Interview Question : Webservice security for jax-ws services

[Guy Emerson]

Hello All,

In one of the interview questions I was asked "What are the APIs  available to provide security to Webservices in SOAP and which one did you use."

I dont remember using any particular api for webservice security . I searched google and did not find any api for sole use in Webservice..  I saw use of https secured protocol , certificates for authentication but not any java api to use..

Would you please help me broaden my knowledge in webservices security . Or am I missing out on something ?


Thanks and Regards

Emerson

[Tim Moores]

The relevant API is called WS-Security, and is supported by all major SOAP implementations. It provides encryption and authentication at the message level (not at the transport level like HTTPS dors).

[Guy Emerson]

Thanks a lot Tim for your quick response.

I will come up with questions on WS-security and implementations as I read along..Please do answer to my queries..

Regards

Emerson

[Guy Emerson]

Hi again,

I was going through the WS-security implementation by Apache which seems to be very good. I am yet to be too sure as to whether its meant only to be used with Apache Axis2 servers as most of the materials I am getting on google tell me that its used with Apache Axes2 framework.. My requirement is WSS4J use in Weblogic server

I am a little lost to distinguish between Apache CXF and Apache WSS4J. If both are meant to provide implementation of WS-Security then why two different implementations.

Thanks a lot to anybody who help me understand these nuances

Regards

Emerson

[Tim Moores]

I think all Java WS-Security implementations are built on top of WSS4J. The comparison would be between Axis2 and CXF, which have different histories and feature sets, but -having used only Axis2- I'm not in a position to recommend one over the other. Axis2 always got the job done for me, so I didn't look elsewhere.

[Guy Emerson]

Hi Tim,

I have been reading through some website that tells me how to apply security Axis2 server with rampart framework. I have created service and clients as shown below. Could you please tell me why I am getting an error and the program fails


Service :-

import javax.xml.stream.XMLStreamException;
import org.apache.axiom.om.OMAbstractFactory;
import org.apache.axiom.om.OMElement;
import org.apache.axiom.soap.SOAPFactory;

public class CMSService {
   public OMElement getNumberOfArticles(OMElement element) throws XMLStreamException {
       element.build();
       element.detach();
       String categoryValue = element.getFirstElement().getText();
       SOAPFactory factory = OMAbstractFactory.getSOAP12Factory();
       OMElement resultElem = factory.createOMElement("numberOfArcticles", factory.createOMNamespace("http://daily-moon.com/cms/", "resp"));
       resultElem.setText(articleCount(categoryValue).toString());
       System.out.println("Service method getNumberOfArticles done");
       return resultElem;
   }

   private Integer articleCount(String catId) {
       return new Integer(42);
   }
}


callback class

import java.io.IOException;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
import org.apache.ws.security.WSPasswordCallback;

public class PWCallback implements CallbackHandler {
   public void handle(Callback[] callbackArr) throws IOException, UnsupportedCallbackException {
       int i = 0;
       while (i < callbackArr.length) {
           if (callbackArr[i] instanceof WSPasswordCallback) {
               WSPasswordCallback wSPasswordCallback = (WSPasswordCallback) callbackArr[i];
               if (wSPasswordCallback.getIdentifer().equals("bob")) {
                   wSPasswordCallback.setPassword("password");
               } else if (wSPasswordCallback.getIdentifer().equals("alice")) {
                   wSPasswordCallback.setPassword("password");
               } else {
                   throw new UnsupportedCallbackException(callbackArr[i], "Unknown user");
               }
               i++;
           } else {
               throw new UnsupportedCallbackException(callbackArr[i], "Unrecognized Callback");
           }
       }
   }
}



services.xml

<service name="CMSService">

   <description>
       This is a sample Web Service for the newspaper's Content Managment System.
   </description>

   <parameter name="ServiceClass" locked="false">CMSService</parameter>

   <parameter name="InflowSecurity">
      <action>
           <items>Timestamp Signature</items>
           <passwordCallbackClass>PWCallback</passwordCallbackClass>
           <signaturePropFile>security.properties</signaturePropFile>
      </action>
   </parameter>

   <parameter name="OutflowSecurity">
     <action>
       <items>Timestamp Signature Encrypt</items>
       <user>alice</user>
       <passwordCallbackClass>PWCallback</passwordCallbackClass>
       <signaturePropFile>security.properties</signaturePropFile>
       <signatureKeyIdentifier>SKIKeyIdentifier</signatureKeyIdentifier>
       <encryptionKeyIdentifier>SKIKeyIdentifier</encryptionKeyIdentifier>
       <encryptionUser>bob</encryptionUser>
       <signatureParts>{Element}{http://schemas.xmlsoap.org/soap/envelope/}Body</signatureParts>
       <optimizeParts>//xenc:EncryptedData/xenc:CipherValue/xenc:CipherData</optimizeParts>
      </action>
   </parameter>

   <operation name="getNumberOfArticles">
       <messageReceiver class="org.apache.axis2.receivers.RawXMLINOutMessageReceiver"/>
   </operation>

</service>


security.properties

org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
org.apache.ws.security.crypto.merlin.keystore.type=jks
org.apache.ws.security.crypto.merlin.keystore.password=password
org.apache.ws.security.crypto.merlin.file=sec.jks






Client side :--

axis2.xml

<axisconfig name="AxisJava2.0">    <!-- Engage the security module -->    <module ref="rampart"/>        <parameter name="OutflowSecurity">      <action>        <items>Timestamp Signature</items>        <user>alice</user>        <passwordCallbackClass>PWCallback</passwordCallbackClass>        <signaturePropFile>security.properties</signaturePropFile>        <signatureKeyIdentifier>SKIKeyIdentifier</signatureKeyIdentifier>        <signatureParts>{Element}{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Timestamp</signatureParts>      </action>    </parameter>    <parameter name="InflowSecurity">      <action>        <items>Timestamp Signature Encrypt</items>        <user>alice</user>        <passwordCallbackClass>PWCallback</passwordCallbackClass>        <signaturePropFile>security.properties</signaturePropFile>        <signatureKeyIdentifier>SKIKeyIdentifier</signatureKeyIdentifier>        <encryptionKeyIdentifier>SKIKeyIdentifier</encryptionKeyIdentifier>        <encryptionUser>bob</encryptionUser>        <signatureParts>{Element}{http://schemas.xmlsoap.org/soap/envelope/}Body</signatureParts>        <optimizeParts>//xenc:EncryptedData/xenc:CipherValue/xenc:CipherData</optimizeParts>      </action>    </parameter>    <!-- ================================================= -->    <!-- Parameters -->    <!-- ================================================= -->    <parameter name="hotdeployment" locked="false">true</parameter>    <parameter name="hotupdate" locked="false">false</parameter>    <parameter name="enableMTOM" locked="false">true</parameter>    <!-- Uncomment this to enable REST support -->    <!--    <parameter name="enableREST" locked="false">true</parameter>-->    <parameter name="userName" locked="false">admin</parameter>    <parameter name="password" locked="false">axis2</parameter>    <!-- ================================================= -->    <!-- Message Receivers -->    <!-- ================================================= -->    <!--This is the Deafult Message Receiver for the system , if you want to have MessageReceivers for -->    <!--all the other MEP implement it and add the correct entry to here , so that you can refer from-->    <!--any operation -->    <!--Note : You can ovride this for particular service by adding the same element with your requirement-->    <messageReceivers>        <messageReceiver mep="http://www.w3.org/2004/08/wsdl/in-only"                         class="org.apache.axis2.receivers.RawXMLINOnlyMessageReceiver"/>        <messageReceiver mep="http://www.w3.org/2004/08/wsdl/in-out"                         class="org.apache.axis2.receivers.RawXMLINOutMessageReceiver"/>    </messageReceivers>    <!-- ================================================= -->    <!-- Transport Ins -->    <!-- ================================================= -->    <transportReceiver name="http"                       class="org.apache.axis2.transport.http.SimpleHTTPServer">        <parameter name="port" locked="false">6060</parameter>        <!--If you want to give your own host address for EPR generation-->        <!--uncommet following paramter , and set as you required.-->        <!--<parameter name="hostname" locked="false">http://myApp.com/ws</parameter>-->    </transportReceiver>    <transportReceiver name="tcp"                       class="org.apache.axis2.transport.tcp.TCPServer">        <parameter name="port" locked="false">6061</parameter>        <!--If you want to give your own host address for EPR generation-->        <!--uncommet following paramter , and set as you required.-->        <!--<parameter name="hostname" locked="false">tcp://myApp.com/ws</parameter>-->    </transportReceiver>    <!-- ================================================= -->    <!-- Transport Outs -->    <!-- ================================================= -->    <transportSender name="tcp"                     class="org.apache.axis2.transport.tcp.TCPTransportSender"/>    <transportSender name="local"                     class="org.apache.axis2.transport.local.LocalTransportSender"/>    <transportSender name="jms"                     class="org.apache.axis2.transport.jms.JMSSender"/>    <transportSender name="http"                     class="org.apache.axis2.transport.http.CommonsHTTPTransportSender">        <parameter name="PROTOCOL" locked="false">HTTP/1.1</parameter>        <parameter name="Transfer-Encoding" locked="false">chunked</parameter>    </transportSender>    <transportSender name="https"                     class="org.apache.axis2.transport.http.CommonsHTTPTransportSender">        <parameter name="PROTOCOL" locked="false">HTTP/1.1</parameter>        <parameter name="Transfer-Encoding" locked="false">chunked</parameter>    </transportSender>    <!-- ================================================= -->    <!-- Phases  -->    <!-- ================================================= -->    <phaseOrder type="inflow">        <!--  System pre defined phases       -->         <phase name="Transport">            <handler name="RequestURIBasedDispatcher"                     class="org.apache.axis2.engine.RequestURIBasedDispatcher">                <order phase="Dispatch"/>            </handler>            <handler name="SOAPActionBasedDispatcher"                     class="org.apache.axis2.engine.SOAPActionBasedDispatcher">                <order phase="Dispatch"/>            </handler>        </phase>        <phase name="Security"/>        <phase name="PreDispatch"/>        <phase name="Dispatch" class="org.apache.axis2.engine.DispatchPhase">            <handler name="AddressingBasedDispatcher"                     class="org.apache.axis2.engine.AddressingBasedDispatcher">                <order phase="Dispatch"/>            </handler>            <handler name="SOAPMessageBodyBasedDispatcher"                     class="org.apache.axis2.engine.SOAPMessageBodyBasedDispatcher">                <order phase="Dispatch"/>            </handler>            <handler name="InstanceDispatcher"                     class="org.apache.axis2.engine.InstanceDispatcher">                <order phase="PostDispatch"/>            </handler>        </phase>        <!--  System pre defined phases       -->        <!--   After Postdispatch phase module author or or service author can add any phase he want      -->        <phase name="OperationInPhase"/>    </phaseOrder>    <phaseOrder type="outflow">        <!--      user can add his own phases to this area  -->        <phase name="OperationOutPhase"/>        <!--system predefined phase-->        <!--these phase will run irrespective of the service-->        <phase name="PolicyDetermination"/>        <phase name="MessageOut"/>    </phaseOrder>    <phaseOrder type="INfaultflow">        <phase name="PreDispatch"/>        <phase name="Dispatch" class="org.apache.axis2.engine.DispatchPhase">            <handler name="RequestURIBasedDispatcher"                     class="org.apache.axis2.engine.RequestURIBasedDispatcher">                <order phase="Dispatch"/>            </handler>            <handler name="SOAPActionBasedDispatcher"                     class="org.apache.axis2.engine.SOAPActionBasedDispatcher">                <order phase="Dispatch"/>            </handler>            <handler name="AddressingBasedDispatcher"                     class="org.apache.axis2.engine.AddressingBasedDispatcher">                <order phase="Dispatch"/>            </handler>            <handler name="SOAPMessageBodyBasedDispatcher"                     class="org.apache.axis2.engine.SOAPMessageBodyBasedDispatcher">                <order phase="Dispatch"/>            </handler>            <handler name="InstanceDispatcher"                     class="org.apache.axis2.engine.InstanceDispatcher">                <order phase="PostDispatch"/>            </handler>        </phase>        <!--      user can add his own phases to this area  -->        <phase name="OperationInFaultPhase"/>    </phaseOrder>    <phaseOrder type="Outfaultflow">        <!--      user can add his own phases to this area  -->        <phase name="OperationOutFaultPhase"/>        <phase name="PolicyDetermination"/>        <phase name="MessageOut"/>    </phaseOrder>    </axisconfig>

client class

import org.apache.axis2.Constants;
import org.apache.axis2.addressing.EndpointReference;
import org.apache.axis2.client.Options;
import org.apache.axis2.client.ServiceClient;
import org.apache.axiom.om.OMElement;

import org.apache.axiom.om.OMAbstractFactory;
import org.apache.axiom.soap.SOAPFactory;
import org.apache.axiom.om.OMNamespace;
import org.apache.axis2.context.ConfigurationContext;
import org.apache.axis2.context.ConfigurationContextFactory;


public class ClassifiedClient {
    private static EndpointReference targetEPR = new EndpointReference(
"http://localhost:8888/axis2/services/CMSService");

    public static OMElement getNumOfArticlesOMElement() {
        SOAPFactory fac = OMAbstractFactory.getSOAP12Factory();
        OMNamespace omNs = fac.createOMNamespace(
                "http://daily-moon.com/cms", "cms");
        OMElement method = fac.createOMElement("getNumberOfArticles", omNs);
        OMElement value = fac.createOMElement("category", omNs);
        value.addChild(fac.createOMText(value, "classifieds"));
        method.addChild(value);

        return method;
    }

    public static void main(String[] args) {
        try {
            OMElement payload = ClassifiedClient.getNumOfArticlesOMElement();
            ConfigurationContext configContext = ConfigurationContextFactory.createConfigurationContextFromFileSystem("axis-repo", null);
            Options options = new Options();
            options.setTo(targetEPR);
            options.setTransportInProtocol(Constants.TRANSPORT_HTTP);

            //Blocking invocation
            ServiceClient sender = new ServiceClient(configContext, null);

            sender.setOptions(options);
            OMElement result = sender.sendReceive(payload);

            String response = result.getText();
            System.out.println("There are "+response+" classifieds at the moment.");
        } catch (Exception e) { //(XMLStreamException e) {
        	System.out.println(e.toString());
        }
    }
}

callback class

import org.apache.ws.security.WSPasswordCallback;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
import java.io.IOException;

public class PWCallback implements CallbackHandler {

    public void handle(Callback[] callbacks)
            throws IOException, UnsupportedCallbackException {

        for (int i = 0; i < callbacks.length; i++) {
            if (callbacks[i] instanceof WSPasswordCallback) {
                WSPasswordCallback pc = (WSPasswordCallback) callbacks[i];

                if (pc.getIdentifer().equals("bob")) {
                    pc.setPassword("password");
                } else if (pc.getIdentifer().equals("alice")) {
                    pc.setPassword("password");
                } else {
                    throw new UnsupportedCallbackException(callbacks[i], "Unknown user");
                }
            } else {
                throw new UnsupportedCallbackException(callbacks[i],
                        "Unrecognized Callback");
            }
        }
    }
}

security.properties

org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
org.apache.ws.security.crypto.merlin.keystore.type=jks
org.apache.ws.security.crypto.merlin.keystore.password=password
org.apache.ws.security.crypto.merlin.file=sec.jks


start.bat

echo off SET CLASSPATH=C:/SW/axis2/lib/XmlSchema-1.0.2.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/axiom-api-1.2.19.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/axiom-impl-1.2.19.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/axis2-kernel-1.7.3.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/commons-codec-1.3.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/commons-httpclient-3.0.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/commons-logging-1.1.1.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/geronimo-spec-activation-1.0.2-rc4.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/geronimo-spec-javamail-1.3.1-rc5.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/jaxen-1.1-beta-8.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/log4j-1.3.15.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/neethi-3.0.3.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/stax-api-3.1.1.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/wsdl4j-1.6.2.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/wstx-asl-2.9.3.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/wss4j-1.6.16.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/xmlsec-1.5.7.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/commons-discovery-0.2.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/bcprov-jdk15on-1.49.jar SET CLASSPATH=%CLASSPATH%;C:/SW/axis2/lib/xalan-2.7.0.jar SET CLASSPATH=%CLASSPATH%;. REM C:\SW\jdk1.5.0_06\bin\javac.exe ClassifiedClient.java java.exe -Daxis2.xml=axis-repo/conf/axis2.xml -Daxis2.repo=axis-repo ClassifiedClient REM java.exe ClassifiedClient



I deployed CMSService.aar in axis2 server in the axis2-1.7.3\repository\services folder



I was expecting to execute the start.bat file to get a response from the axis2 server.

But instead I got an error on the command prompt


C:\Users\humpa\Desktop\softcol\security-code-files\WSSecurityCodeFiles\ClientAFTER>start.bat

C:\Users\humpa\Desktop\softcol\security-code-files\WSSecurityCodeFiles\ClientAFTER>echo off
org.apache.axis2.deployment.DeploymentException: org.apache.axis2.transport.tcp.TCPTransportSender

C:\Users\humpa\Desktop\softcol\security-code-files\WSSecurityCodeFiles\ClientAFTER>



Could you please figure what is creating this Error is ?


Regards

Emerson

[Paul Clapham]

        } catch (Exception e) { //(XMLStreamException e) {
         System.out.println(e.toString());
        }

I'd suggest printing the whole stack trace of the exception instead of just the description. That should give you much more information about where it happens. Like this:

        } catch (Exception e) { //(XMLStreamException e) {
           e.printStackTrace();
        }

[Guy Emerson]

Thanks Paul,

With the stack trace I could see it was because of several jar files missing. Added them now arrived at a configuration problem showing Exception as below :--

[livecoding]C:\Users\humpa\Desktop\softcol\security-code-files\WSSecurityCodeFiles\ClientAFTER>start.bat C:\Users\humpa\Desktop\softcol\security-code-files\WSSecurityCodeFiles\ClientAFTER>echo off org.apache.axis2.deployment.DeploymentException: org.apache.axis2.transport.tcp.TCPServer at org.apache.axis2.deployment.AxisConfigBuilder.processTransportReceivers(AxisConfigBuilder.java:669) at org.apache.axis2.deployment.AxisConfigBuilder.populateConfig(AxisConfigBuilder.java:129) at org.apache.axis2.deployment.DeploymentEngine.populateAxisConfiguration(DeploymentEngine.java:629) at org.apache.axis2.deployment.FileSystemConfigurator.getAxisConfiguration(FileSystemConfigurator.java:116) at org.apache.axis2.context.ConfigurationContextFactory.createConfigurationContext(ConfigurationContextFactory.java:64) at org.apache.axis2.context.ConfigurationContextFactory.createConfigurationContextFromFileSystem(ConfigurationContextFactory.java:210) at ClassifiedClient.main(ClassifiedClient.java:33) Caused by: java.lang.InstantiationException: org.apache.axis2.transport.tcp.TCPServer at java.lang.Class.newInstance(Unknown Source) at org.apache.axis2.deployment.AxisConfigBuilder.processTransportReceivers(AxisConfigBuilder.java:653) ... 6 more[/livecoding]


I did a bit of research and added a few transport receivers as below in the axis2.xml file  :--


<parameter name="transport.tcp.port">6060</parameter>
As shown below. For transport receiver

<!-- Enable TCP message -->  
<transportReceiver name="tcp" class="org.apache.axis2.transport.tcp.TCPTransportListener">
   <parameter name="transport.tcp.port">6060</parameter>
</transportReceiver>
To add Transport Sender

<transportSender name="tcp" class="org.apache.axis2.transport.tcp.TCPTransportSender"/>



Modified axis2.xml looks like this

and the ClassifiedClient.java is remains same with a minor change to include the printStackTrace()  line number 33 shows the configuration problem..

import org.apache.axis2.Constants;
import org.apache.axis2.addressing.EndpointReference;
import org.apache.axis2.client.Options;
import org.apache.axis2.client.ServiceClient;
import org.apache.axiom.om.OMElement;

import org.apache.axiom.om.OMAbstractFactory;
import org.apache.axiom.soap.SOAPFactory;
import org.apache.axiom.om.OMNamespace;
import org.apache.axis2.context.ConfigurationContext;
import org.apache.axis2.context.ConfigurationContextFactory;


public class ClassifiedClient {
    private static EndpointReference targetEPR = new EndpointReference(
"http://localhost:8888/axis2/services/CMSService");

    public static OMElement getNumOfArticlesOMElement() {
        SOAPFactory fac = OMAbstractFactory.getSOAP12Factory();
        OMNamespace omNs = fac.createOMNamespace(
                "http://daily-moon.com/cms", "cms");
        OMElement method = fac.createOMElement("getNumberOfArticles", omNs);
        OMElement value = fac.createOMElement("category", omNs);
        value.addChild(fac.createOMText(value, "classifieds"));
        method.addChild(value);

        return method;
    }

    public static void main(String[] args) {
        try {
            OMElement payload = ClassifiedClient.getNumOfArticlesOMElement();
            ConfigurationContext configContext = ConfigurationContextFactory.createConfigurationContextFromFileSystem("axis-repo", null);
            Options options = new Options();
            options.setTo(targetEPR);
            options.setTransportInProtocol(Constants.TRANSPORT_HTTP);

            //Blocking invocation
            ServiceClient sender = new ServiceClient(configContext, null);

            sender.setOptions(options);
            OMElement result = sender.sendReceive(payload);

            String response = result.getText();
            System.out.println("There are "+response+" classifieds at the moment.");
        } catch (Exception e) { //(XMLStreamException e) {
        	e.printStackTrace();
        }
    }
}

Please advise..

Regards

Emerson