web service security

[Goran Markovic]

Hi. I have tried some examples using WSIT tutorial. Genesis of either server and client, occurs in the NetBeans IDE. And everything works fine when I try any sort of ws security, explained in the examples.
But, I don't get hoe to deploy service on the tomcat server, independently of NetBeans IDE? As much I saw for a client, in the NetBeans, when create Web Service Client, Web Service Reference file which is a wsdl file with embedded WS Security Policy. in the NetBeans it's all somehow "hiddenly performed behind", and I have a a problem if I want to deploy service/client application in the standalone tomcat server, because I will not use deployemtn from NetBeans in the production,where service is exposed as a WSServlet. But I do not know what to do with a client because, if try to engage a client just as I did, but before engaging a ws security policy, I get an exception contains that my SOAP message, client request, doesn't contains a security headers.
So, how to refine and what to do with my deployment ? I hope I was clear about my problem.
Thanks

[Ulf Dittmer]

Yep, the Sun-affiliated people sure make it hard to do much of anything these days without using NetBeans. Which sucks because plenty of people don't use it.

Check out #14 in the Metro user's guide: https://metro.dev.java.net/guide/

[Goran Markovic]

Thanks. I am going to try it now.

[Goran Markovic]

Hi. I have a few doubts about using WSIT outside a NetBeans. I will be little more verbose just to make my self clear. I have a Web Service made outside of NetBeans IDE :

package org.sler.ue;

import javax.jws.WebMethod;
import javax.jws.WebParam;
import javax.jws.WebService;

/**
 *
 * @author sler
 */
@WebService()
public class UEServer {

    /**
     * Web service operation
     */
    @WebMethod(action = "count", operationName = "count")
    public int count(@WebParam(name = "i")
    int i, @WebParam(name = "j")
    int j) {
        //TODO write your implementation code here:
        return i+j*23;
    }

}

This is the wsit-org.sler.ue.UEServer.xml file :

<?xml version="1.0" encoding="UTF-8"?> 
 <definitions 
 xmlns="http://schemas.xmlsoap.org/wsdl/" 
 xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" 
 xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
 xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" name="UEServerService" targetNamespace="http://ue.sler.org/" xmlns:tns="http://ue.sler.org/" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp1="http://www.w3.org/ns/ws-policy" xmlns:fi="http://java.sun.com/xml/ns/wsit/2006/09/policy/fastinfoset/service" xmlns:tcp="http://java.sun.com/xml/ns/wsit/2006/09/policy/soaptcp/service" xmlns:wsaw="http://www.w3.org/2005/08/addressing" xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy" xmlns:sc="http://schemas.sun.com/2006/03/wss/server" xmlns:wspp="http://java.sun.com/xml/ns/wsit/policy"
 >
    <message name="count"/>
    <message name="countResponse"/>
    <portType name="UEServer">
        <operation name="count">
            <input message="tns:count"/>
            <output message="tns:countResponse"/>
        </operation>
    </portType>
    <binding name="UEServerPortBinding" type="tns:UEServer">
        <wsp:PolicyReference URI="#UEServerPortBindingPolicy"/>
        <operation name="count">
            <input>
                <wsp:PolicyReference URI="#UEServerPortBinding_count_Input_Policy"/>
            </input>
            <output>
                <wsp:PolicyReference URI="#UEServerPortBinding_count_Output_Policy"/>
            </output>
        </operation>
    </binding>
    <service name="UEServerService">
        <port name="UEServerPort" binding="tns:UEServerPortBinding"/>
    </service>
    <wsp:Policy wsu:Id="UEServerPortBindingPolicy">
        <wsp:ExactlyOne>
            <wsp:All>
                <wsaw:UsingAddressing xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl" wsp:Optional="false"/>
                <sp:SymmetricBinding>
                    <wsp:Policy>
                        <sp:ProtectionToken>
                            <wsp:Policy>
                                <sp:X509Token sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Never">
                                    <wsp:Policy>
                                        <sp:WssX509V3Token10/>
                                        <sp:RequireIssuerSerialReference/>
                                    </wsp:Policy>
                                </sp:X509Token>
                            </wsp:Policy>
                        </sp:ProtectionToken>
                        <sp:Layout>
                            <wsp:Policy>
                                <sp:Strict/>
                            </wsp:Policy>
                        </sp:Layout>
                        <sp:IncludeTimestamp/>
                        <sp:OnlySignEntireHeadersAndBody/>
                        <sp:AlgorithmSuite>
                            <wsp:Policy>
                                <sp:Basic128Sha256/>
                            </wsp:Policy>
                        </sp:AlgorithmSuite>
                    </wsp:Policy>
                </sp:SymmetricBinding>
                <sp:Wss11>
                    <wsp:Policy>
                        <sp:MustSupportRefIssuerSerial/>
                        <sp:MustSupportRefThumbprint/>
                        <sp:MustSupportRefEncryptedKey/>
                    </wsp:Policy>
                </sp:Wss11>
                <sp:SignedSupportingTokens>
                    <wsp:Policy>
                        <sp:UsernameToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
                            <wsp:Policy>
                                <sp:WssUsernameToken10/>
                            </wsp:Policy>
                        </sp:UsernameToken>
                    </wsp:Policy>
                </sp:SignedSupportingTokens>
                <sc:KeyStore wspp:visibility="private" location="D:\Dokumenti\NetBeansServers\Sun\AppServer\domains\domain1\config\keystore.jks" type="JKS" storepass="changeit" alias="xws-security-server"/>
            </wsp:All>
        </wsp:ExactlyOne>
    </wsp:Policy>
    <wsp:Policy wsu:Id="UEServerPortBinding_count_Input_Policy">
        <wsp:ExactlyOne>
            <wsp:All>
                <sp:EncryptedParts>
                    <sp:Body/>
                </sp:EncryptedParts>
                <sp:SignedParts>
                    <sp:Body/>
                    <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
                    <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
                    <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
                    <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
                    <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
                    <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
                    <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
                    <sp:Header Name="AckRequested" Namespace="http://schemas.xmlsoap.org/ws/2005/02/rm"/>
                    <sp:Header Name="SequenceAcknowledgement" Namespace="http://schemas.xmlsoap.org/ws/2005/02/rm"/>
                    <sp:Header Name="Sequence" Namespace="http://schemas.xmlsoap.org/ws/2005/02/rm"/>
                    <sp:Header Name="CreateSequence" Namespace="http://schemas.xmlsoap.org/ws/2005/02/rm"/>
                </sp:SignedParts>
            </wsp:All>
        </wsp:ExactlyOne>
    </wsp:Policy>
    <wsp:Policy wsu:Id="UEServerPortBinding_count_Output_Policy">
        <wsp:ExactlyOne>
            <wsp:All>
                <sp:EncryptedParts>
                    <sp:Body/>
                </sp:EncryptedParts>
                <sp:SignedParts>
                    <sp:Body/>
                    <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
                    <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
                    <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
                    <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
                    <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
                    <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
                    <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
                    <sp:Header Name="AckRequested" Namespace="http://schemas.xmlsoap.org/ws/2005/02/rm"/>
                    <sp:Header Name="SequenceAcknowledgement" Namespace="http://schemas.xmlsoap.org/ws/2005/02/rm"/>
                    <sp:Header Name="Sequence" Namespace="http://schemas.xmlsoap.org/ws/2005/02/rm"/>
                    <sp:Header Name="CreateSequence" Namespace="http://schemas.xmlsoap.org/ws/2005/02/rm"/>
                </sp:SignedParts>
            </wsp:All>
        </wsp:ExactlyOne>
    </wsp:Policy>
</definitions>

and web service client :

package wss.sler;

import handlers.ReliableMessageHandler;

import java.util.ArrayList;
import java.util.List;

import javax.xml.ws.handler.Handler;
import javax.xml.ws.handler.HandlerResolver;
import javax.xml.ws.handler.PortInfo;

import authC.*;
import com.sun.xml.internal.ws.Closeable;	
public class AuthenticationClient {

	public static void main(String [] srga){
		
		try {
			UEServerService service = new UEServerService();
		    service.setHandlerResolver(new ClientHandlerResolver());
			UEServer port = service.getUEServerPort();
			 // TODO initialize WS operation arguments here
			int i = 65;
			int j = 5;
			// TODO process result here
			int result = port.count(i, j);
			System.out.println("Result = "+result);
		         ((Closeable)port).close();
		    } catch (Exception ex) {
		    	ex.printStackTrace();
		    }
	}
}
	
	   class ClientHandlerResolver implements HandlerResolver {
	       public List<Handler> getHandlerChain(PortInfo port_info) {
	           List<Handler> hchain = new ArrayList<Handler>();
	           hchain.add(new ReliableMessageHandler());
	           return hchain;
	       }
	   }

Where in the package authC are stored classes for service invocation, and these classes are generated using wsimport command on the deployed address of service, also using custom client files for bindings (using -b command). I invoke a service, it perform calculation and everything works fine. Here I am using just stand alone Tomcat server.
What doubts me is a dump message. As you can see here I introduce a handler which purpose is only to print a SOAP on the screen, and this is the content of such a message. this is the request:

<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"><S:Body><ns2:count xmlns:ns2="http://ue.sler.org/"><i>65</i><j>5</j></ns2:count></S:Body></S:Envelope>

As you can see there is no any security header added to the SOAP Headers printed?
When I using a NetBeans, I set in the Glassfish configuration file to perform dump message in order to see SOAP. And it display to me next, which is entire SoAP messages with Security Headers and encryption/signature:

<?xml version="1.0" ?><S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:exc14n="http://www.w3.org/2001/10/xml-exc-c14n#"><S:Header><To xmlns="http://www.w3.org/2005/08/addressing" wsu:Id="_5006">http://localhost:8080/UsernameAuthenticationService/UEServerService</To><Action xmlns="http://www.w3.org/2005/08/addressing" wsu:Id="_5005">count</Action><ReplyTo xmlns="http://www.w3.org/2005/08/addressing" wsu:Id="_5004">
    <Address>http://www.w3.org/2005/08/addressing/anonymous</Address>
</ReplyTo><MessageID xmlns="http://www.w3.org/2005/08/addressing" wsu:Id="_5003">uuid:ad955ba9-7087-40d2-93ae-a0c1941e40d0</MessageID><wsse:Security S:mustUnderstand="1"><wsu:Timestamp xmlns:ns10="http://www.w3.org/2003/05/soap-envelope" xmlns:ns11="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" wsu:Id="_3"><wsu:Created>2009-11-01T10:59:48Z</wsu:Created><wsu:Expires>2009-11-01T11:04:48Z</wsu:Expires></wsu:Timestamp><xenc:EncryptedKey xmlns:ns10="http://www.w3.org/2003/05/soap-envelope" xmlns:ns11="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" Id="_5002"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/><ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="keyInfo"><wsse:SecurityTokenReference><ds:X509Data><ds:X509IssuerSerial><ds:X509IssuerName>CN=SUNCA, OU=JWS, O=SUN, ST=Some-State, C=AU</ds:X509IssuerName><ds:X509SerialNumber>2</ds:X509SerialNumber></ds:X509IssuerSerial></ds:X509Data></wsse:SecurityTokenReference></ds:KeyInfo><xenc:CipherData><xenc:CipherValue>sNctXGiug+l9PN3zfGmoIYKnaCo9BOSNwXq5dsRcu8Q/r0hEOZJniENtQBEFWa7TKoswDemNx3qg3yiXCmxhqwadmRa+eG5SDdYUWygWOsz84bc4FtWGB3Zu9lqVCc87Uk0oQ/MMxD2iwQMdieJv7+FPb9VaSh/Rlvy60alKCFI=</xenc:CipherValue></xenc:CipherData></xenc:EncryptedKey><xenc:ReferenceList xmlns:ns17="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" xmlns:ns16="http://www.w3.org/2003/05/soap-envelope" xmlns=""><xenc:DataReference URI="#_5008"></xenc:DataReference><xenc:DataReference URI="#_5009"></xenc:DataReference></xenc:ReferenceList><xenc:EncryptedData xmlns:ns10="http://www.w3.org/2003/05/soap-envelope" xmlns:ns11="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" Type="http://www.w3.org/2001/04/xmlenc#Element" Id="_5009"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/><ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="keyInfo"><wsse:SecurityTokenReference><wsse:Reference ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" URI="#_5002"/></wsse:SecurityTokenReference></ds:KeyInfo><xenc:CipherData><xenc:CipherValue>c0jXx0NNZPZrEYwNgXsOuEOxI0tfyJ9Yec0nR4u2SumSgDZiEL9l4tZx/enft29Hnq/LuJgraPHP4kkgMqCaht3bDtysPJSfaa7yQuShV4/Xw9vhD1JuKJ8iFXXgTCi3kx0aVZrumdAcgpZk0UXFo022D1qlxAVfBXZkOpmtlqiigQSDGo8q5ck6+vO5W172X/kCyBbQ4MS2a+cgs6R8getOekbEX8N/LRqu3mS3qJM9ModMrF9O1D7mEy12ligio7Q4It8CXhlkD1BVm+SqoJaGP9Uney8fAzd3T0SA8wwi08gmZJ1Qefw4FCMzI5rp7KlUJedoDVj8mbFDQ1xA60DahUo0SNzySpG9YqzkTczPuFUHuPFeWILUeaJB+wmyhmo5QNLP5QeV9TNqvkx5pICdlYty5tHamev7hjyZZ17cvQKkWivdxFsZu9Dw4CKVOQzxNEQ4bGSQrfvZqk8GRRS0KxutnFeSlImU4+FeRAW39QI85iLiA1ROIrP1HNTR</xenc:CipherValue></xenc:CipherData></xenc:EncryptedData><ds:Signature xmlns:ns10="http://www.w3.org/2003/05/soap-envelope" xmlns:ns11="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" Id="_1"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><exc14n:InclusiveNamespaces PrefixList="wsse S"/></ds:CanonicalizationMethod><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/><ds:Reference URI="#_5003"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><exc14n:InclusiveNamespaces PrefixList="S"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>9HqBWVQeY+UAmHwqvY1UZPivHqqGhXSGGvLmjELbeO8=</ds:DigestValue></ds:Reference><ds:Reference URI="#_5004"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><exc14n:InclusiveNamespaces PrefixList="S"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>nTVGdtpHv1VCgDo2XPqOHqEIMeFl4/br2sgTrpO1TCk=</ds:DigestValue></ds:Reference><ds:Reference URI="#_5005"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><exc14n:InclusiveNamespaces PrefixList="S"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>RlhqT9qcqcpnW2HUETEDAIa6x/YrbPpDtEcysInzFMA=</ds:DigestValue></ds:Reference><ds:Reference URI="#_5006"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><exc14n:InclusiveNamespaces PrefixList="S"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>ynyavh5ACgANoCt61jc+GNBU1H7TUTb+SVS5fQRlqvw=</ds:DigestValue></ds:Reference><ds:Reference URI="#_5007"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><exc14n:InclusiveNamespaces PrefixList="S"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>DjOXPA/7VxuotqxRbC+YLnMYfvDUSn+06tTYyelI6iU=</ds:DigestValue></ds:Reference><ds:Reference URI="#_3"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><exc14n:InclusiveNamespaces PrefixList="wsu wsse S"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>vrWsiMWbXeSGuhvYG4otWy81HO4NFCe/XzZ/s9CsWY8=</ds:DigestValue></ds:Reference><ds:Reference URI="#uuid_b30b04bd-813b-43bf-8f9e-f02005d031fa"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><exc14n:InclusiveNamespaces PrefixList="wsu wsse S"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>OBm08IkRs3/2EUfBY17JdV+qaDQWBqVJkso0TqGDLyQ=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>PjbPjoCPXJ/2pSkNpeMNSQSUXYY=</ds:SignatureValue><ds:KeyInfo><wsse:SecurityTokenReference wsu:Id="uuid_c050519d-ce78-482d-8f0b-7c6cc2119cb1"><wsse:Reference ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" URI="#_5002"/></wsse:SecurityTokenReference></ds:KeyInfo></ds:Signature></wsse:Security></S:Header><S:Body wsu:Id="_5007"><xenc:EncryptedData xmlns:ns10="http://www.w3.org/2003/05/soap-envelope" xmlns:ns11="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512" Type="http://www.w3.org/2001/04/xmlenc#Content" Id="_5008"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/><ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="keyInfo"><wsse:SecurityTokenReference><wsse:Reference ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" URI="#_5002"/></wsse:SecurityTokenReference></ds:KeyInfo><xenc:CipherData><xenc:CipherValue>Brpx1vnlCG03Juxr6NEFclq8mWiojxNWcFj7MpZEH0XRA72DWIIqAGGRnJ0vwL6hmFfAZS06fFFoVF1m1z4P/3h8MmQ8zHxONRW7PwsvA4uzj9+XV3RpA07jTo+qDD8y</xenc:CipherValue></xenc:CipherData></xenc:EncryptedData></S:Body></S:Envelope>

My question is why are messages different if the same wsit is performed (In the NetBeans I use - "Username Authentication with Symmetric Key" option, and configured wsit file is later used for stand alone deployed service)? Or in the case of stand alone deploying WSIT features are NOT applied to the service?
please some one make me this clear. Thanks

[Goran Markovic]

Hi. can anyone give a hint about my issue? Thanks