Web service authentication/session management using Axis2

I'm creating a web service using Axis2 where the client will need to login to the service and maintain a session. I'm trying to figure out a good way to do this. I've read the article on the following link:
http://www.developer.com/services/article.php/3620661/Axis2-Session-Management.htm
and it describes 4 main ways of doing this: Request Session Scope, Soap session scope, Transport session scope, and Application scope. However, it doesn't give much detail in actually implementing this. It says to add a parameter to services.xml like this:
<service name="foo" scope=" transportsession">
</service>
but what about the actual code that goes in the server and client to actually handle the login process and verify the username/password in an SQL database on the server? I'm having a lot of trouble finding a good tuturial on this. Can anyone point me in the right direction? I'm also open to other ideas that don't necessarily directly involve Axis2.

Session management for a web service and already answered. Locking.

Similar Messages

Web Service Stateless Session request using JDeveloepr 11g (JAX-RPC)

I have been trying to consume web Service by sending Stateless Session request to the system.
I generated the Java Proxy using JDeveloepr 11g, using JAX-RPC.
As it is Stateless I need to add following SOAP Header for authentication
<soap:Header>
<wsse:Security soap:mustUnderstand="1">
<wsse:UsernameToken>
<wsse:Username>[email protected]</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wssusername-
token-profile-1.0#PasswordText">adminOnDemand</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</soap:Header>
To do this I tried clientuntcredentialprovider as suggested by most of the post online, but found of little help as the server complained of not be able to find the User Name and Password.
To add to the mess problem I hit was I was not able to View the SOAP Request or Response sent by JDeveloper hence not helping me in debugging the same
I have tried it on XML SPY by manually adding SOAP Header to the SOAP request and was able to find the response, but I have not been able to do the same using the JDeveloper 11g IDE.
I have tried HTTP Analyzer assuming it might help, but unfortunately due to the huge size of WSDL, tool hanged my PC each time I loaded it.
I know it should be fairly straight forward but just feel like missing something.
Has anybody has got this thing working ?
Regards,
Deepak

What exactly you mean that since your request is stateless you must send a Username token?
Also, can you put here the code you used to populate the UNT.
Finally, if possible, can you zip and email your wsdl, the http analyzer should be able to handle wsdls, even if they are huge.
Thanks,
Vishal

Web Services and session management

Hello,
I am building an application using tomcat and axis2 for ws support. Is there any (standard, preferably) way to maintain session information accross multiple soap invocations? Or maybe even manage the sessions by myself "logically" and send something like a header identifying the session key with each request?
Any comments would be appreciated,
Thx

Hi
Axis2 offers two ways of doing session management. The first way uses a cookie. You need to specify scope="transportsession" in your services.xml, and ensure that cookies are enabled.
The second way is not dependent on HTTP cookies, but uses WS-Addressing headers instead. It is scope="soapsession". If you use the Axis2 client then you can do this very simply use setManageSession(true) on your ServiceClient.
e.g. stub._getServiceClient.setManageSession(true);
If you use another client, you will need to get the header from the response message and add it to future requests yourself.
Can I suggest you move this discussion to [email protected] where all the axis2 experts hang out?
Paul

Plugin based Web Service with session management

I am trying to make a web service in java with jax-ws that should support extensions to the service without rebuilding the project. I thought it might be possible to make a standard web service and the let each plugin create their own service, making the client side plugin point to both the standard service and the plugin specific one. This way I could have user management and such in the standard service and the more plugin specific one in an other service. The problem is though, how do I make a common session for all the services? All services are running at the same server and on the same domain name.
I checked the HTTP headers and found out that the JSESSIONID was changing when I created a new port on the client side. I was trying to implement a SOAPHandler to edit the cookie in the HTTP header, hoping that this will lead to the same session across the services. But found it hard. It was no problem reading the "Set-cookie" header, setting the cookie on the new requests was harder, as the CookieJar object seems to be internal [1]. And the MessageContext.HTTP_REQUEST_HEADERS wasn't created at the time my handlers run. Is there an easy solution to this?
I am not sure if my idea is a good solution to the main problem, and all other ideas are more than welcome. I hope it is possible to extend the features of my server without rebuilding the project. If anything is unclear, feel free to ask :)
[1] com.sun.xml.internal.ws.client.http.CookieJar

Adhir_Mehta wrote:
Could you explain plug in scenario with one example?Ok. We have not chosen exactly how to do this, but the idea is that someone may be able to extend the functionality of our server without rebuilding the project. We thought of something like a jar file with a implementation of some abstract classes. It should at least only be necessary to redeploy the project into the web container. The problem is; how do we let the plugins extend our web interface? One solution we thought of was to let each plugin have it's own service and dynamicly link to the plugin services from the main service that we provide as standard in our server. This way we may have some kind of plugin support on the clients as well, making the client side plugins know what kind of service it needs on the server side and thus extending the functionality all together.
Hope that explains our scenario. Feel free to comment and add new ideas :)
Regarding session management, its not advisable to manage the session in web services since that way it will become non interoperable.The documentation we found regarding sessions and jax-ws was all doing sessions with HTTPSessions, and to let the web container handle that.
On the server side
    @Resource
    private WebServiceContext wsContext;
    private HttpSession getSession() {
        MessageContext mc = wsContext.getMessageContext();
        return ((javax.servlet.http.HttpServletRequest)mc.get(MessageContext.SERVLET_REQUEST)).getSession();
    HttpSession session = getSession();
    session.setAttribute("User", user);On the client side
((BindingProvider)port).getRequestContext().put(BindingProvider.SESSION_MAINTAIN_PROPERTY,true);Do you have other standard options for us on how to do session management? All ideas are more than welcome

SOAP Web Service Authentication configuration

Hello,
I've got a little problem with Web Service authentication configuration.
I'm working on the SAP NetWeaver CE EHP1 7.11. I also have a XMII application deployed on the server and there are some SOAP Web Services(over XMII Transactions) that require basic authentication.
I use all Web Services in the EJB layer. So, I've generated proxy using SAP NetWeaver as a Web Service Runtime for generation. And Iuse an injection mechanism to get a service implementation:
@WebServiceRef(name="GetBatchListService")
private XacuteWS batchListWS;
In this case I could use Single Service Administration application in the NetWeaver Administrator@SOA Management@Application and Scenario Communication to configure basic authentication for EVERY Web Service. And this configuration disappears after every redeploy.
The question is how and where could I configure authentication for all web services?
I've read a lot of documentation, but, unfortunately, I haven't found needed one. I could see 2 direction of searching now, it might help:
1) Destination: Configure HTTP Destination or Web Service Template Destination and use it in all Web Services proxies somehow.
2) Find Configuration way: Create a configuration group or anything else to configure all services from one screen.
Best Regards,
Dmitry

Dimtris,
If your WSDL url is pointing to the URL of the Adapter Engine as shownin the Hot to Use the SOAP adapter there is no option. You cannot add it to the SOAP Url.
But, if you change the SOAP Url to the Url shown in this blog by Stefan Grube then you can add the user id and pasword to the url by adding sap- user=userid and sap-password = password.
The optin shown ion the blog by Grube can be used as long as you do not have to use SOAP attachments and in this case you would not need both sender SOAP adapter and a sender agreement.
/people/stefan.grube/blog/2006/09/21/using-the-soap-inbound-channel-of-the-integration-engine
Regards
Bhavesh
Regards
Bhavesh

What is the difference between Session timeout and Short Session timeout Under Excel Service Application -- session management?

Under Excel Service Application --> session management; what is the difference between Session timeout and Short Session timeout?

Any call made from the API will automatically be set to the “Session Timeout” period, no matter
what. Calls made from EWA (Excel Web Access) will get the “Short Session Timeout” period assigned to it initially.
Short Session Timeout and Session Timeout in Excel Services
Short Session Timeout and Session Timeout in Excel Services - Part 2
Sessions and session time-outs in Excel Services
above links are from old version but still applies to all.
Please remember to mark your question as answered &Vote helpful,if this solves/helps your problem. ****************************************************************************************** Thanks -WS MCITP(SharePoint 2010, 2013) Blog: http://wscheema.com/blog

SWA: Web Services call with attachment using 10.1.3 preview?

Has anyone managed to figure out how to invoke a web service with an attachment (using SWA, SOAP with Attachments) with the new 10.1.3 preview release?
Or are there any samples/documents that can point me in the right direction on how to do this?
Thanks!
....Andrzej

Finally got 10.1.3 installed, and sure enough, there is an example for the use of SWA (SOAP with Attachments), both as client and as server.
But the notes say it won't run with Oracle Lite DB. Makes me wonder why?
Kinda sucks, since that is what we're using for our proof of concept. <sigh>

X.509 Web Service Authentication for ABAP AS Web Service Interaction

We are trying to use X.509 web service authentication with SAP Web AS ABAP between 2 different SAP installations. Company 1 is trying to consume a web service set up by Company 2.
Company 1 has installed Company 2's public key, generated the client proxy using Company 2's WSDL and created a corresponding lpconfig entry.
Then company 2 has set up the profile parameter ICM/HTTPS/verify_client to accept certificates and imported Company 1's SLL client certificate and mapped the user in USREXTID. Note that Company 1 uses self-signed certificates, so it does not have a root certificate, which is what the documentation says should be imported into the PSE instead of the SSL client certificate.
When Company 1 tries the web service call, it receives a request to authenticate the web service from Company 2. (basic authentication logon screen, even though the web service configuration is set to X.509 Client Certificate.
Should this work or is there a problem because Company 1 uses self-signed certificates or is there something else we are missing?

>
Connie Begovich wrote:
> We are trying to use X.509 web service authentication with SAP Web AS ABAP between 2 different SAP installations. Company 1 is trying to consume a web service set up by Company 2.
>
> Company 1 has installed Company 2's public key, generated the client proxy using Company 2's WSDL and created a corresponding lpconfig entry.
>
> Then company 2 has set up the profile parameter ICM/HTTPS/verify_client to accept certificates and imported Company 1's SLL client certificate and mapped the user in USREXTID. Note that Company 1 uses self-signed certificates, so it does not have a root certificate, which is what the documentation says should be imported into the PSE instead of the SSL client certificate.
>
> When Company 1 tries the web service call, it receives a request to authenticate the web service from Company 2. (basic authentication logon screen, even though the web service configuration is set to X.509 Client Certificate.
>
> Should this work or is there a problem because Company 1 uses self-signed certificates or is there something else we are missing?
I think that the problem is in Service Authentication (in transaction sicf). You have to consume web-service, transmitting user-password for access.

Does WL70 Web Service Support Sessions?

Does anybody know how to make WL70 Web Service support sessions?
The "javax.xml.rpc.session.maintain" property on Stub does not seem to work.
Without session support, it is almost no use for us because we have to authenticate
the user each time.
Thanks in advance.
- Hao

It is just not working for me. I am using static stub.
After tracking the HTTP traffic, I found that the WL70 server is not issuing any
cookie. I have configured all the parameters for tracking session in the web application,
but I still don't see any cookie in the HTTP headers from the server. I also tried
to invoke the service using a browser, still no cookie seen. Is this a bug or
there is some other configuration for the server?
- Hao
"manoj cheenath" <[email protected]> wrote:
By default client will maintain the session. You dont have to set this
property.
Are you using static or dyn client?
Also, you should use the same instance of the stub for all your invokes
(all invokes to be in the same session).
regards,
-manoj
"Hao Chen" <[email protected]> wrote in message
news:[email protected]..
It is not working for me.
When I set the "javax.xml.rpc.session.maintain" property, weblogicthrows
"UnsupportedOperation"
exception and be default I don't see any session information beingpassed.
How do I configure the client side or even the server?
Thanks.
- Hao
"manoj cheenath" <[email protected]> wrote:
WL70 client does support http session. Is this not
working for you?
regards,
-manoj
"Hao Chen" <[email protected]> wrote in message
news:3d6402ac$[email protected]..
Does anybody know how to make WL70 Web Service support sessions?
The "javax.xml.rpc.session.maintain" property on Stub does not seemto
work.
Without session support, it is almost no use for us because we haveto
authenticate
the user each time.
Thanks in advance.
- Hao

Error while calling .svc web service from pl/sql using utl_dbws

Hello Folks,
I am calling a .svc web service from pl/sql using utl_dbws and encountering the following error
javax.xml.rpc.soap.SOAPFaultException: The message with Action '' cannot be processed at the receiver, due to a ContractFilter mismatch at the EndpointDispatcher. This may be because of either a contract mismatch (mismatched Actions between sender and receiver) or a binding/security mismatch between the sender and the receiver. Check that sender and receiver have the same contract and the same binding (including security requirements, e.g. Message, Transport, None).
Can you help me find what am I doing wrong?
Thanks
Rk

Hi,
Here are the details
1. What version?
Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - 64bi
PL/SQL Release 10.2.0.4.0 - Production
CORE 10.2.0.4.0 Production
TNS for 64-bit Windows: Version 10.2.0.4.0 - Production
NLSRTL Version 10.2.0.4.0 - Production
2. What error message ... we need the full and complete error stack not your interpretation of it.
ORA-29532: Java call terminated by uncaught Java exception: javax.xml.rpc.soap.SOAPFaultException: The message with Action '' cannot be processed at the receiver, due to a ContractFilter mismatch at the EndpointDispatcher. This may be because of either a contract mismatch (mismatched Actions between sender and receiver) or a binding/security mismatch between the sender and the receiver. Check that sender and receiver have the same contract and the same binding (including security requirements, e.g. Messag
3. "I am calling means what?" We need the full and complete statement showing the values of all parameters.
The input to the web-service is a xmltype containing address information and the web-service returns a string
CREATE OR REPLACE FUNCTION get_id
RETURN VARCHAR2
AS
l_service UTL_DBWS.service;
l_call UTL_DBWS.CALL;
l_wsdl_url VARCHAR2 (32767);
l_namespace VARCHAR2 (32767);
l_service_qname UTL_DBWS.qname;
l_port_qname UTL_DBWS.qname;
l_operation_qname UTL_DBWS.qname;
l_xmltype_in SYS.XMLTYPE;
l_xmltype_out SYS.XMLTYPE;
l_return VARCHAR2 (32767);
BEGIN
l_wsdl_url := 'http://test.com/test.svc?wsdl';
l_namespace := 'http://test.org/';
l_service_qname := UTL_DBWS.to_qname (l_namespace, 'SName');
l_port_qname := UTL_DBWS.to_qname (l_namespace, 'BasicHttpBinding_ISName');
l_operation_qname := UTL_DBWS.to_qname (l_namespace, 'Iden');
l_service :=
UTL_DBWS.create_service
(wsdl_document_location => urifactory.geturi
(l_wsdl_url),
service_name => l_service_qname
l_call :=
UTL_DBWS.create_call (service_handle => l_service,
port_name => l_port_qname,
operation_name => l_operation_qname
l_xmltype_in :=
SYS.XMLTYPE
('<IdenRequest xmlns:i="http://www.w3.org/XMLSchema-instance" xmlns="http://test.org/SNameIden.WCFService">
<address />
<zip>12345</zip>
<state>AA</state>
<street>W Test </street>
</address>
</IdenRequest>'
l_xmltype_out :=
UTL_DBWS.invoke (call_handle => l_call,
request => l_xmltype_in);
UTL_DBWS.release_call (call_handle => l_call);
UTL_DBWS.release_service (service_handle => l_service);
l_return := l_xmltype_out.EXTRACT ('//Iden/text()').getstringval();
RETURN l_return;
END;
/

Invoke Web Service in 9i database using UTL_HTTP

I am trying to explore Oracle's UTL_HTTP package to invoke external web service without having to use java stored procedure. I downloaded a demo scripts from OTN web site (http://www.oracle.com/technology/tech/webservices/htdocs/samples/dbwebservice/DBWebServices_PLSQL.html) and bumped into problems when invoking it.
select * from book_quote
ERROR at line 1:
ORA-29273: HTTP request failed
ORA-06512: at "SYS.UTL_HTTP", line 1022
ORA-12545: Connect failed because target host or object does not exist
ORA-06512: at "APPS.DEMO_SOAP", line 71
ORA-06512: at "APPS.BOOK_SERVICE", line 13
I checked the wsdl at the given website and it's valid. Is the database machine unable to connect to the internet? If so how can I enable it?
Can anyone help?
Thanks,
Tom

Hi,
You need to use Adaptive Web Service Model for that.
Check the tuorial in the link for accessing web services.
https://www.sdn.sap.com/irj/sdn/webdynpro?rid=/library/uuid/49f2ea90-0201-0010-ce8e-de18b94aee2d#16
Regards
Pankaj

A user that consumes a Web service is authorized to use then in BackEnd?

Hello,
I need to help me please
Can you validate that a user that consumes a Web service is authorized to use this service?.
I mean, I have a backend system, which has an RFC, which we published in PI as Web Services, and a third application consumes it with SOAP Adapter. How I can check that the user is consuming the service is authorized (role / profile) in the backend to run this service?
I searched SAML, but I will not check certificates, I need to check that the user is authorized in the backend, do I need IDM?
Thanks in advance.

Hello,
Please go to back end system and see the authorization profile of the user consuming the service. He must have SOAP Run time aurhorization for object S_SERVICE for the specific service. Also, the user needs application authorization for the underlying RFC call.
Thanks,
Venu

What web service & xml will be used for deleting the packged epub/pdf file from Admin Console

What web service & xml will be used for deleting the packged epub/pdf file from Admin Console?
I am able to delete the files from Admin console directy but not able to get which web service is calling on deleting the file from admin console:
Mangal

Hi Jim,
I tired following web service and xml to delete the packaged ebook but it is giving me error instead of response:
Web Service & XML
http://myserver_url/admin/ManageResourceKey
<request action="delete" auth="builtin" xmlns="http://ns.adobe.com/adept">
<nonce>" . $nonce . "</nonce>
<expiration>'. $expiration .'</expiration>
<resourceKey>
<resource>resource_id</resource>
<resourceItem>1</resourceItem>
</resourceKey>
</request>
Error Message
<error xmlns="http://ns.adobe.com/adept"
data="E_ADEPT_DATABASE http://myserver_url/admin/ManageResourceKey
Cannot%20delete%20or%20update%20a%20parent%20row:%20a%20foreign%20key%20constraint%20fails %20(`adept`.`distributionrights`,%20CONSTRAINT%20`distributionrights_ibfk_2`%20FOREIGN%20K EY%20(`resourceid`)%20REFERENCES%20`resourcekey`%20(`resourceid`))"/>
Magal Varshney

Web service in SOlution Manager

Hi¡¡¡
Someone knows how to configurate the web service in solution manager???
thanks!!!

Aris´ "administration_guide_aris_s.pdf"
Chapter 7.1.2.1.3 How to Activate Web Services
Markus

How to deploy and debug java web service in eclipes or using any other soft

Hai,
can any one tell me how to deploy and debug java web service in eclipes or using any other software.
i have used tomcat web server and jdk1.4.0 to develop web service.
we have used web service to interact with MS outlook .
bye
sudhakar.m

Hi Sudhakar,
If you are used to working with ant then you can very well use eclipse to deploy your web service.
You would usually have the ant script in the source root working directory. From eclipse if you select the build file from the navigator view and right click you will see a run ant option in the pop up menu.
Select that option and you would be able to see each targets with a checkbox select option. So define each target maybe one for wsdl2java conversion, one for compilation and one for deploying your web services. You can either make all of them run by having depends option on or you can run them individually as it takes your fancy.
I am not sure about debugging a web service yet.
Hope this helps
Aviroop
The truth is out there? Does anyone know the URL?

Web service authentication/session management using Axis2

Similar Messages

Maybe you are looking for