External providers / frameworks on Weblogic

Question

Hi everyone! I'm studying about how to use WS-Security with the Weblogic App server 11gR1 by reading it's online documentation. As I've seen Weblogic has it's own implementation stack of this standard including proprietary annotations and APIs. Since I'm trying to make my application the more App server agnostic as possible I've been looking for other options to enable WS-Security. One of these I found to be a viable option was the CXF framework which has as WSS4J implementation. I'm considering CXF a better option because all the WS-Security configuration including keystore locations, actions to take (sign, encrypt, timestamp, etc) can be configured declaratively in an external configuration file. As far as I've seen through the online documentation at http://download.oracle.com/docs/cd/E12839_01/web.1111/e13713/message.htm the Weblogic implementation involves lot of API usage which would lock my application. My application can be sold to different constumers which might use different application servers and infrastructure, that's the reason of my concerns. So I would like to know what do you guys think about using external frameworks in general (CXF and others) instead of some Weblogic native stack. My main concern is maybe loosing some of the weblogic administration features (because it probably won't manage an unknown stack). Sorry if I said something wrong, I'm still learning.
Thank you !

Answer 1

What you described is correct. As of today, it is not easy to build a portable JAX-WS applications if you need to use WS-* in general for the reasons you listed. Primarily there is no standard way yet to enable QoS policies such as security, RM, etc., and whichever stack you choose, you'll end up depending upon prietary programming/deployment model.
Adopting (portable) open source WS framework might be something viable, but again, as you pointed it out, it has its own disadvantages. Typically, including CXF, if you choose any portable WS framework, you cannot take advantage of management/monotoring capability which is important from the operational standpoint. In addition, you need to keep in mind that you cannot have a tight integration with native security realm configuration in case of WS Security. In other words, you cannot use WLS security configuration such as Authenticator/Identity Asserter etc.--at least OOTB-- when running CXF/Metro/Axis/... on WLS, and this is the case for other application servers as well. This can be unacceptable in many enterprise environments where you'd like to have a single security realm for all the applications including your WS.
With that said, there is no one-size-fits-all answer to your question. You'll need to closely examine your requirements and understand the technical/business implications of the decision you're making.
Regards,
Pyounguk