Avoid using Username and password in SOAP Envelope

Hi Team
I am working on calling the sercured web-service from PLSQL and able to call it successfully and get the response.
In the SOAP envelope, I have header and body.
Header contains the WS Security which includes username and password to authenticate the web-service and body contains the actual input pay load for service.
Currently, header has username and password as 'hard-coded', is there a way to avoid the usage of username and password.
We already tried to SIF for EBS methodology where in following steps are done:
1) Create and event in EBS.
2) Pass the event along with payload to SOA.
3) SOA receives the event and triggers web-service and gets the response.
4) Pass the response to EBS.
This technique does avoid usage of username and password but takes 20 seconds to do the job. However, the appraoch above takes hardly 1 second.
Please let me know in case any one has any idea on how to avoid credentials usage in SOAP envelope.
Thanks
Mirza Tanzeel

How about doing away with that approach entirely?
Password authentication requires one to keep a secret, secret. And that is the primary problem as how does one safely guard the secret, and manage the secret (by regularly changing)?
Relying on secrets is a problem. I have never been a fan of password based security.
Instead:
a) use HTTPS to secure communication between sender and receiver
b) use robust firewall rules to ensure that only sender is allowed to communicate with receiver
c) implement sound network management and exception reporting (to detect and prevent violations on network infrastructure level)
If you lack in the network infrastructure and administration areas, then:
a) make the web service endpoint on server on localhost only (do not expose it to the outside world)
b) establish a trusted ssh connection between sender and receiver using strongly encrypted RSA/DSA keys
c) configure sender with a service that opens a reverse tunnel to target, exposing the web service as a local port on its localhost

Similar Messages

Calling A Secured webservice using Username and password in the Soap header

I want to call a secured webservice.
The Username and password should be sent with the payload in the SOAP Header
as
<wsse:Security S:mustunderstand="0" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken wsu:Id="SecurityToken-XXXXXXXXXXXXXXXXXXXXXXXXX" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:Username>uname</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">pwd</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
Can you please send me the steps?
I tried with giving the username and password under Service Account.
I tried to create a wspolicy under business service. But nothing works...
Please help me at the earliest.
Also please give me steps in sequence.

Now i made sure that the endpoint is available!
Now am getting this error:
<soapenv:Fault>
<faultcode>soapenv:Server</faultcode>
<faultstring>BEA-380002: localhost1</faultstring>
<detail>
<con:fault xmlns:con="http://www.bea.com/wli/sb/context">
<con:errorCode>BEA-380002</con:errorCode>
<con:reason>localhost1</con:reason>
<con:location>
<con:node>RouteNode1</con:node>
<con:path>request-pipeline</con:path>
</con:location>
</con:fault>
</detail>
</soapenv:Fault>
Also in the invocation trace i can observe the following things:
Under Invocation Trace:-
========================
     Receiving request =====> Initial Message context
     ===============================================
     under added header:-
     ==================
     <soap:Header xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
     </soap:Header>
     under RouteNode1
================
     Route to "TargetMyService_BS"
$header (request):-
<soap:Header xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
</soap:Header>
Under Message Context changes:-
*===============================*
I can find this element also:-
con:security>
*<con:doOutboundWss>false</con:doOutboundWss>*
*</con:security>*
eventhough we enabled ws security, how the above tag can be false?
I think its getting failed to populate the header with the required login credentials.
The other doubt i have is:-
=================
I have chosen the service account type is static...is this right?

Username and password for SOAP sender call

Hello,
does anyone know how to provide the username and password to a SOAP sender call, e.g. XI receives the ws via soap and needs to know which userid and password to check. When you use a SOAP client they use basic authentication which sends the request first to XI and XI send a request back for password. This would work for an online app but not for ws from machine to machine. I read some docu about query strings but no where it has an example what to put either on the request URL, the adapter or the SOAP envelope. SOAP 1.1 seems to have left that open and IBM has an example using SOAP Header which did not work with XI.
Thanks
Stefan

Hi,
do you use the javax.xml.rpc.Call class? Because then
you can supply username and password to the call via
the addParameter method. I think I did that with XI 3.0
and it worked. If you need more information please consult
the javax.xml.rpc.Call javadoc.
Best regards,
Hermann

OSB Authentication using username and password (plaintext or digest)

Hi,
I want to implement a simple osb authentication using username/password (plain text or digest) , so that client required to provide username password token in soap header (message Level security) to access our webservices. I have read some of articles which shows how to create custom ws policy, but received following error during deployment.
weblogic.wsee.ws.init.WsDeploymentException: The WebLogic Server 9.x-style policy is not supported in JAX-WS web services
Please note - I can not install OWSM as part of my requirement
=======
<?xml version="1.0"?>

<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
xmlns:wssp="http://www.bea.com/wls90/security/policy"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
xmlns:wls="http://www.bea.com/wls90/security/policy/wsee#part">

<wssp:Identity>
<wssp:SupportedTokens>

<wssp:SecurityToken IncludeInMessage="true"
TokenType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#UsernameToken">
<wssp:UsePassword Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest"/>
</wssp:SecurityToken>
</wssp:SupportedTokens>
</wssp:Identity>
</wsp:Policy>

You can use the default Auth.xml WS policy in OSB and be able implement the authentication using username and plain text password.
Just assign the Auth.xml on the Request Policies of the Proxy Service (under Policies).
Then use any user credentials that has access to the domain for testing.
If you want to restrict access for each operation then in the Security tab, under Message Access Control, specify a Role.
Then in the OSB > Security Configuration, create the appropriate role with the specific role conditions like User is User1 or User is User2 etc ...
Hope this helps.
Thanks,
Patrick

OSB 11g - Authentication - Username and password in SOAP body

Hi,
I have a PS based on the WSDL provided by the client. According to the WSDL the client will send the username and password (to be used for authentication) in SOAP Body. I have extract the username and password from the body and authenticate it and then only process the data.
The approach I am thinking of is to create two PS. The first PS will be called by client to send the data. There will be no authentication required for this PS. Once this PS (PS-1) receives the message it will extract the username, password and data from the SOAP body. It will then set the username and password in the HTTP header of the second PS (PS-2) and the data in the SOAP body of PS-2.
PS-2 will be under basic authentication. PS-2 will accept the data as the only payload. Upon receiving the data it will do the normal processing.
But I do not see any way to set the HTTP header (Authorization) for the second PS. Is my approach correct? Is there another/better approach?
I went through this link [http://download.oracle.com/docs/cd/E13159_01/osb/docs10gr3/security/model.html] and found that we may have to configure another Authentication provider. How to do that?
Thanks,
Sanjay

Hi Sanjay,
Your approach seems correct to me (using two proxies) but instead of setting the username and password in HTTP header, you may set it as SOAP header and use Custom Authentication method in OSB. To know more about it, please refer -
http://download.oracle.com/docs/cd/E17904_01/doc.1111/e15866/message_level_cust_auth.htm#i1069719
Regards,
Anuj

How to configure JMS-Server to use username and password

Hi
Maybe this is a real stupid question, but please help me, I'm not very experienced using JMS:
I'm using JMS (provided by OC4J / Application Server 10.1.3). I configured a ConnectionFactory (without username and password) and a Queue and there is also a application, which successfully opens the JMS-Connections.
This works well as long as I do not provide a username und password in the ConnectionFactory (EnterpriseManager: OC4J/Admin/Services/JMS-provider...). If I do this, my application terminates with the following stacktrace:
javax.jms.JMSSecurityException: JMSServer[aplora2:12602]: failed to authenticate "myuser/mypassword", no such user.
     at com.evermind.server.jms.JMSUtils.make(JMSUtils.java:1034)
     at com.evermind.server.jms.JMSUtils.toJMSSecurityException(JMSUtils.java:1090)
     at com.evermind.server.jms.JMSServer.getJMSServer(JMSServer.java:1237)
     at com.evermind.server.jms.JMSServer.getJMSServer(JMSServer.java:1213)
     at com.evermind.server.jms.InContainerProxy.getJMSServer(InContainerProxy.java:93)
     at com.evermind.server.jms.EvermindConnection.<init>(EvermindConnection.java:103)
     at com.evermind.server.jms.EvermindQueueConnection.<init>(EvermindQueueConnection.java:62)
     at com.evermind.server.jms.EvermindQueueConnectionFactory.unprivileged_createQueueConnection(EvermindQueueConnectionFactory.java:98)
     at com.evermind.server.jms.EvermindQueueConnectionFactory.access$000(EvermindQueueConnectionFactory.java:42)
     at com.evermind.server.jms.EvermindQueueConnectionFactory$1.execute(EvermindQueueConnectionFactory.java:78)
     at com.evermind.server.jms.InContainerProxy.doSecureOp(InContainerProxy.java:157)
     at com.evermind.server.jms.EvermindQueueConnectionFactory.createQueueConnection(EvermindQueueConnectionFactory.java:75)
     at com.evermind.server.jms.EvermindQueueConnectionFactory.createQueueConnection(EvermindQueueConnectionFactory.java:66)
     at sam.model.messages.MessageManager.<init>(MessageManager.java:74)
where "myuser" and "mypassword" are the username and password I entered in the ConnectionFactory. (My Application certainly uses the same username and password)
I expected, that by entering username and password here I would configure my Queue to be protected by them. But obviously there are some very basic things I didn't understand. Can anyone give me a hint, how I can protect the (OC4J-) JMS-Server or the Queue by username and password?
Thanks for your help
Frank Brandstetter

Hey Frank -
Assuming you've set up users in the "Security Manager" for your application, you can specify what JNDI resources they can "read" (and thus also connect to) via the orion-application.xml file. Look at the following snippet from the orion-application.xml file:
     <namespace-access>
<read-access>
<namespace-resource root="jms/firstQueue">
<security-role-mapping impliesAll="false" name="jmsSecurity">
<user name="scooter"/>
</security-role-mapping>
</namespace-resource>
</read-access>
<read-access>
<namespace-resource root="delme">
<security-role-mapping impliesAll="false" name="jmsSecurity">
<group name="messagingUsers"/>
</security-role-mapping>
</namespace-resource>
</read-access>
</namespace-access>
This would say that only the user "scooter" that you've set up would have access to the Queue whose JNDI name begins with jms/firstQueue. Anyone you've set up and added to a messagingUsers group would have access to any Queues whose JNDI name begins with "delme". (I'm honestly not sure what exactly this line does: <security-role-mapping impliesAll="false" name="jmsSecurity">)
This is the only way I've found to limit access to a particular Queue.
HTH.
Scott

Username and password through SOAP header

Hi Gurus
I am developing web service model in webdynpro by consuming third-party WSDL. This third party web service expecting me to send the user name &password through SOAP header.
Can any body tell me how to pass the username password through SOAP header using webdynpro model?

Hi,
In WD there's no direct way to access the SOAP message header. If the web service defines implicit headers in JAX-RPC then you have to use the setProperty methods of the javax.xml.rpc.Stub interface so that the JAX-RPC handler can retrieve these via the getProperty methods.
Regards,
Satyajit.

Using username and password used in UME

Hi
    i have used UME to authenticate the user and now i want to do as follows.
    call a web service and if that logged in user has right to access that web service he will get the result else he will not.
   right now i have hard coded the a user to call the web service and every one who has logged in can see every thing i don't want such things now.
so please give me suggestion for this
Thanks in advance

Hi nk,
In case you are using WS-over-EJB you can try to implement something like described in this <a href="http://help.sap.com/saphelp_nw04/helpdata/en/21/f8424089ff2571e10000000a155106/frameset.htm">tutorial</a>.
If you need user cridentials, check
Get the current client-user password
Reading User Logon and Password on Web Dynpro Application
retrieving password.........
Best regards, Maksim Rashchynski.

Dynamic Username and password in SOAP reciever

Hi,
We have a requirement where we have to post the data to a webservice using SOAP reciever. However, the challenge is that we have multiple username/PWD and based on a field in source message, decide at the runtime, which Username/PWD to choose.
Please suggest how can we proceed.

Authentication Keys
If authentication is required for the receiver system, you can enter a password and a confirmation for each key value. This means that you do not need to write passwords in the enhanced message header.
If you want to specify or display authentication keys, select View Authorization Keys.
You can enter and confirm passwords for each authentication key value (TAuthKey or TproyxAuthKey).
http://help.sap.com/saphelp_nw04/helpdata/en/29/5bd93f130f9215e10000000a155106/content.htm
Add field inside SOAP header PI 7.1

Unable to log in Azure Linux VM using username and password

I tried creating a Linux VM (Cent OS based) using PowerShell. I was able to provision the VM, but when i tried to log in using the credentials in the VM using Putty, I get an error message stating "No supported authentication methods available
(server sent : publicKey).
Although when i create a VM through Azure portal using the same image i don't find any issues to login the VM. Please find below the PowerShell commands i used to provision Linux VM.
Option 1:
New-AzureQuickVM -Linux -ServiceName "customdatalinux" -Name "customdatalinux" -ImageName "0b11de9248dd4d87b1862
1318e037d37__RightImage-CentOS-7.0-x64-v14.2" -Password "******" -Location "East US" -LinuxUser "*****" -InstanceSize "ExtraSmall"
Option 2:
PS C:\> $vm1 = New-AzureVMConfig -Name "customdatalinux" -InstanceSize "ExtraSmall" -ImageName "0b11de9248dd4d87b18621318e037d37__RightImage-CentOS-7.0-x64-v14.2" | Add-AzureProvisioningConfig -Linux -LinuxUser "*****"
-Password "*****"
New-AzureVM -ServiceName "customdatalinux" -VMs $vm1
Option 3:
$vm1 = New-AzureVMConfig -Name "customdatalinux" -InstanceSize "ExtraSmall" -ImageName "0b11de9248dd4d87b1862131
8e037d37__RightImage-CentOS-7.0-x64-v14.2" | Add-AzureProvisioningConfig -Linux -LinuxUser "****" -Password "*****" | Set-AzureEndpoint -Name "SSH" -Protocol "TCP" -Loc
alPort "22" -PublicPort "22"
New-AzureVM -ServiceName "customdatalinux" -VMs $vm1
In the Azure portal i can see that there is an option to select credentials authentication alone, where i can enter the password and provision a VM. I try to do the same through PowerShell and VM gets provisioned, but am unable to log in the VM using those
credentials.
Can you please let me know how to resolve this issue?
Thanks,
Anish

Try this
azure vm create customdatalinux0b11de9248dd4d87b18621318e037d37__RightImage-CentOS-7.0-x64-v14.2 username password -l "West US"By default, linux VM on Azure has Port 22 opened so you don't have to configure those unless you want to change port. Also loose | and '' in commands.
Creating new VM creates new service unless you want to use one already created.
Mustafa Toroman

How to automlog into webside using username and password using java program

I am trying to log in to a website using password and username. What libraries i can use. I searched online and came to know that i can use Apache's commons HttpClient library to do that. I am new to this please let me know what can i use.
For starting purpose i wrote this code:
public static void main(String[] args) throws URIException {
     try {
          HttpClient client = new HttpClient();
          GetMethod method = new GetMethod("http://www.google.com");
               int returnCode = client.executeMethod(method);
               System.err.println(method.getResponseBodyAsString());
          method.releaseConnection();
          } catch (HttpException e) {
               e.printStackTrace();
          } catch (IOException e) {
               e.printStackTrace();
but this is giving me an error. please see below,
java.net.UnknownHostException: www.google.com
     at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
     at java.net.PlainSocketImpl.connect(Unknown Source)
     at java.net.SocksSocketImpl.connect(Unknown Source)
     at java.net.Socket.connect(Unknown Source)
     at java.net.Socket.connect(Unknown Source)
     at java.net.Socket.<init>(Unknown Source)
     at java.net.Socket.<init>(Unknown Source)
     at org.apache.commons.httpclient.protocol.DefaultProtocolSocketFactory.createSocket(DefaultProtocolSocketFactory.java:80)
     at org.apache.commons.httpclient.protocol.DefaultProtocolSocketFactory.createSocket(DefaultProtocolSocketFactory.java:122)
     at org.apache.commons.httpclient.HttpConnection.open(HttpConnection.java:707)
     at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:387)
     at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171)
     at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397)
     at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:323)
     at com.verizon.zoeott.ingest.PropertyFileReader.main(PropertyFileReader.java:48)
Another thing is that we use proxy to get internet connection. In internet explorer-->internet options-->LAN Settings-->using automatic configuration script to connect to the internet.
I don't know how to configure this into java program. please help.
Thanks,
amol
Edited by: 877846 on Jan 20, 2012 9:16 AM
Edited by: 877846 on Jan 20, 2012 9:21 AM

Also please let me know about how to connect internet through proxy server.As I said above, if you are using the Apache HTTP client, no we can't, as this is not an Apache forum. I also told you where to find that answer.
If on the other hand you don't want to use that client any more, setting the system properties http.proxyHost and http.proxyPort will do it for java.net.HttpURLConnection. See the Java Custom Networking tutorial for examples.

Username and password token retrieval from SOAP web services

We are implementing one JAX-WS Web services which requires to retrieve the username and password in SOAP header elements and use those for further use/processing.
When we are retrieving username/password it’s coming as null. Please help ...
if (Boolean.FALSE.equals(context.get(MessageContext.MESSAGE_OUTBOUND_PROPERTY))) {
try {
SOAPMessage sm = context.getMessage();
//SOAPEnvelope envelope = context.getMessage().getSOAPPart().getEnvelope();
SOAPEnvelope envelope = sm.getSOAPPart().getEnvelope();
SOAPHeader sh = envelope.getHeader();
System.out.println("Message: "+envelope);
System.out.println("Envelope: "+envelope);
System.out.println("Header: "+sh.toString());
Iterator it = sh.examineAllHeaderElements();
while(it.hasNext()){
System.out.println(it.next());
String username;
username = sh.getAttribute("Username");
// username = sh.getAttributeValue("Username");
//String password = sh.getAttribute("Password");
System.out.println("uid:"+username);
//System.out.println("pass: "+password);
context.put("Username", username);
//context.put("Passsword", password);
// default scope is HANDLER (i.e., not readable by SEI
// implementation)
context.setScope("Username", MessageContext.Scope.APPLICATION);

<S12:Envelope xmlns:S11="..." xmlns:wsse="..." xmlns:wsu= "...">
<S12:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:Username>TestUser</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">TestPassword</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</S12:Header>
</S12:Envelope>

How-to access username and password protected Java EE Web services from ADF

The title of this post is exactly the same as this article by Frank Nimphius:
http://www.oracle.com/technology/products/jdev/howtos/1013/protectedws/access_protected_web_services_from_adf.htm
The article addresses the problem of securing web services using usernames and passwords, when those web services are accessed through a proxy or a data control. In the examples, the user names and passwords are specified, whether in the code or the definition of data controls. (SKING/SKING).
In a very common scenario, users login to reach a page, for example, A.jspx, which contains a button that calls a web service, for example displayDate. Suppose that user has logged in by username/pass of (AHUNOLD/AHUNOLD) and AHUNOLD has access to the service and the page. Is there any way to pass the logged in user name and password to the webservice ? Of course we can hard-code the username in the data control definition or proxy code, but this is just one of the thousands of users who have access to the service and the authentication is not dynamic this way.
Hope my question is clear. Wishing you all a great Christmas.
Farbod

Hi Frank, and happy new year.
Are you implying that it couldn't be done declaratively? What is your suggestion for this problem? You know the problem... As I described:
- I need to secure my web services, so when exposed, no one from inside network or the internet, can access the web service without proper permission
- The web services are shown as web controls on jspx pages. The user has logged in before reaching the page. It is irrelevant to ask him to enter user name and password again.
- I have user names, passwords and roles in Oracle Internet Directory (Identity Management). It provides some APIs and I can retrieve the usernames and attempt logging in programmically. But how can I get username and password from the session in ADF application?
I guess using SAML or certificate could be the solution, but I have a problem with SAML, described here:
Re: Webservices Security, SAML, and Identity Management (OID)
Best Regards,
Farbod

Default username and password for Oracle EM

Hi all
I am running Oracle database server using the VM template 'Database App Development VM'. I have started the EM from the console and able to access it through browser. I used username and password as 'oracle'. But it is saying that 'user name or password are not valid'. Can you tell me what are the credentials to enter into the EM?
Thanks,
Ganesh

Based on my install on a VirtualBox under Ubuntu, it looks like it comes pre-configured. As the Database Instance is already there and started up without any issues.
However I don't see anything about installing or configuring EM.
Any hints on where to find documentation related to OEM and the "Database App Development VM" install would be greatly appreciated.
Joe

R12 application username and password

Hello:
I use username and password apps to access the database for R11i eBusiness Suite
But when I use the same username and password for R12 I can not access when I use apps.
Can you please help me to get the username and password for R12 eBusiness Suite to access the database?
Thank you
sem

While to set up OAM, the form server is not working
FRM 92101 There was a failure in the form seever during start up
One time it was working and now it is not
and how do I fix the error I have on the form server?- As applmgr user, source the Applications environment file
- Issue the following:
$ make -f ins_forms.mk install
Then How do I setup OAM to connect to the databaseFrom OAM, navigate to Site Map > Administration > System Configuration > Hosts > Register

Avoid using Username and password in SOAP Envelope

Similar Messages

Maybe you are looking for