bean id="webServiceFactory" class="my.app.WebServiceFactory"&gt;
      &lt;property name="wsdlLocation" value="classpath:/my/app/webservice.wsdl" /&gt;
      &lt;property name="serviceURL"&gt;
          &lt;jee:jndi-lookup jndi-name="webservice/url" /&gt;
      &lt;/property&gt;
      &lt;property name="inInterceptors"&gt;
          &lt;list&gt;
              &lt;ref bean="loggingInInterceptor" /&gt;
          &lt;/list&gt;
      &lt;/property&gt;
      &lt;property name="outInterceptors"&gt;
          &lt;list&gt;
              &lt;ref bean="loggingOutInterceptor" /&gt;
              &lt;ref bean="myHTTPAuthInterceptor" /&gt;
          &lt;/list&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;bean id="myWebService" factory-bean="webServiceFactory" factory-method="getInstance" /&gt;
  </code></pre>
  
  <p>Headers are set through MyHTTPAuthInterceptor like this:</p>
  
  <pre><code>public MyHTTPAuthInterceptor(ConfigDao configDao)
  {
      super(Phase.POST_PROTOCOL);
  
      this.configDao = configDao;
  }
  
  @Override
  public void handleMessage(Message message) throws Fault
  {
      Map&lt;String, List&lt;?&gt;&gt; headers = (Map&lt;String, List&lt;?&gt;&gt;) message.get(Message.PROTOCOL_HEADERS);
  
      String authString = configDao.getUsername() + ":" + config.getPassword();
      headers.put("Authorization", Collections.singletonList("Basic " + new String(Base64.encodeBase64(authString.getBytes()))));
  }
  </code></pre>
  
  <p>With username and both set to 'test', everything seems to be OK in the logs:</p>
  
  <pre><code>Headers: {SOAPAction=[""], Accept=[*/*], Authorization=[Basic dGVzdDp0ZXN0]}
  </code></pre>
  
  <p>However, the server returns a HTTP 401: Unauthorized.</p>
  
  <p>Not knowing what's going wrong, I took a whole other approach by changing my web service client factory code. I added a basic authorization policy to the client's conduit like this:</p>
  
  <pre><code>HTTPConduit httpConduit = (HTTPConduit) client.getConduit();
  AuthorizationPolicy authorizationPolicy = new AuthorizationPolicy();
  authorizationPolicy.setUserName("test");
  authorizationPolicy.setPassword("test");
  authorizationPolicy.setAuthorizationType("Basic");
  httpConduit.setAuthorization(authorizationPolicy);
  </code></pre>
  
  <p>Tested my setup again, same log (different order though):</p>
  
  <pre><code>Headers: {SOAPAction=[""], Authorization=[Basic dGVzdDp0ZXN0], Accept=[*/*]}
  </code></pre>
  
  <p>Now the server's response is 200 OK!</p>
  
  <p>Problem solved you might think, but the second approach doesn't really work for me. My application is a multi-tenant environment, all with different username and password. With the second approach I cannot reuse my client.</p>
  
  <p>How can I get my interceptor to work correctly? Am I plugging into the wrong phase? Does the order of the headers matter? If so, how do I change it?</p>