How to secure a J2SE Web Service

Hi,
I have created a J2SE Web Service using JAX-WS and I now wish to secure it but I can't seem to work out how to do it in an automated manner.
I have used the simple Java-First method, writing an annotated java class and then running wsgen to generate the WSDL and required artifacts.
WSIT seems to be the solution, placing a WSIT config file in a META-INF directory on the classpath. However, in the examples that I have there seems to be a huge amount of overlap between the WSDL and the WSIT config file. Moreover, the content of the WSIT config seems to be dependent on the contents of the WSDL. This means that should I update the implementation class I would have to manually update the WSIT config (unlike the WSDL which would be autogenerated from the Java class).
Ideally I would like to create two files:
- myserviceImpl.java
- wsit-config.xml (using the correct naming convention)
Then run WSGEN and, hey presto, a full WSDL is generated complete ith security policy information. However, it seems that this is not the way it works.
I'd be grateful for any advice you can give on how to automate this process. My current idea is to generate the WSDL and then use an XSLT step in the build process to drag the WSIT config into the WSDL.
I'd also be interested in hearing how other people have created secure J2SE web services.
I am using Eclipse (not NetBeans) and Maven.
Thanks

I am using Eclipse (not NetBeans) and Maven.I hate doing this, but have you tried Netbeans? Metro has really tight integration with it and pretty much can do what you want. However, making a programmer change IDE is like suggesting someone to try another religion.

Similar Messages

How to get data from web service in ADF mobile

I'm new to ADF mobile application development. I'm currently blocked in a scenario. I have a web service(from third party) which needs <wsse:Security> to retrieve data. In soapUI, the web service will retrieve the response only when there is this security tag. Otherwise it will give response as invalid security. The web service looks like this:
        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xx="http://xmlns.oracle.com/apps/csf/soaprovider/plsql/xx_fs_mob_login/" xmlns:get="http://xmlns.oracle.com/apps/csf/soaprovider/plsql/xx_fs_mob_login/get_login/">
               <soapenv:Header>
                  <xx:SOAHeader>
                     
                     <xx:Responsibility>XXX</xx:Responsibility>
                     
                     <xx:RespApplication>XXX</xx:RespApplication>
                     
                     <xx:SecurityGroup>XXX</xx:SecurityGroup>
                     
                     <xx:NLSLanguage>XXX</xx:NLSLanguage>
                     
                     <xx:Org_Id>XXX</xx:Org_Id>
                  </xx:SOAHeader>
    <The portion which is excluded from the soap, but which is required for getting response>
    <wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
                     <wsse:UsernameToken wsu:Id="UsernameToken-1">
                        <wsse:Username>XXX</wsse:Username>
                        <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">XXX</wsse:Password>
                        <wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">XXX</wsse:Nonce>
                        <wsu:Created>2013-02-13T08:58:50.649Z</wsu:Created>
                     </wsse:UsernameToken>
                  </wsse:Security>
    <The portion which is excluded from the soap, but which is required for getting response>
               </soapenv:Header>
               <soapenv:Body>
                  <get:InputParameters>
                     
                     <get:P_USERNAME>XXX</get:P_USERNAME>
                  </get:InputParameters>
               </soapenv:Body>
            </soapenv:Envelope>
I tried the steps described in ADF mobile tutorial to get web service data. But I'm getting response code 500 from the server. I tried the steps for secured web service also. But I'm not sure which security policy has been implemented in the web service. I tried with oracle/wss_username_client_token_policy and some others but didn't succeed. Later I tried by creating web service client/proxy. But as Oracle ADF only supports java 1.4, I got errors in the generated code(errors on generics and annotation).
The WSDL for the web service is as follows:
    <definitions xmlns:tns="http://xmlns.oracle.com/apps/csf/soaprovider/plsql/xx_fs_mob_login/" xmlns="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:tns1="http://xmlns.oracle.com/apps/csf/soaprovider/plsql/xx_fs_mob_login/get_login/" name="XX_FS_MOB_LOGIN" targetNamespace="http://xmlns.oracle.com/apps/csf/soaprovider/plsql/xx_fs_mob_login/">
    <types>
    <schema xmlns="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" targetNamespace="http://xmlns.oracle.com/apps/csf/soaprovider/plsql/xx_fs_mob_login/get_login/">
    <include schemaLocation="http://27.251.157.211:8000/webservices/SOAProvider/plsql/xx_fs_mob_login/APPS_XX_FS_MOB_LOGIN_GET_LOGIN.xsd"/>
    </schema>
    <schema xmlns="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" targetNamespace="http://xmlns.oracle.com/apps/csf/soaprovider/plsql/xx_fs_mob_login/">
    <element name="SOAHeader">
    <complexType>
    <sequence>
    <element name="Responsibility" minOccurs="0" type="string"/>
    <element name="RespApplication" minOccurs="0" type="string"/>
    <element name="SecurityGroup" minOccurs="0" type="string"/>
    <element name="NLSLanguage" minOccurs="0" type="string"/>
    <element name="Org_Id" minOccurs="0" type="string"/>
    </sequence>
    </complexType>
    </element>
    </schema>
    </types>
    <message name="GET_LOGIN_Input_Msg">
    <part name="header" element="tns:SOAHeader"/>
    <part name="body" element="tns1:InputParameters"/>
    </message>
    <message name="GET_LOGIN_Output_Msg">
    <part name="body" element="tns1:OutputParameters"/>
    </message>
    <portType name="XX_FS_MOB_LOGIN_PortType">
    <operation name="GET_LOGIN">
    <input message="tns:GET_LOGIN_Input_Msg"/>
    <output message="tns:GET_LOGIN_Output_Msg"/>
    </operation>
    </portType>
    <binding name="XX_FS_MOB_LOGIN_Binding" type="tns:XX_FS_MOB_LOGIN_PortType">
    <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
    <operation name="GET_LOGIN">
    <soap:operation soapAction="http://XXX:8000/webservices/SOAProvider/plsql/xx_fs_mob_login/"/>
    <input>
    <soap:header message="tns:GET_LOGIN_Input_Msg" part="header" use="literal"/>
    <soap:body parts="body" use="literal"/>
    </input>
    <output>
    <soap:body use="literal"/>
    </output>
    </operation>
    </binding>
    <service name="XX_FS_MOB_LOGIN_Service">
    <port name="XX_FS_MOB_LOGIN_Port" binding="tns:XX_FS_MOB_LOGIN_Binding">
    <soap:address location="http://XXX:8000/webservices/SOAProvider/plsql/xx_fs_mob_login/"/>
    </port>
    </service>
    </definitions>
Please help me to figure out a solution for this.
Thanks in advance
Rino

how to store the data in the mobile which i fetched from the server using RMS. Can u give me a eg. code. here and send me a link to my email id. [email protected]
I am using Oravle10g as the database. It is installed in the server.
I made a connection in servlet using ODBC:JDBC.
I am able to see the data fetched from the server in my mobile.
Now, i am trying to save the data. But i dont know how to use the RMS to connect to the Oracle database or pass the string etc.
Do help me if you dont mind.
I kept reading and tried some codes but i failed.
Me still trying...........
Thanks in Advance.

Adding security to a web service then generating a proxy [SOLVED]

Hi
I generated a web service based on a very simple java program. I have deployed it to a local oc4j install and successfully called it from a proxy generated from jdev. I am using 10.1.3.3.0.
I added security to the web service and regenerated the proxy. I wanted to see the difference in the SOAP messages sent to the web service. However the proxy does not seem to have changed to take account of the new security settings on the web service.
The security options I set were:
On main security dialog: Ticked the port and "Text Password"
On Authentication: Ticked "Expect Username ti Authenticate"
"Password Required"
Password Type = "Plain Text"
"Nonce Required in Token"
"Creation Time Required in Token"
I have 2 questions:
1. How do I get the proxy to send SOAP messages that contain the security headers required to run the web service. Here is the main method from my proxy. I thought adding setUsername and setPassword would be the solution
    public static void main(String[] args) {
        try {
            gpn3.Getphonenum3SoapHttpPortClient myPort = new gpn3.Getphonenum3SoapHttpPortClient();
            System.out.println("calling " + myPort.getEndpoint());
            // Add your own code here
            myPort.setUsername("oc4jadmin");
            myPort.setPassword("welcome");
            myPort.getNum("Lisa");
        } catch (Exception ex) {
            ex.printStackTrace();
2. When the web service receives a user name and password what does it check them against? I assume the oc4jadmin user will be allowed access but how do I set up other users?
many thanks
paul schweiger
Message was edited by:
[email protected]

I have figured this out now
1. I needed to set the same security settings in my proxy as I did for my web service. I had assumed that the proxy would generate the necessary security settings from the web service.
2. For some reason my web service application is using the system level jazn-data xml file
oc4j_extended_101330/j2ee/home/config/system-jazn-data.xml
This does include the oc4jadmin user and I am now able to use that account to call the web service. I also managed to add another user and use that account to call the web service successfully.
Thanks for the help
paul

Does J2SE web service consumer need weblogic as agent?

Since OWSM 11g, agent is part of weblogic server. so, does this mean for a J2SE web service consumer, I need to install weblogic for it to let it work with OWSM agent? if so, what configuration needed for J2SE web service consumer to work with weblogic ?

I got the following error.
But If I call it from a jsp page or a servlet. Nothing happend, Transaction is successful.
java.lang.NullPointerException
     at org.apache.commons.discovery.resource.ClassLoaders.getAppLoaders(ClassLoaders.java:206)
     at org.apache.axis.AxisProperties.getClassLoaders(AxisProperties.java:118)
     at org.apache.axis.AxisProperties.getNameDiscoverer(AxisProperties.java:105)
     at org.apache.axis.AxisProperties.getResourceClassIterator(AxisProperties.java:112)
     at org.apache.axis.configuration.EngineConfigurationFactoryFinder$1.run(EngineConfigurationFactoryFinder.java:116)
     at java.security.AccessController.doPrivileged(Native Method)
     at org.apache.axis.configuration.EngineConfigurationFactoryFinder.newFactory(EngineConfigurationFactoryFinder.java:113)
     at org.apache.axis.configuration.EngineConfigurationFactoryFinder.newFactory(EngineConfigurationFactoryFinder.java:160)
     at org.apache.axis.client.Service.getEngineConfiguration(Service.java:813)
     at org.apache.axis.client.Service.getAxisClient(Service.java:104)
     at org.apache.axis.client.Service.<init>(Service.java:113)
     at org.tempuri.wsdl.EFSnet2Locator.<init>(EFSnet2Locator.java:10)
     at com.ipharmacy.payment.Payment.main(Payment.java:12)

How to expose a SOAP web service from HCP

Hello All,
Currently I am trying to create a SOAP web service within a HCP Java application to allow backend systems to consume data stored in HCP.
This is the planned scenario:
1. Create data in HCP - therefor I am using JPA and a oData Model.
2. Backend uses web service to consume data from HCP - with this point I do have some problems.. I do want to create a SOAP web service in order to achieve this.
Is there an easy way to create a SOAP web service in HCP? There are many tutorials in the internet of how to create a SOAP web service in 20 sec´s, but non of these helped me. I do was able to consume a SOAP web service in HCP coming from the ByD, but the other way around seems pretty complicated...
Can I make use of the Eclipse functions to create a web service? (New --> Other... --> Web Services --> Web Service and than choose the Button up Java bean Web Service type)
Have any of you some coding snippets that would probably help me out?
I have unsuccessfully tried to use the @WebService, @SOAPBinding, @WebMethod notation in my java classes...
Thank you,
Swen

Hello Nedelcho,
Yes. All the required jar files are in the lib directory.
Currently I am able to create a web service locally.
But when I deploy that to the cloud server my JPA service is not working any more.
Receiving the following error message:
<?xml version='1.0' encoding='UTF-8'?><error xmlns="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata"><code/><message xml:lang="en">javax.naming.NamingException: Error while attempting to resolve reference [Root exception is javax.naming.NamingException: Cannot create resource object instance due to exception in the object factory [Root exception is javax.naming.NamingException: Data source 'jdbc/DefaultDB' not available.]]</message></error>
The web.xml contains the following:
Any advice?
Best regards,
Swen

How do I invoke a web service?

I'm new to web services... and I have to find a way to connect to the microsoft reporting services web service....
But well I don't know how to connect to a web services...
Can someone direct me to a java tutorial about invoking web services?
Please? =)
Thanks,
Renato Fontes

Enter the string without the quote, then try to switch to the XML view and add the quotes. This should be a workaround for simple values.
You should also be able to generate a java client from JDeveloper in a few clicks, using the Wizard. As you can generate the JUnit template for the proxy (or stub), it's usually faster to re-run your test.
If this does not work for you, can you post the WSDL so we can see if there is any reason it does not work for you.
All the best,
-Eric

How can I call external web service from BPEL

1. I have "EmpService" webservice (simple webservice to get emp salary, not in BPEL domain) running in Oracle AS host1. If I want to call this web service from BPEL in another host2. How can I do this?
2. Is it a must to deploy this EmpService to Oracle BPEL domain in order to call it? If so, how can I deploy it. As many BPEL example tutorial demonstrate the "obant" command to deploy the BPEL process, but not show how to deploy a external web service not in BPEL project. Please help. ...

Create a partner link in BPEL and point it to the WSDL deployed on external server.
this thread will also help
Axis generated WS to Bpel WS

How can I create a web Service from my Web Dynpro Application ?

Hi,
Kindly let me know How I could create a "Web Service" with my Web Dynpro DC project.
Awaiting your responses.
Regards,
Mahesh

Hi Mahesh,
You can use the web services by creating the Model in web Dynpro
And if you want to publish your own web service then you have to create a EJB module and publish as a web service.
Thanks
Ninad

How to use WS-RM web Service from Session Bean?

Hi all.
Could you tell me the way how to call WS-RM web service(Staring BPM Process) from SessionBean?
Our environment: SAP NetWeaver CE 7.2 SP3
I do the following.
I have created a BPM Process starting with Message Start Event.
This Message Start Event was created by Service Interface(stateless and asynchronous) which was imported from ESR.
I deployed this into my server and it worked fine in webservice navigator as a WS-RM WebService.
But I can't call this webservice from SessionBean in EJBExplorer.
I get the following error message:
Caused by: This exception is wrapper of javax.xml.ws.soap.SOAPFaultException. com.sap.engine.services.webservices.espba
se.client.bindings.exceptions.SOAPFaultException: Invalid WS-RM message. There are no WS-RM headers within SOAP message.
at com.sap.engine.services.webservices.espbase.client.bindings.impl.JAXWSUtil.processFault(JAXWSUtil.java:412)
at com.sap.engine.services.webservices.espbase.client.bindings.impl.SOAPTransportBinding.call_SOAP(SOAPTransportBinding.java:1366)
at com.sap.engine.services.webservices.espbase.client.bindings.impl.SOAPTransportBinding.callWOLogging(SOAPTransportBinding.java:960)
at com.sap.engine.services.webservices.espbase.client.bindings.impl.SOAPTransportBinding.call(SOAPTransportBinding.java:915)
at com.sap.engine.services.webservices.espbase.client.jaxws.core.WSInvocationHandler.processTransportBindingCall(WSInvocationHandler.java:168)
at com.sap.engine.services.webservices.espbase.client.jaxws.core.WSInvocationHandler.invokeSEISyncMethod(WSInvocationHandler.java:121)
at com.sap.engine.services.webservices.espbase.client.jaxws.core.WSInvocationHandler.invokeSEIMethod(WSInvocationHandler.java:84)
at com.sap.engine.services.webservices.espbase.client.jaxws.core.WSInvocationHandler.invoke(WSInvocationHandler.java:65)
at $Proxy2753.zwsvCheckOrderdataMainprocessStart(Unknown Source)
at jp.co.ogis_ri.WSTestSessionBean.exeWS(WSTestSessionBean.java:81)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
I created this SessionBean as follows:
I created DCs for EJB and created SessionBean in EJB DC.
I imported a WSDL file(WS-RM web service) from Service Registory and
I created service clients and Service References.
After that I implemented SessionBean to call web service checking with this help.
http://help.sap.com/saphelp_nwce72/helpdata/en/44/4d2bb1c6b00597e10000000a155369/frameset.htm
After deploying this EJB,I configured properties in nwa.
Thanks
Yuichi

Yuichi
Did you manage to solve this? I'm doing something similar and seeing the same problem, although they're up to 7.3 SP7.
Any help greatly appreciated.
Lewis

Problems invoking a secure 8.1 web service from a 6.1 client

I'm trying to invoke a secure 8.1 web service from a 6.1 client application and keep getting rejected with the following message:
Security Violation: User: '<anonymous>' has insufficient permission to access EJB:
In the 6.1 client, I've established a WebServiceProxy and set the userName and password to the proper values, but I can't seem to get past the security.
If there something special I need to do on either the 8.1 securing side or on the 6.1 accessing side to make this work?
Any help would be GREATLY appreciated.

Hi Paul,
This sound familiar, but I cannot at the moment locate a reference to
the issue. I would encourage you to seek the help of our super support
team [1].
Regards,
Bruce
[1]
http://support.bea.com
[email protected]
Paul Merrigan wrote:
>
I'm trying to invoke a secure 8.1 web service from a 6.1 client application and keep getting rejected with the following message:
Security Violation: User: '<anonymous>' has insufficient permission to access EJB:
In the 6.1 client, I've established a WebServiceProxy and set the userName and password to the proper values, but I can't seem to get past the security.
If there something special I need to do on either the 8.1 securing side or on the 6.1 accessing side to make this work?
Any help would be GREATLY appreciated.

How to call an external web service from OIM?

Hi,
I have a question on how to call an external web service from OIM within e.g. creating user process? How should it be done; through adapter and task in the process?
Any recomendations?
Thanks in advance!

it is not clear to me if you are having problems with calling java code from OIM or if the problem is the web service API.
Lets do some divide and conquer:
Can you create a simple java class that just writes a couple of lines to the log? Please attach this code to the OIM task and make sure it runs.
Once this works we can start looking at the web service call.
Best regards
/Martin

How can I invoke the web service manually in websphere?

Hi
I've developed a webservice application using Rational Application Developer (RAD). I deployed it in a websphere 6.1 application server, using the administration console to import the war file that I had previously exported with RAD.
My webservice application is listed in the "Enterprise Applications" section of websphere's administration console as started.
My question is: how can I invoke the web service manually? Is there some kind of websphere generated webpage that I can use to call it manually?
I tried http://<server:port>/<contextroot> and http://<server:port>/<contextroot>/<servicename> in a webbrowser, but it doesn't work. Is it possible to invoke the web service manually, or do I need to develop a client?
Thanks in advance
Pedro

Hi Bo Wang,
    Go to the Portal -> System Administration -> System Configuration
                           -> Portal Content folder
                           -> Open Visual Composer folder
    There you can see the Webservice Systems you have created through VC.
You can delete the unwanted system here.
Regards,
Shemim

How do we deploy several Web Services under the same Root Context?

We have several webservices, each in their own WAR file, running on OC4J 10.1.3. They each have their own Root Context and Oracle Welcome Servlet. This works well, and since they are all separate we can easily hot-deploy updated versions.
The drawback is separate URL's like :
.../RootContext1/WebService1
.../RootContext2/WebService2
.../RootContext3/WebService3
How do we assemble our Web Services to share a single Root Context? We are hoping to achieve URL's like this :
.../WebServices/WebService1
.../WebServices/WebService2
.../WebServices/WebService3
Do we have to bundle them all into the same WAR/EAR (and loose the power of individual deployment) or is there another way?
Thanks in advance!

If each one is a separate WAR file, then at the OC4J level each one will need a separate root context as it gets bound into the default-web-app.
I guess the corollary question here is if there is someway to combine multiple webservice endpoints into one WAR file -- which can then be mapped to a single root context.
I'll try and get someone more WS savvy than myself to take a look at this for you.
And Clever Apache is a viable option.
cheers
-steve-

How to Remove & Re-Enable Web Services on LaserJet printers supporting ePrint

If your LaserJet printer has been disconnected from or failed to connect to Web Services, you may need to power cycle your printer to reconnect. If that does not resolve the problem, you can remove web services, wait 30 seconds, then re-enable web services to re-establish your connection to ePrint and Print Apps. Note: this last step will result in a new email address being assigned to your printer.
How do I remove HP Web Services for my LaserJet printer?
Print a configuration page from your product, and locate the IP address.
At your computer, open a Web browser and type the product IP address into the address line and press Enter. The HP Embedded Web Server opens.
Click the HP Web Services tab.
Select the option to disable Web Services.
How do I enable or re-enable HP Web Services for my LaserJet printer?
To use HP ePrint, you must first enable HP Web Services. Re-Enabling Web Services uses the same procedure as enabling the Web Services.
Print a configuration page from your product, and locate the IP address.
At your computer, open a Web browser and type the product IP address into the address line and press Enter. The HP Embedded Web Server opens.
Click the HP Web Services tab.
Select the option to enable Web Services.
When Web Services are enabled, ePrint information appears in the HP Embedded Web Server. Look for the e-mail address that is automatically assigned to the product. The product also prints an HP Web Services information sheet that contains this e-mail address and instructions
If you were unable to register your printer in www.hpeprintcenter.com within 24 hours of printing your information sheet, you must re-enable the printer code by reprinting your information sheet. The information sheet will also provide your email address if you have forgotten it.
How do I print the Web Services Information Sheet for my LaserJet printer?
You can only add the printer to your HP ePrintCenter account within 24 hours after printing the information sheet. You can re-print the information sheet at any time from the printer control panel.
Print a configuration page from your product, and locate the IP address.
At your computer, open a Web browser and type the product IP address into the address line. The HP Embedded Web Server opens.
Click the HP Web Services tab.
Click the Print Information Sheet button.
I am an HP employee.

To help improve the organization and information sharing in this forum this post/discussion has been closed and replaced.
Please see this post: <link to new “Enable Disable Web Services on your printer” post.
If after reviewing the post above you still have questions/issues with your web-connected printer, you can either review and comment in existing posts in this forum that report issues like yours, or if necessary start a new post requesting assistance.
Miles
HP Employee

How to deploy my own web services to the Start BPEL PM Server?

Recently, I am learning the JDeveloper BPEL Designer(version 10.1.2.0), I had finished my first BPEL process CreditFlow flowing the quickstart guider.
Now I wonder how to deploy my own web services to the Start BPEL PM Server? I mean I don't want to invoke the CreditRatingService as I did flowing the quickstart guider, but to invoke my own web servcies. Now I had made some web services with eclipse and deployed them to the tomcat5.0. but how can I invoke these my own web services just like I invoked the CreditRatingService in the JDeveloper BPEL Designer?
Thank you!

Copy the WSDL file from your Tomcat server onto your development machine. Add them to your project in JDeveloper. Then add a partnerlink and specify the WSDL location. Then add you role, variables and compile!

How to secure a J2SE Web Service

Similar Messages

Maybe you are looking for