I have a plain webservice deployed on a weblogic server which is working as expected.
Now I want to secure it and I tried using #RolesAllowed but it's not restricting access to the webservice - all users are granted access.
#WebService(portName = "WebInternalSoapHTTPPort", serviceName = "InternalService", targetNamespace = "http://test.com/WebInternalServices", endpointInterface = "com.test.webinternal.WebInternal")
#BindingType("http://schemas.xmlsoap.org/wsdl/soap/http")
#Policies({#Policy(uri="policy:customPolicy.xml")})
#RolesAllowed ( {
#SecurityRole (role="developer",
mapToPrincipals={ "shilpa"})
} )
public class WebInternalImpl implements WebInternal {
}
But when I try to manually add this restriction via Admin Console it works fine.
Looks like I am missing some configuration to apply security role defined in the JWS file.
Any thoughts are much appreciated.
Related
when I log into my app, I get a message
If you’re the app developer, make sure that these request details
comply with Google policies. redirect_uri:
http://XXXXXX/login/oauth2/code/google
I tried to add this to the Authorized redirect URIs in my google cloud
but I get an error
Invalid Redirect: You are using a sensitive scope. URI must use
https:// as the scheme
also if I add a url with
https://
then I still get a message when I log into the app
If you’re the app developer, make sure that these request details
comply with Google policies. redirect_uri:
http://XXXXXXX/login/oauth2/code/google
my technology stack:
java
spring
vaadin
properties file:
server.port=${PORT:8080}
spring.security.oauth2.client.registration.google.client-id=xxxxxx.apps.googleusercontent.com
spring.security.oauth2.client.registration.google.client-secret=xxxxxx
spring.security.oauth2.client.registration.google.scope=openid,email,profile,\
https://www.googleapis.com/auth/spreadsheets,\
https://www.googleapis.com/auth/spreadsheets.readonly,\
https://www.googleapis.com/auth/drive.file,\
https://www.googleapis.com/auth/drive,\
https://www.googleapis.com/auth/script.scriptapp
spring.security.oauth2.client.provider.google.token-uri=https://oauth2.googleapis.com/token
spring.security.oauth2.client.provider.google.authorization-uri=https://accounts.google.com/o/oauth2/auth?prompt=consent&access_type=offline
spring.security.oauth2.client.provider.google.user-info-uri=https://www.googleapis.com/oauth2/v3/userinfo
the code that gets Credential:
public void initCredential(OAuth2AuthorizedClientService authorizedClientService, Authentication authentication ) {
OAuth2AuthorizedClient authorizedClient = authorizedClientService.loadAuthorizedClient(
"google",
authentication.getName());
credential = new GoogleCredential.Builder()
.setClientSecrets(CLIENT_ID,CLIENT_SECRET)
.setJsonFactory(GsonFactory.getDefaultInstance())
.setTransport(GoogleNetHttpTransport.newTrustedTransport())
.build()
.setAccessToken(authorizedClient.getAccessToken().getTokenValue())
.setRefreshToken(authorizedClient.getRefreshToken().getTokenValue());
}
also Oauth2 configuration:
#EnableWebSecurity
#Configuration
public class WebSecurityConfig extends VaadinWebSecurityConfigurerAdapter {
private static final String LOGIN_URL = "/login";
#Override
protected void configure(HttpSecurity http) throws Exception {
super.configure(http);
http.oauth2Login()
.loginPage(LOGIN_URL).permitAll();
}
#Override
public void configure(WebSecurity web) throws Exception {
super.configure(web);
web.ignoring().antMatchers(
"/VAADIN/**",
"/favicon.ico",
"/robots.txt",
"/manifest.webmanifest",
"/sw.js",
"/offline-page.html",
"/frontend/**",
"/webjars/**",
"/frontend-es5/**", "/frontend-es6/**")
.antMatchers(HttpMethod.POST, "/notifications");
}
}
as I understand it, I need to configure the use of the https protocol in the configuration, but I don't understand a little where I can configure it
it is also worth noting that the application works locally, but when deploying it to AWS and trying to login via oauth 2, I get the message
As stated in the message You are using a sensitive scope. URI must use https:// as the scheme
Just configuring it in Google cloud console has no effect on how your application runs. It just says that this redirect uri will be supported.
Your app when it is run is still running with http and not as https. I am going to assume that you are still in development and running this locally and you have not configured our app yet to run https.
Fix your ide.
We are developing a barcode application to run on our mobile computers running Windows Mobile 5.0 Pocket PC and it needs to get it's data from our Oracle database.
Apex is already set up but how can I create a secure Web Service using Apex's native Authentication? How to set "HTTPS only"?
Update
I can call the ...?wsdl link in the browser now, looks fine. It's also registered in the project as a WebReferance.
But when I run the following code:
CONTAR_USUARIOSService service = new CONTAR_USUARIOSService();
System.Net.NetworkCredential pocket = new System.Net.NetworkCredential("pocket", "000");
service.Credentials = pocket;
double resultado = service.CONTAR_USUARIOS();
I get this error:
System.Net.WebException was unhandled
Message="WebException"
StackTrace:
at System.Web.Services.Protocols.SoapHttpClientProtocol.doInvoke(String methodName, Object[] parameters, WebClientAsyncResult asyncResult)
at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
at Supernorte.Recebimento.ContarUsuariosWebReference.CONTAR_USUARIOSService.CONTAR_USUARIOS()
at Supernorte.Recebimento.Login..ctor()
at Supernorte.Recebimento.MainForm.mostrarLogin()
at Supernorte.Recebimento.MainForm..ctor()
at Supernorte.Recebimento.Program.Main()
I get an "Unauthorized" error.
If you get your Oracle inputs and outputs routed through your web service (which I am still personally struggling with), you might be able to access your information that way.
Add the web reference.
It will ask for the URL where your Web Service has been uploaded. I'm guessing this can be a website you own off site, but I use our internal server.
You can see I have a default web page where I load up the available services that I've stuck out there. 1Mainframe.svc` was going to be my "Big Service", but then I realized that I needed to do a lot more than make that once call, so I created the next one, "Erp Service".
Anyway, after I select the ErpService.svc, I'm given this, where I changed the default Web Reference Name to ErpService1. I've personally found that if I need to edit or modify the service, the XML config files get all messed up, so I just delete Service1 and add Service2.
I add a new class called ErpClass1.cs
Add a reference to my Web Service using the namespace for my project, and start coding!
using System;
using System.Linq;
using System.Collections.Generic;
using System.Text;
using AcpMobile5.ErpService1;
namespace AcpMobile5 {
class ErpClass1 {
private ErpService m_erpService;
public ErpClass1() {
m_erpService = new ErpService();
}
public void Query(string woNumber) {
m_erpService.Query(woNumber);
}
public string PartNumber() {
return m_erpService.CoilPartNo();
}
}
}
Obviously, this does not solve everything for you. The Web Service that you use to access your Oracle database still needs to be written, and that's no simple task.
However, I hope it helps point you along the right direction.
This is all done using Visual Studio 2008 for Mobile 5.0.
So, I didn't use Apex as I intended. Instead I enabled Oracle XML DB Native Web Services.
After some hard times with authentication [mostly caused by typing the wrong password ): ] I got this code working:
MyWebService service = new MyWebService();
service.Credentials = new MyWebService("MY_ORACLE_USER", "*******");
double result = service.MY_LOGIN_FUNCTION(this.userName);
I'm behind ISA Server Proxy and I need to call a web service. Given its wsdl I've created proxies (using Add Service Reference command) and have tried to call the service, but it raised an exception telling me that proxy authorization is required. After some research I've found a solution to my problem
var webproxy = new WebProxy(new Uri("http://<address>:<port>").ToString(), true, new string[]
{
})
{
Credentials = networkCredentials,
BypassProxyOnLocal = false
};
WebRequest.DefaultWebProxy = webproxy;
After this piece of code I'm able to call web service. But as I've read here by default DefaultWebProxy uses the same settings as set in IE. However WebRequest.DefaultWebProxy.Credentials is null and I'm unable to pass thru the proxy. Why?
I've was also same boat. The last answer on this post helped me.
How do I determine (elegantly) if proxy authentication is required in C# winforms app
Especially.
//HACK: add proxy
IWebProxy proxy = WebRequest.GetSystemWebProxy();
proxy.Credentials = System.Net.CredentialCache.DefaultCredentials;
req.Proxy = proxy;
req.PreAuthenticate = true;
//HACK: end add proxy
I have developed a custom SharePoint web service, and deployed it to /_vti_bin/myservice.asmx. As a "regular" user, browsing to that ASMX URL works fine. When I try to browse to "/_vti_bin/myservice.asmx/js" as required to call this service from ASP.Net AJAX, I get a 403. If I browse to it as no less than a farm admin (site collection admin doesn't work), I get a 403. It is entirely possible that the farm admin's role as a local server admin is also allowing it to work.
This is my web service class:
[WebService(Namespace = "http://sharepointservices.genericnamespace.com/")]
[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
[System.ComponentModel.ToolboxItem(false)]
[System.Web.Script.Services.ScriptService]
public class ApprovalSvc : System.Web.Services.WebService
{
[WebMethod]
[ScriptMethod(ResponseFormat = ResponseFormat.Xml)]
public XmlDocument GetInboxItems(string inboxName, string s_Id)
{
// code removed
}
}
This is the art of my web part code where I am hooking up the ASP.Net AJAX stuff:
ScriptManager scriptMgr = new ScriptManager();
string webUrl = SPContext.Current.Web.Url;
ServiceReference srvRef = new ServiceReference(webUrl + "/_vti_bin/ApprovalSvc.asmx");
scriptMgr.Services.Add(srvRef);
this.Controls.Add(scriptMgr);
If I'm logged in as a farm/server admin, it works. Otherwise, no. The web service assembly is in the GAC & listed in SafeControls. Any ideas?
Good old Process Monitor to the rescue.
The facts:
The service code DLL is in the web application's bin directory, as it cannot be signed b/c it references unsigned DLLs.
The request for the service DLL is coming from ASP.Net & not SharePoint, specifically an HttpModule in the System.Web.Extensions assembly.
The solution:
Because the request didn't come through SharePoint, and identity impersonation is also turned on by default, the default NTLM permissions on the web app's BIN directory were not good enough - the user's account had no access to the BIN directory or the DLLs within it.
We gave the NT AUTHORITY\Authenticated Users Read access (not Read & Execute, not List Folder Contents, just Read) to the folder, and all is well.
I created a very simple webservice in ASP.NET 2.0 to query a list in SharePoint 2007 like this:
namespace WebService1
{
/// <summary>
/// Summary description for Service1
/// </summary>
[WebService(Namespace = "http://tempuri.org/")]
[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
[System.ComponentModel.ToolboxItem(false)]
// To allow this Web Service to be called from script, using ASP.NET AJAX, uncomment the following line.
// [System.Web.Script.Services.ScriptService]
public class Service1 : System.Web.Services.WebService
{
[WebMethod]
public string HelloWorld()
{
return "Hello World";
}
[WebMethod]
public string ShowSPMyList()
{
string username = this.User.Identity.Name;
return GetList();
}
private string GetList()
{
string resutl = "";
SPSite siteCollection = new SPSite("http://localhost:89");
using (SPWeb web = siteCollection.OpenWeb())
{
SPList mylist = web.Lists["MySPList"];
SPQuery query = new SPQuery();
query.Query = "<Where><Eq><FieldRef Name=\"AssignedTo\"/><Value Type=\"Text\">Ramprasad</Value></Eq></Where>";
SPListItemCollection items = mylist.GetItems(query);
foreach (SPListItem item in items)
{
resutl = resutl + SPEncode.HtmlEncode(item["Title"].ToString());
}
}
return resutl;
}
}
}
This web service runs well when tested using the built-in server of Visual Studio 2008. The username indicates exactly my domain account (domain\myusername).
However when I create a virtual folder to host and launch this web service (still located in the same machine with SP2007), I got the following error when invoking ShowSPMyList() method, at the line to execute OpenWeb(). These are the details of the error:
System.Data.SqlClient.SqlException: Cannot open database "WSS_Content_8887ac57951146a290ca134778ddc3f8" requested by the login. The login failed.
Login failed for user 'NT AUTHORITY\NETWORK SERVICE'.
Does anyone have any idea why this error happens? Why does the web service run fine inside Visual Studio 2008, but not when running stand-alone? I checked and in both cases, the username variable has the same value (domain\myusername).
Thank you very much.
Thank you very much for the replies. I'll look into the documents to see how i can change the settings related to the application pool as suggested.
I want to make clear that i wanted to build a webservice to run outside of sharepoint (but can be deployed on the same server with sharepoint).
Is there any way i can programmatically pass the credentials (another domain account instead of 'NT AUTHORITY\NETWORK SERVICE' by default) to sharepoint when invoking OpenWeb method? I believe if i'm able to do that then i can walkaround the security issue above.
When you create your own custom virtual folder and set it inside the IIS, it's highly possible that the user account who run the application pool of that particular IIS virtual directory is currently set to NT authority\Network Service.
You can check carefully, by looking closely of what is the actual application pool that run that particular IIS virtual directory.
From there, you can go to the "Application Pool" folder and right click, choose Properties. Select the "Identity" tab, and it will show you who is the user account that currently running the application pool.
Alternatively, you can refer to the SharePoint SDK, something similar to ExtractCrmAuthenticationToken in dynamics CRM to extract the Authentication Token ticket.
Or alternatively you can use Network Credential to embed your own custom user id and password.
Hope this helps,
hadi teo
I fully agree with Hadi, if this is something you want to just quickly test, for a proof of concept, you can change the credentials under what the Application pool runs, to a user that has permissions. Or you could use Identity Impersonate setting in your config file.
However resist the temptiation to do this in a production enviroment, use the proper authentication. It will come back, to bite you.
If you need to set this up for production, there is a couple of areas that you want to look at, duplicate SPN's, and deligation probably the most common areas that is not configured correctly. Your error however points to impersanation not happening.
Also make sure you are deploying the web service to its own web site that does not already run SharePoint. If you want the web service to run on the same web site as SharePoint read Creating a Custom Web Service.
You can check what application pool identity SharePoint is using by following the same instructions that Hadi writes, but for an app pool running SharePoint. Make sure to only change the application pool used by your web service and not SharePoint or else other permission errors could occur within SP. (There should be no reason but if you are interested in changing the app pool identity used by SharePoint follow these instructions.)
On solution would be to "impersonate" as the SharePoint System account using the following code:
SPSecurity.RunWithElevatedPrivileges(delegate()
{
// also dispose SPSite
using (SPSite siteCollection = new SPSite("http://localhost:89"))
{
using (SPWeb web = siteCollection.OpenWeb())
{
// ...
}
}
});