I am creating a web service using IBM JAX-RPC/JAX-WS. I am trying to implement the wsse security but not able to figure out the exact steps for achieving the same. I will be using RSA 7.5 and Websphere 7 for this web service.
Reading the documentation, I was totally lost since I am new to it and don't have any idea about the same.
Can someone list me the steps for how to implement the wsse security for the web service?
I have been struggling on this since past few days.
EDIT
I want the authentication to be done in the header, it should look something like this:
<header>
<authenticationInfo>
<userID></userID>
<password></password>
</authenticationInfo>
</header>
Other than using the handler and altering the header content, is there some other way to achieve the same?
For web services (SOAP based), the security part is generally handled by web services handlers. Handlers are applicable for both the client and server side. For typical security use case,
On client side, the handlers intercept the request before being send to server and inserts a security header in the SOAP message.
On server side, the handlers intercept the request and check for the SOAP request contains appropriate security headers. This happens before it handled by request handlers.
Here is a nice link on WS security in general I came across. Its not IBM or java specific but an informative read nevertheless.
To answer you question for step by step guide, I could not find any standard RSA 7.5 specific articles but since JAX-RPC is standard specification, it should be same. Here is once such example (Part1,Part2)
WebSphere has built-in support for WS-Security. See http://publib.boulder.ibm.com/infocenter/radhelp/v7r5/topic/com.ibm.webservice.wsfp.doc/topics/csecurews.html.
Related
I have a Jersey based server that I want to secure with OAuth 2.0. There are two paths that I've seen as common:
Oltu - Is compatible with Jersey and seems to be supported, although not as well as Spring Security. This 2012 question seems to suggest this is the way to go, but I want confirmation on a 2016 context so I son't implement something not as well supported anymore.
Spring Security - It seems to be very popular, but this path implies changing the server into a Spring based MVC. I don't know if that is something recommendable based on the benefits of using something as widely supported as Spring and the cost of the refactoring.
With support I mean a project that is in continous development, well established community with tutorials, materials and some libraries for clients (web, mobile, server) already available.
Which one is a stronger option? Is there another option or options?
In any case. Is there a good reference material or tutorial to start implementing this?
UPDATE
After few hours of reading and understanding about both the OAuth Providers I had mentioned, I feel Apache Oltu's documentation did not guide me much as there are key components that aren't documented yet, but an example gave me a better picture on how Oltu must be implemented. On the other hand, going through Spring Security's material I got to know that it can still be built on a non-Spring MVC based java project. But there is a limited exposure of implementations/tutorials on Spring Security on a non-Spring based project.
Another approach:
I came up with an architecture that might be more stable and would not care about the implementation details of the inner server(the one already implemented using Jersey). Having a server that is dedicated for security purpose (authorizing, authenticating, storing tokens in its own database, etc) in the middle that acts like a gateway between the outside world and the inner server. It essentially acts a relay and routes the calls, back and forth and ensures that the client knows nothing about the inner server and both the entities communicate with the security server only. I feel this would be the path to move forward as
Replacing with another security provider just means plugging out the security server implemetation and adding the new one.
The security server cares nothing about the inner server implementation and the calls would still follow the RESTful standards.
I appreciate your suggestions or feedbacks on this approach.
Apache Oltu supports OpenID Connect but its architecture is bad. For example, OpenIdConnectResponse should not be a descendant of OAuthAccessTokenResponse because an OpenID Connect response does not always contain an access token. In addition, the library weirdly contains a GitHub-specific class, GitHubTokenResponse.
Spring Security is famous, but I'm afraid it will never be able to support OpenID Connect. See Issue 619 about the big hurdle for OpenID Connect support.
java-oauth-server and java-resource-server are good examples of Jersey + OAuth 2.0, but they use a commercial backend service, Authlete. (I'm the author of them.)
OpenAM, MITREid Connect, Gluu, Connect2id, and other OAuth 2.0 + OpenID Connect solutions are listed in Libraries, Products, and Tools page of OpenID Foundation.
**UPDATE** for the update of the question
RFC 6749 (The OAuth 2.0 Authorization Framework) distinguishes an authorization server from a resource server. In short, an authorization server is a server that issues an access token, and a resource server is a server that responds to requests which come along with an access token.
For a resource server, API Gateway is one of the recent design patterns. Amazon, CA Technologies, IBM, Oracle and other companies provide API Gateway solutions. API Gateway architecture may be close to your idea. Some API Gateway solutions verify access tokens in their own ways (because the solutions issue access tokens by themselves) and other solutions just delegate access token verification to an external server (because the solutions don't have a mechanism to issue access tokens). For example, Amazon API Gateway is an example that delegates access token verification to an external server, which Amazon has named custom authorizer. See the following for further information about custom authorizer.
Introducing custom authorizers in Amazon API Gateway (AWS Blog)
Enable Amazon API Gateway Custom Authorization (AWS Document)
Amazon API Gateway Custom Authorizer + OAuth (Authlete article)
If an authorization server provides an introspection API (such as RFC 7662) that you can use query information about an access token, your resource server implementation may be able to replace (plug-out and add) an authorization server to refer to comparatively easily.
For an athorization server, gateway-style solutions are rare. It's because such a solution must expose all the functionalities required to implement an authorization server as Web APIs. Authlete is such a solution but I don't know others.
I think, it's far simplier to use the oauth connectors that are implemented inside jersey itself!
Have you considered using jersey own OAuth (already linked inside jersey) server / client ?
https://eclipse-ee4j.github.io/jersey.github.io/documentation/latest/security.html#d0e13146
Please take a look to :
16.3.2. OAuth 2 Support
hope helped. :)
My web service was created some time back using IBM JAX-RPC. As a part of enhancement, I need to provide some security to the existing service.
One way is to provide a handler, all the request and response will pass through that handler only. In the request I can implement some authentication rules for each and every application/user accessing it.
Other than this, What are the possible ways for securing it?
I have heard someting called wsse security for web service. Is it possible to implement it for the JAX-RPC? Or it can be implemented only for JAX-WS? Need some helpful inputs on the wsse security so that i can jump learning it.
Other than handler and wsse security, any other possible way to make a service secure?
Please help.
JAX-RPC and Document-Literal are two different ways of creating SOAP webservices. For adding the security, check out OASIS. You have to add the the policy tag and additional layer of encryption to the SOAP message
I am implementing a Spring WS in NetBeans IDE and JDK1.6. The Spring-WS version is 2.0.4. Though I have implemented the provider by going through the tutorial on Spring site but I am unable to implement the security features. Can anybody explain the overall security framework in WebServices like where are the certificates placed on the server and how the request is validated against them. Also the spring site doesnt contains enough info about the terms like keystores, certificates, trusted stores. Can anybody explain how are these related to Spring WS and how can they be created and used ? I am just getting more and more confused ?
I implemented Spring WSS few weeks ago and all the information you need can be found in this link. There, you can find information about certificates and keystores but you should look for in other place if you need more information about as Spring WSS just uses certificates for signing and validating the messages.
Particulary, for signing a message you need to create a interceptor as it is described here. Once your interceptor is ready, you can add it to the ingoing messages or to the outgoing
Also, I recommend you to debug your SOAP messages as it is described here to see what is going on with your messages.
I am currently using the jaxws and apache CXF framework to create webservices using the top down approach.
I am using the SOAP interceptors to add remove SOAP header elements, using SAAJ, before the message gets to the container, and the container maps the SOAP action too the java method. I am doing this to create Security Token Services (STS) to facilitate a lite implementation of the SAML2 Profile - converting authentication details into portable identities (SAML Authentication Assertions).
I cannot help think there must be an easier way to do this. Is there a framework that will allow me to manipulate the message with more ease? and if so a tutorial would help.
Many thanks
To change things in SOAP messages you must use SOAP Handlers.
Maybe easier way to do it is changing the way you are securing your web service, if you use a WS-Security way of doing things, our container will work with it fine, and you don't need the handlers anymore.
As per title really I'm wanting to send a custom HTTP post request to a web server and I have little experience in this area. The web server uses an LDAP server for access control (not sure if that's important) for which of course I know the username and password. Could anyone flesh out some code to do this or at least get me started?
Edit for one of the comments, the server is running a LAMP stack with PhP 5+ and Apache 2+
You can use HttpClient module from Apache.
Although the java.net package provides
basic functionality for accessing
resources via HTTP, it doesn't provide
the full flexibility or functionality
needed by many applications.
HttpClient seeks to fill this void by
providing an efficient, up-to-date,
and feature-rich package implementing
the client side of the most recent
HTTP standards and recommendations.
Designed for extension while providing
robust support for the base HTTP
protocol, HttpClient may be of
interest to anyone building HTTP-aware
client applications such as web
browsers, web service clients, or
systems that leverage or extend the
HTTP protocol for distributed
communication.
LDAP and authentication are separate issues from sending POSTs to web servers.
Th server side needs to do that authentication. Set it up either in your code or in the web server itself.
If your client is a Java application, you can create a POST using UrlConnection.
If your client is an HTML page or JSP, you need a form with a POST action.