I have webservice (server-side) implemented using axis2 in my project. We want to enable WS-security in the existing web services. We are evaluating if apache ramapart module fits our need. Here is our requirement:
Basically we have in-house security framework which provides encryption,signature and token generation capabilites. Our in-house security framework basically requires a set of configurations in form of XML and it expose various APIs to do various security operations.
Now with above environment, I can think of three possbile solutions:-
I can develop an axis2 module around in-house security framework and install it as .mar file in security phase. So I will not use apache rampart. But issue with this approach is I can't use ws-security policy to specify security assertions and making sure incoming security tokens conforms to effective policy. It is like reinventing wheel what rampart already doing.
I believe apache rampart underlines call to apache wss4j module for security operations. I believe apache wss4j module provides a way to register 3rd party security provider (by implemeting CryptoProvider interface). I am not sure if this is feasible and viable solution. Please suggest.
Ws-security policy allows to use a custom token. This custom token can be built up using our in-house security framework. So basically it enables us to create ws-security policy using apache rampart module and have custom token developed using our security framework. But I could not find help regarding this on internet. Could anyone please help with example.
any other suggestions are also most welcome.
I've posted an answer here: How to encrypt SOAP messages manually?
There is a very detailed example there that you might find useful.
you can set the provider by using :
cryptoConfig.setProvider(PROVIDER);
Regarding the custom security headers, I'm sorry but I didn't try it so I can't help you there.
Related
I have a Jersey based server that I want to secure with OAuth 2.0. There are two paths that I've seen as common:
Oltu - Is compatible with Jersey and seems to be supported, although not as well as Spring Security. This 2012 question seems to suggest this is the way to go, but I want confirmation on a 2016 context so I son't implement something not as well supported anymore.
Spring Security - It seems to be very popular, but this path implies changing the server into a Spring based MVC. I don't know if that is something recommendable based on the benefits of using something as widely supported as Spring and the cost of the refactoring.
With support I mean a project that is in continous development, well established community with tutorials, materials and some libraries for clients (web, mobile, server) already available.
Which one is a stronger option? Is there another option or options?
In any case. Is there a good reference material or tutorial to start implementing this?
UPDATE
After few hours of reading and understanding about both the OAuth Providers I had mentioned, I feel Apache Oltu's documentation did not guide me much as there are key components that aren't documented yet, but an example gave me a better picture on how Oltu must be implemented. On the other hand, going through Spring Security's material I got to know that it can still be built on a non-Spring MVC based java project. But there is a limited exposure of implementations/tutorials on Spring Security on a non-Spring based project.
Another approach:
I came up with an architecture that might be more stable and would not care about the implementation details of the inner server(the one already implemented using Jersey). Having a server that is dedicated for security purpose (authorizing, authenticating, storing tokens in its own database, etc) in the middle that acts like a gateway between the outside world and the inner server. It essentially acts a relay and routes the calls, back and forth and ensures that the client knows nothing about the inner server and both the entities communicate with the security server only. I feel this would be the path to move forward as
Replacing with another security provider just means plugging out the security server implemetation and adding the new one.
The security server cares nothing about the inner server implementation and the calls would still follow the RESTful standards.
I appreciate your suggestions or feedbacks on this approach.
Apache Oltu supports OpenID Connect but its architecture is bad. For example, OpenIdConnectResponse should not be a descendant of OAuthAccessTokenResponse because an OpenID Connect response does not always contain an access token. In addition, the library weirdly contains a GitHub-specific class, GitHubTokenResponse.
Spring Security is famous, but I'm afraid it will never be able to support OpenID Connect. See Issue 619 about the big hurdle for OpenID Connect support.
java-oauth-server and java-resource-server are good examples of Jersey + OAuth 2.0, but they use a commercial backend service, Authlete. (I'm the author of them.)
OpenAM, MITREid Connect, Gluu, Connect2id, and other OAuth 2.0 + OpenID Connect solutions are listed in Libraries, Products, and Tools page of OpenID Foundation.
**UPDATE** for the update of the question
RFC 6749 (The OAuth 2.0 Authorization Framework) distinguishes an authorization server from a resource server. In short, an authorization server is a server that issues an access token, and a resource server is a server that responds to requests which come along with an access token.
For a resource server, API Gateway is one of the recent design patterns. Amazon, CA Technologies, IBM, Oracle and other companies provide API Gateway solutions. API Gateway architecture may be close to your idea. Some API Gateway solutions verify access tokens in their own ways (because the solutions issue access tokens by themselves) and other solutions just delegate access token verification to an external server (because the solutions don't have a mechanism to issue access tokens). For example, Amazon API Gateway is an example that delegates access token verification to an external server, which Amazon has named custom authorizer. See the following for further information about custom authorizer.
Introducing custom authorizers in Amazon API Gateway (AWS Blog)
Enable Amazon API Gateway Custom Authorization (AWS Document)
Amazon API Gateway Custom Authorizer + OAuth (Authlete article)
If an authorization server provides an introspection API (such as RFC 7662) that you can use query information about an access token, your resource server implementation may be able to replace (plug-out and add) an authorization server to refer to comparatively easily.
For an athorization server, gateway-style solutions are rare. It's because such a solution must expose all the functionalities required to implement an authorization server as Web APIs. Authlete is such a solution but I don't know others.
I think, it's far simplier to use the oauth connectors that are implemented inside jersey itself!
Have you considered using jersey own OAuth (already linked inside jersey) server / client ?
https://eclipse-ee4j.github.io/jersey.github.io/documentation/latest/security.html#d0e13146
Please take a look to :
16.3.2. OAuth 2 Support
hope helped. :)
I have implemented idp using OpenAM. Now i have to implement sp. I tired using fedlet but couldn't integrate with my existing app. So, i am now trying to write sp from scratch to implement SSO. Can anyone provide steps to implement sp using OpenSAML?
If you have a java-based WebApp then using Spring Security SAML extension is quite simple to integrate.
Why dont you define a SP in OpenAM without the fedlet? If you want to use OpenSAML for it, I have a book, A Guide to OpenSAML, that introduces SAML and the OpenSAML library. I also have lots of examples here on my blog.
I am implementing a Spring WS in NetBeans IDE and JDK1.6. The Spring-WS version is 2.0.4. Though I have implemented the provider by going through the tutorial on Spring site but I am unable to implement the security features. Can anybody explain the overall security framework in WebServices like where are the certificates placed on the server and how the request is validated against them. Also the spring site doesnt contains enough info about the terms like keystores, certificates, trusted stores. Can anybody explain how are these related to Spring WS and how can they be created and used ? I am just getting more and more confused ?
I implemented Spring WSS few weeks ago and all the information you need can be found in this link. There, you can find information about certificates and keystores but you should look for in other place if you need more information about as Spring WSS just uses certificates for signing and validating the messages.
Particulary, for signing a message you need to create a interceptor as it is described here. Once your interceptor is ready, you can add it to the ingoing messages or to the outgoing
Also, I recommend you to debug your SOAP messages as it is described here to see what is going on with your messages.
I am developing a server/client Java application where I need to authenticate the client before sending data, also I need to encrypt the sent data after authentication and to ensure its freshness
I am wondering what is the best library that I could use to do that?
Take a look at the security module in the Spring framework. Pretty much covers all the common authentication and authorisation services
Java Authentication and Authorization Service is a part of Java spec since SE 1.4. The API is fairly well-defined, but as it has been written with goal of covering every possible auth backend (including LDAP, smart card and similar stuff) it may bring too much functionality overhead.
Apache Shiro is one of libraries/frameworks that I am aware of, that build upon JAAS, abstracting it's concepts and making them generally easier to use. The second one is jGuard, but as of Dec 2013 it seems to not being maintained anymore.
You could integrate with an existing LDAP (or Active Directory) registry using OpenLDAP ( http://www.openldap.org/jldap/ ).
You could use Public Key Encryption and do client authentication based on certificates.
Check out JSSE of SUN on secure sockets
If you are not using Spring and you are using some off-the-shelf server framework, look there - most include authorization modules.
I'm having a lot of problems trying to implement an OAuth provider.
I would like to know if anyone has successfully used an Oauth provider using Java? I found a lot of libraries but all of them are really bad commented and I cant work with them. I'm accepting any documentation that explains how an oauth provider should work and/or how implement it.
Situation: I have some data in MySQL on my server and I would like to authorize a "rely party" to access over OAuth, but I'm not sure how to do it.
I assume you want to secure your server-side services with Oauth? You did not say what kind of server-side technology you are using.
For example for REST-based servers, both Jersey and Resteasy already have Oauth integrated.
Also, this seem to be a pretty complete servlet+JSP OAuth example: http://oauth.googlecode.com/svn/code/java/example/oauth-provider/
Here is a better alternative, It's in java and comes with demo dropwizard and Java EE applications
https://github.com/OpenConextApps/apis
ApiFest is an open-source project that implements OAuth20 specification final version (RFC 6749). The project is available at github and it is released under Apache License, Version 2.0. ApiFest is written in pure Java and uses Netty as a server. You can check the code - https://github.com/apifest/apifest-oauth20. You can take a look at the documentation on the site, too - http://apifest.com.