I exposing EJB3.0 stateless session bean as web service using JAX-WS annotations and right now I'm using JBOSS5.1.0 GA as application server and JBOSSWS is generating the WSDL for me when I deploy the EAR.
Now I want to secure the web services by providing authentication and encryption-decryption on the SOAP messages. How do I can achieve that, Is there any annotations available for both in JAX-WS (or) can I achieve by doing any configuration at EJB level. I do not want to do secure web services with respect to JBOSS, because I want to deploy the same EAR in different application as well.
So please help me to build the generic EJB3.0 web services bean with the security implementation ., Thanks a lot in advance
Concerning SOAP WebServices, you can a lot of posts in this forum related to your question. In particular in User authenticate in SOAP I've mentioned that there several ways to authenticate the client.
Supposing that you want to authenticate the client by X.509 certificate. Then:
For JBossWS refer WS-SecurityOptions – X509 Certificate Token
For Metro/JAX-WS services refer Using JAX-WS-Based Web Services with SSL
For Apache CXF refer WS-Security
For Spring Security refer Spring Security With X.509 Certificate
Related
How can I secure a thrift service using Identity server and then authenticate a user using RemoteUserStoreManagerServiceStub. After authenticating a user i wish to use the given session id for corresponding access.
Thanks
Please note, only the EntitlementService of WSO2IS has been exposed using thrift. All others are exposed with as SOAP services. EntitlementService Thrift service is already secured with username/password. First you need to authenticate using thrift authenticator and call the EntitlementService Thrift service. You can find sample client code from here
I have a web service hosted in a JBoss AS. Add a app running on Google App Engine. Now I want to access my web service hosted in JBoss AS only by my App Engine app and I want to restrict others from accessing my web service. How can I do that? Please help.
Use the AppEngine URL Fetch Service to call your JBoss web services from your AppEngine app. Use the HTTPS option to secure the network connection. Furthermore create request headers and payload such as to satisfy whatever JBoss security requirements you can establish between JBoss and AppEngine (for example client user authentication).
I am trying to write a web service client using Jax-ws for a secured webservice hosted by a third party. While doing so, I am facing a lot of issues and somehow wanted to find out if the issue is with my client or the hosted web service.
Do we have any publicly available and free secure web services on the internet? I can find many non secure services.
Have a look at this URL:
http://www.webservicex.net/ws/wscatlist.aspx
... where you can find a bunch of published webservices.
I've been reading everywhere including here and here that WSO2 provided SOAP APIs for its services. My question is where are they? How can I locate them? For example, if there's a XACML API provided by WSO2, how can I find it.
What I understand about the WSO2 platform is that ESB, STS, DSS, IS are all services. To expose their functionalities, you have to write out standard XML, then import it into the WSO2 backend. After this, a WSDL is generated which can be used by a client. Am I right?
If not, then I have simple questions;
What is the endpoint or service url for all IS services?
What is the endpoint or service url for all ESB services?
What is the endpoint or service url for all STS services?
What is the endpoint or service url for all DSS services?
Thanks for explaining.
WSO2 uses Admin services and by default they are not exposed to outside and exposed over https.
You can view the list of services available by by referring this thread.
Another sample on using an Admin service is available here.
Sample developed to create proxy services using Proxy admin service is available here
Are there any special configuration settings you have to do to make a web service work with SSL?
Is there a way to force the service methods to authenticate using a username/password like I can do with a WCF service?
No. SSL support provided by web server (IIS).
Yes. Just configure authentication through web.config