I'm implementing a Client Web Service and I need to convert code from Apache Axis2 with Apache CXF.
Below is the code in Apache Axis2 which needs to be converted to CXF way of authentication:
_service = "http://mysite.custhelp.com/cgi-bin/myinterface.cfg/services/soap";
org.apache.axis2.client.ServiceClient serviceClient = ((org.apache.axis2.client.Stub)_service)._getServiceClient();
serviceClient.addHeader(createSecurityHeader("Username", "Password"));
Where createSecurityHeader will create be responsible for authenticating and providing a response in form of securityHeader.
Any help will be appreciated.
Thanks,
Jineet
I know it's probably too late to be able to help you, Jineet, but answering this question for the benefit of others who might have struggled like you and me trying to migrate from Axis to CXF.
You need to do both the steps described as the top 2 solutions of this stackoverflow question: Java Web Service client basic authentication
As per my understanding and experience, the first approach (BindingProvider) is required for authentication at SOAP protocol level to work. The second one (Authenticator) is required for authorization to access the SOAP service endpoint URL (HTTP/s level).
After making both these changes, my migration was successful.
Related
I am working on integrating a SOAP service provided by european VAT validation service VIES.
the SOAP service is hosted at following links
https://ec.europa.eu/taxation_customs/vies/checkVatService.wsdl
http://ec.europa.eu/taxation_customs/vies/checkVatService.wsdl
I think both of them leads to pretty much same site with one being http and other https
(please let me know if there is a difference).
so I integrated the wsdl into our spring boot application and it worked fine when I tried in in my local host which was http. but as soon as I hosted it in to our live server which is https it started giving error reply.
I searched for possible reasons why it isn't working and ended up with the conclusion that the SOAP services provided by VTES works only in http sites.(let me know if I am wrong)
but when I searched for more solutions I found more sites that provide https secured REST application that uses same SOAP service (https://vatlayer.com/) . We tried to reason with our client to purchase one of those since they only allow a limited number of free VAT validations, but they are not happy with that,
but it got me thinking since they can built a https secured REST API with this thing it means I can do that to. so I searched for a solution but couldn't find any, can anyone please give a insight into it about how it is done.
Thanks and regards.
If you are calling the link from the web browser(client side) and if your live web application runs on HTTPS, then you should also call the SOAP service with HTTPS or otherwise the browser will see it as violating the Same Origin Policy and will block your request.
Starting a new project to create a restful Web Service that requires callers to be Authenticated by Kerberos (Active Directory).
The web service will be hosted by Tomcat and I was planning to use JAX-RS with JAAS but I'm not finding much information on this, does anyone have information or experience on getting this to work?
Should I be looking at Spring and Spring Security instead?
Apache provides good documentation for using JAXRS with kerberos. Here is the link:
http://cxf.apache.org/docs/jaxrs-kerberos.html
I have the same issue. I googled extensively and not found a good answer.
The problem is that the issue has several layers and most answers point to (usually vague) solutions for only one layer.
And there is not a single complete and clear example for the end-to-end solution.
LAYERS
Client call to rest service using kerberos/windows logged in credentials.
Answers usually show how to use kerberos to authenticate but fail to say how to use it to pass the logged in credentials to the REST service.
Both Spring REST client functionality and native Java seem capable of doing this but it is not clear how.
Processing by the REST service of the authentication request by the client that is authenticating via windows/kerberos.
Spring REST service functionality appears to be the easiest way to implement it but again it is not clear how to tell the REST service to expect that authentication method.
Either forwarding the client kerberos credentials to whatever resource the REST service is trying to access, or get a success/failure and then the REST service uses kerberos/windows authentication itself (different credentials from the clients) to access a resource.
I hope this clarification of the issue helps in producing a good answer.
In Kerberos there are two severs url involved authentication server and the other ticketing server. If you go to browser console under ticketing server response parameter you can see a cookie that you can utilise to authenticate your rest api by utilising it as a request parameters.
That’s the only solution to authenticate your rest api.
I am creating a web service using IBM JAX-RPC/JAX-WS. I am trying to implement the wsse security but not able to figure out the exact steps for achieving the same. I will be using RSA 7.5 and Websphere 7 for this web service.
Reading the documentation, I was totally lost since I am new to it and don't have any idea about the same.
Can someone list me the steps for how to implement the wsse security for the web service?
I have been struggling on this since past few days.
EDIT
I want the authentication to be done in the header, it should look something like this:
<header>
<authenticationInfo>
<userID></userID>
<password></password>
</authenticationInfo>
</header>
Other than using the handler and altering the header content, is there some other way to achieve the same?
For web services (SOAP based), the security part is generally handled by web services handlers. Handlers are applicable for both the client and server side. For typical security use case,
On client side, the handlers intercept the request before being send to server and inserts a security header in the SOAP message.
On server side, the handlers intercept the request and check for the SOAP request contains appropriate security headers. This happens before it handled by request handlers.
Here is a nice link on WS security in general I came across. Its not IBM or java specific but an informative read nevertheless.
To answer you question for step by step guide, I could not find any standard RSA 7.5 specific articles but since JAX-RPC is standard specification, it should be same. Here is once such example (Part1,Part2)
WebSphere has built-in support for WS-Security. See http://publib.boulder.ibm.com/infocenter/radhelp/v7r5/topic/com.ibm.webservice.wsfp.doc/topics/csecurews.html.
Can any one provide me code for consuming webservices via SOAP in java? Actually i am able to consume webservices through HTTP GET and HTTP POST but my requirement is to consume webservices through SOAP.I tried through SOAP but not getting any output. So plz help me to out from this crisis.
Thanks
The WSDL is here:
http://www.webservicex.net/globalweather.asmx?WSDL
You can view my example web service client on github. I use the maven cxf-codegen-plugin (as configured in pom.xml) to generate the client code, which is located here. You can then call the web service operations as demonstrated here.
If you search in google for java soap client example then you will find a lot of java examples of SOAP implementation.
If you have the WSDL of the web service, you can generate a Java client to talk to that service easily with Axis2 CodeGen
What is the correct way to authenticate an Axis2 (Version 1.4) Client at a http proxy server that requires NTLM authentication?
I'm using the following code to provide the proxy credentials, but the authentication still fails (see details at the end):
Options options = serviceStub._getServiceClient().getOptions();
options.setProperty(HTTPConstants.CHUNKED, false);
options.setProperty(HTTPConstants.PROTOCOL_VERSION, HTTPConstants.HEADER_PROTOCOL_10);
ProxyProperties proxyProperties = new ProxyProperties();
proxyProperties.setProxyName("123.123.123.123");
proxyProperties.setProxyPort(8080);
proxyProperties.setUserName("myUser#www.example.org");
proxyProperties.setPassWord("1234");
proxyProperties.setDomain("");
options.setProperty(HTTPConstants.PROXY, proxyProperties);
With exactly the same credentials, a webbrowser, such as Firefox is able to get trough the proxy, so I assume, the proxy server is correctly set up. With the Axis2 client however, the authentication failes (HTTP status code is "407 Proxy Authentication Required").
Further details:
I compared the network traffic from firefox and my client using a network sniffer. The main difference seems to be, that the axis2 client is sending an empty response for the ntlm challenge.
Has anyone successfully authenticated at a http proxy server using NTLM? Can you give me a code example?
I was unable to resolve this problem (with Axis 2). Don't want to blame this on Axis2 tough. Maybe I did something wrong but couldn't figure it out, even after many hours of trying, debugging and reading the docs.
But when I was running out of options I had to look out for other options. This other option came in the form of alternative SOAP-Frameworks. There exist quite a few SOAP frameworks for java. I know about Axis2, CXF and JAX-WS.
Instead of Axis2 I use now JAX-WS. Replacing the frameworks was a straight forward process. A nice side effect of the replacement was, that I got rid of the huge dependency tree, Axis2 comes with. JAX-WS is part of J6EE so there wasn't any need to import other dependencies.
At this time I did the replacement only on the client side. The server still uses Axis2. This combination works great so far, but I still plan to eventually replace Axis2 on the server side too.
All in all: If you do not use a special feature of Axis2, I think, JAX-WS is the better option.