Securing single point of entry doc-lit web services

I am designing doc-lit web services with a single point of entry, but the doc can contain requests of various types, with varying levels of authorization on the 'methods' being called by the web service as a result of the passed requests. I'm looking for a standards-compliant means of accomplishing this, or at least some method that will not be insanely difficult to move to a standards-based security implementation when they become available. I do not want to use SSL/TLS, but do want to stick to standards including WS-Security, XML-Encryption and XML-DSig. I would also like to use OID/SSO with certificate-based authentication.
What are my options as far as existing tools, techniques, etc for this in a Java/Oracle environment? Is there anything in Oracle BPEL that could help me in this quest?
Appreciate any advice, pointers, shared experiences, etc on this - I'm a little lost in the trees right now!
Thanks Much,
Jim Stoll

Eric - appreciate the tip. The link to the JDev files for the OBE article doesn't work though (ie, in the article, there is a link to download the source for the project) - is there an alternate way that I could get hold of that code? Even something as simple as someone emailing it to me would work - I desperately need to move forward on this stuff. (There's another sample at http://www.oracle.com/technology/products/jdev/101/howtos/securews/index.html, but that one throws exceptions and I can't seem to get any help on it via the forum or Oracle Support, either...)
Thanks for your assistance!
Jim

Similar Messages

  • SwA with a doc/lit web service? 8.1sp3

    For WL 8.1sp3, is it possible to do SwA using a doc/lit style web service? I'm not even sure if this makes sense, and it's not mentioned on any sites I've seen.
    I'm trying to experiment how you can send binary data over XML with BEA WL 8.1sp3. It only supports SwA, which I believe can be used to send binary data at its raw size. However, I wanted to have a document-style web service.
    The only examples for SwA use rpc style.

    If you want to send binary data (i.e. an image, a PDF file, a Word document, etc.) as opposed to an XML document, then you in essence want an RPC-style web service that has an operation that takes an javax.activation.DataHandler. You can build this web service using either the <servicegen> Ant task, or the WLW IDE (a .JWS).
    Here's a link to the e-docs:
    http://e-docs.bea.com/workshop/docs81/doc/en/workshop/guide/getstarted/conUsingSOAPAttachments.html
    The one thing wrong (or missing) with that information, is that it doesn't tell you that you have to set the soap-style needs to be set to rpc. The default is document, which won't produce the the correct client proxy jar. Actually, you won't be able to produce the client proxy jar unless you set soap-style to rpc :-)
    Regards,
    Mike Wooten

  • Need help with DOC type web service

    hi,
    I am trying to write a simple message style ( doc type ) web service but no success so far. I have tried to search for examples but no use. I already implemented some simple RPC style web services like calculator etc and able to use them. I am more interested in the DOC type ( which sends SOAP message and receives SOAP message back). Can Anybody give me an example for implementing this type of service ( very-simple say HellowWorld ) or point me to some website . I am not able to generate the response envelope. I can write the client program which will send a SOAP Envelope to this services with one parameter NAME and the services should return Hello Name but in a SOAP envelope form. I can create a SOAP message in this Client using SOAPConnection and MessageFactory etc. Your help will be really appreciated. There is very little stuff about webservices on the internet as well on this forum.
    Thanks
    Vinod

    Hello kwilding2,
    Thanks for the quick response and pointing to some useful websites. I downloaded the code from web service essentials BUT all the examples are using SOAP RPC calls. They create a call object and call one of the service methods and a response is returned. I am little confused about this stuff. I am looking for something which returns the response in a SOAP envelope for which i think i need to use JAXM API which I already have downloaded. I have created a client which composes a SOAP envelope using SOAPConnection and other MessageFactory classes etc and can send this SOAP envelope to a web service. In return I want the web service to give the SOAP envelope.
    I have gone thru xmethods.net and picked the following stock quote request and response:
    Sample Request envelope:
    <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance" xmlns:xsd="http://www.w3.org/1999/XMLSchema">
    <SOAP-ENV:Body>
    <ns1:getQuote xmlns:ns1="urn:xmethods-delayed-quotes" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
    <symbol xsi:type="xsd:string">IBM</symbol>
    </ns1:getQuote>
    </SOAP-ENV:Body>
    </SOAP-ENV:Envelope>
    Sample Response Envelope:
    <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance" xmlns:xsd="http://www.w3.org/1999/XMLSchema">
    <SOAP-ENV:Body>
    <ns1:getQuoteResponse xmlns:ns1="urn:xmethods-delayed-quotes" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
    <return xsi:type="xsd:float">133.625</return>
    </ns1:getQuoteResponse>
    </SOAP-ENV:Body>
    </SOAP-ENV:Envelope>
    I also want the things in this order. This webservice at xmethods just returns the price for a stock, so how they say it returns this Response Envelope. Is this Envelope something implied. I am getting more confused.
    any help will be appreciated.
    Thanks
    Vinod

  • Doc-style Web Services

    Can a doc-style Web Service invoke an RPC-Style Web Service? I know that we cannot
    mix RPC with Doc-style in the same Service, but I was wondering if RPC and Doc-style
    can call each other.
    Thanks,
    John

    Hi John,
    Yes this is certainly possible. The role of client, server and service
    gets blurred when dealing with multiple web services. For an example,
    you can take a look at the work done by WS-I for the sample application
    [1], where multiple types of web services communicate with each other.
    Regards,
    Bruce
    [1]
    http://www.ws-i.org/SampleApplications/SupplyChainManagement/2003-12/SCMArchitecture1.01.pdf
    John Meiser wrote:
    >
    Can a doc-style Web Service invoke an RPC-Style Web Service? I know that we cannot
    mix RPC with Doc-style in the same Service, but I was wondering if RPC and Doc-style
    can call each other.
    Thanks,
    John

  • How to generate doc/lit/wrapped services from existing wsdl?

    Hello,
    I am using workshop 10.1 to generate webservices from existing wsdl files from workshop 8.1. The existings webservices are based on an xmlbean utility project.
    When I generate the webservice from the existing wsdl file it generates automatically services with doc/lit/bare operations. I found in the known issues that this combination is not supported in combination with xmlbeans.
    See: CR283457
    XBeans are not supported as parameters or return type for doc/lit/bare operations.
    Use of Xbeans as a parameter or return type with doc/lit/bare bindings is not supported in operations or callbacks and will result in a failure during deployment.
    Platform: All
    Workaround: Use doc/lit/wrapped for services that use XBeans as parameters or return types.
    The workaround state to use doc/lit/wrapped for services. My questions is how to do that since workshop has all control over the generation of the webservices? ?:|
    Thanks in advance,
    Martijn Baels
    Software Architect
    www.leanapps.com

    Hi Martijn
    If you do generate web service from the wsdl on a 9.2 project, it always uses jax-rpc types and there's no xmlbeans involved.
    If the wsdl is in the schemas folder and the xmlbeans builder is on, then you also have xmlbeans types created by the builder they aren't being used by the web service. You will still have problems, because some of the xmlbeans types may conflict with the jax-rpc types.
    so when we generate webservice from a wsdl it will never use xmlbeans type, even if the xml builder is on, because WLS doesn't support start from wsdl with xmlbeans types.
    Can you please attach the wsdl and the steps so I can replicate and see the issue?
    Thanks
    Vimala

  • Returning data with a doc style web service

    How does one return information using a "Document" style Web Service? WLS 8.1 restricts
    you to a single "in" parameter. Do I return information by using the "return"
    value from the Web Service (assuming it's synchronous)? If so, what are the restrictions
    on the return value. I've read the WLS 8.1 Programming Web Services document but
    it's pretty lite in the area of Document style Web Services.
    Thanks.

    WLS 8.1 supports two document styles:
    #1 document literal
    #2 document wrapped literal
    In the case of #1 a web service method can only
    take zero or one argument. There can be a return
    type (or void). The (single) argument or return type
    could be any supported type, or user defined complex
    types (java beans). In #1 the dispatch is done based
    on the incoming document and not based on the name
    of the method. You can find an example for this at:
    http://manojc.com/?sample13
    In the case of #2 a web service method can have
    any number of arguments. The WS container will
    wrap the method in to a complexType. Here,
    method name will be the name of the complexType
    and arguments will be added as elements of the
    complexType. In this case dispatch is done
    based on the method name. An example here:
    http://manojc.com/?sample14
    Regards,
    -manoj
    "Jack Ottofaro" <[email protected]> wrote in message
    news:3ea55b39$[email protected]..
    >
    How does one return information using a "Document" style Web Service? WLS8.1 restricts
    you to a single "in" parameter. Do I return information by using the"return"
    value from the Web Service (assuming it's synchronous)? If so, what arethe restrictions
    on the return value. I've read the WLS 8.1 Programming Web Servicesdocument but
    it's pretty lite in the area of Document style Web Services.
    Thanks.

  • Change the end point URL in WSDL for web-service

    Hi All,
    Morning , could someone please help us with this question, we are stuck with this currently.
    In SOA Suite 10g as well 11g we have a jsimple Java class whose one of the methods is exposed as a web service.
    In the project it has created the WSDL as well and have deployed the .ear file to the servers from EM console successfully.
    Now we need to migrate this web service to testing & production environments.
    1. Could someone please let us know the steps as to how do we change the end point url in the WSDL for this web service (present in web content --> WEB-INF/wsdl path in the j-developer project) for migration in case of both 10g (OC4J) as well 11g (WLS) servers.
    2. Also could this change/update be done prior to deployment as well as post deployment as well.
    Looking forward to inputs regards this...as we are stuck with this ..would be very helpful
    Thanks as always for help & guidance..

    Hi
    As Vijay mentioned, you develop a WebService in JDeveloper and test in JDeveloper integrated Weblogic Server say at http://localhost:7101/MyWebService/MyPort?wsdl. Thats it. Once it is working. Export it into a .WAR file. If you have any other supporting EJB JARs etc, put all these into a full blown .EAR at application level. NOW deploy this .EAR or .WAR into any Domain on any host and any port. DOES not matter. That server's host and port will be taken. Infact even if this other domain is Clustered domain, still it will work by giving webserver host and webserver port that sits in front of the cluster.
    I develop my webservices in JDeveloper and test at 7101 port. This .WAR gets deployed in QC Env at qchost:qcport. Same .WAR deployed to UAT at uathost:uatport and finally to prod also at prodhost:prodport.
    Its just the Client (WebService Proxy) that is calling this WebService need to use appropriate host and port based on which Env it is connecting to. For this, simply do not hard code WSDL URL in the java code or anywhere. Simply get it from a .properties file using a key value pair like this.
    WSDL_URL=http://host:port/MyWebService/MyPort?WSDL.
    Now have Environment specific values for above key and put that properties file in that domain root folder. And in your code always refer this key.
    You can use many approaches along the above lines.
    If your WebServies proxy is a webservice adapter say within bpel, still you can modify the value using deployment plan .xml file file while deploying.
    I would not absolutely prefer opening war file from ear and modifying war and updating ear file etc etc. Also do not have multiple EARs for Environment specific. Just have only one single EAR or WAR file that can be deployed to any environment.
    Thanks
    Ravi Jegga

  • Doc/Literal Web Services in OmniPortlet

    Hi I was wondering if OmniPortlet has a problem calling Document/Literal type of Web Services? Because I tried calling 2 such WS, one of which is .NET, the other is developed in JDeveloper.
    In both cases, OminPortlet sends the encodingStyle attribute in its SOAP body, which shouldn't occur for doc/lit types right? The .NET WS can accept the request though, while the JDev one can't.

    This is the WSDL for the .NET service:
    <wsdl:definitions targetNamespace="http://tempuri.org/">
         <wsdl:types>
         <s:schema elementFormDefault="qualified" targetNamespace="http://tempuri.org/">
         <s:element name="HelloWorld">
    <s:complexType/>
    </s:element>
         <s:element name="HelloWorldResponse">
         <s:complexType>
         <s:sequence>
    <s:element minOccurs="0" maxOccurs="1" name="HelloWorldResult" type="s:string"/>
    </s:sequence>
    </s:complexType>
    </s:element>
    </s:schema>
    </wsdl:types>
         <wsdl:message name="HelloWorldSoapIn">
    <wsdl:part name="parameters" element="tns:HelloWorld"/>
    </wsdl:message>
         <wsdl:message name="HelloWorldSoapOut">
    <wsdl:part name="parameters" element="tns:HelloWorldResponse"/>
    </wsdl:message>
         <wsdl:portType name="ServiceSoap">
         <wsdl:operation name="HelloWorld">
    <wsdl:input message="tns:HelloWorldSoapIn"/>
    <wsdl:output message="tns:HelloWorldSoapOut"/>
    </wsdl:operation>
    </wsdl:portType>
         <wsdl:binding name="ServiceSoap" type="tns:ServiceSoap">
    <soap:binding transport="http://schemas.xmlsoap.org/soap/http"/>
         <wsdl:operation name="HelloWorld">
    <soap:operation soapAction="http://tempuri.org/HelloWorld" style="document"/>
         <wsdl:input>
    <soap:body use="literal"/>
    </wsdl:input>
         <wsdl:output>
    <soap:body use="literal"/>
    </wsdl:output>
    </wsdl:operation>
    </wsdl:binding>
         <wsdl:binding name="ServiceSoap12" type="tns:ServiceSoap">
    <soap12:binding transport="http://schemas.xmlsoap.org/soap/http"/>
         <wsdl:operation name="HelloWorld">
    <soap12:operation soapAction="http://tempuri.org/HelloWorld" style="document"/>
         <wsdl:input>
    <soap12:body use="literal"/>
    </wsdl:input>
         <wsdl:output>
    <soap12:body use="literal"/>
    </wsdl:output>
    </wsdl:operation>
    </wsdl:binding>
         <wsdl:service name="Service">
         <wsdl:port name="ServiceSoap" binding="tns:ServiceSoap">
    <soap:address location="http://137.132.1.150:83/service.asmx"/>
    </wsdl:port>
         <wsdl:port name="ServiceSoap12" binding="tns:ServiceSoap12">
    <soap12:address location="http://137.132.1.150:83/service.asmx"/>
    </wsdl:port>
    </wsdl:service>
    </wsdl:definitions>

  • Single Sign On and Application with Web Services

    My Application Server is set as partner application for SSO so for example this address: http://myserver:80 is SSO enabled.
    I have two ADF applications on it with jspx pages and the ADF security is enabled on them. SSO works for these applications (for jspx files).
    I added a new application with a web service and deployed this new application. It is on the same application server as those two applications and its security provider in identity management, SSO enabled. Its address is something like:
    http://myserver:80/newWebService-Project1-context-root/MyWebService1SoapHttpPort
    So I expect to be unable to test web service, but I can and I am not prompted for user name and password.
    Regards
    Farbod

    Thank you.
    Yes I had cleared the cache and in these cases I always use a new browser also.
    I deployed a third application without declarative security options (ADF application, no security settings) and this application also didn't ask me for user information though it was under SSO.
    Regards
    Farbod

  • Entry Parameters in Web Service QUERY_VIEW_DATA

    Hi Gurus,
    From the entry Prameters of the SAP Standard Web Service QUERY_VIEW_DATA, could you please tell me what for would be the ViewId Parameter?
    I have always leave it empty and I have not found any example when it appears filled 
    Thanks so much for your time!
    Regards.
    Verónica.

    Hi,
    Please check the below help link:
    http://help.sap.com/saphelp_nw04/helpdata/en/d8/3bfc3f8fc2c542e10000000a1550b0/frameset.htm
    Thanks,
    Venkat

  • How to add security credentials to SOAP header for EBS Web Service call..

    All,
    I am trying to invoke a webservice that I successfully exposed as a WSDL Web Service using EBS Integrated SOA Gateway. I am using OBIEE 11g Action Framework which uses WebLogic.
    Here are the steps I completed:
    - I exposed a WSDL web service in EBS R12 via Integrated SOA Gateway
    - I granted the access to this service in EBS R12 to user SYSADMIN
    - I used OBIEE 11g to make a Action to call the Web service (using Action Framework) by searching for the WSDL
    - When I try to execute the action: I get the error:
    Action could not be invoked.
    ServiceExecutionFailure :
    Error invoking web service HR_PHONE_API_Service at endpoint http://ip-10-87-33-3.ec2.internal:8000/webservices/SOAProvider/plsql/hr_phone_api/ Missing <wsse:Security> in SOAP Header
    PROBLEM: I am unsure how to add the credentials for SYSADMIN user and password to add the SOAP username/pwd to the outgoing call. Anyone on this forum know how to set up the SOAP to call with the correct credentials? I have been looking at the documentation but it is not clearly explained.

    Dear Heiko,
    did you solve this problem?
    We are facing the same problem. Every parameter that requries "cmd" does not work. I guess we don´t use this paramter the right way.
    Best, Chris

  • Securing Oracle SOA Applications by Using Oracle Web Services Manager

    Guys!
    I am following this tutorial since two days now.
    http://www.oracle.com/technology/obe/fusion_middleware/owsm/secure%20soa/securing%20soa%20with%20owsm.htm
    Everything goes fine till "Associating the Server Agent with the Web Service"
    But when we go to section " Testing the Server Agent" My SOA suite doesnt let me do that. My OWSM and EM hangs and it doest let me enter.
    Any idea what could be the problem?
    Thanks
    Deepak

    Hi, I'm facing the same problem.
    I've just installed the OWSM with the following options:
    1. Oracle 10g Database
    2. OC4J created on Oracle AS 10.1.2 (not standalone version OC4J)
    3. Manual deploy to the OC4J and run "coresv initialize" successfully (I can query to the tables created with sqlplus)
    Start the OC4J on the 10.1.2 AS and access to the login page with account "admin/oblix". It prompts "Login Failed".
    Any idea on this problem? Is a "standalone OC4J" a must?
    Thank you very much!
    Message was edited by:
    user517778

  • No Log entry while executing web service

    Hi,
    I have a web service which is deployed successfully to a server in the Weblogic
    Workshop domain.
    When I try to test the methods of the web service using the Test form, sometimes,
    I get a message 'No Log Entry'. When I reploy the application, it starts working
    properly.
    There is no problem with the code. Could someone please tell me as to why I might
    be getting the 'No Log Entry' message randomly.
    Thanks,
    Aparna

    My guess is that you are using the tutorial "Creating a SOAP Web Service". This one has a couple of errors in it:
    1. The directory it tells you to deploy the class to the following location:
    <JDeveloper_home>\soap\webapps\soap\soap\WEB-INF\lib
    when in fact it should be:
    <JDeveloper_home>\soap\lib\soap\soap\WEB-INF\lib
    2. This tutorial also says you do not have to re-start OC4J; in this case you do.
    If you are doing the J2EE Web service tutorial a re-start should not be required. One other potential cause of this kind of error can be because your proxy server is set on in Tools->Preferences->Proxy Server. Turn it off and this might fix the problem - my guess, however, is that your problem is either with step 1 or step 2 above.
    Mike.

  • Doc for Web services SDK (not using Consumer APIs)?

    I would like to interact with the BO XIr2 Web Services SDK, but I can't find much documentation about them (aside from what the WSDLs cough up).  I don't necessarily want to use the Consumer APIs for the web services.  So I'm really looking for examples or even just a sort of "object model" for the web services that describe what the different calls in the WSDL do and in what order you need to call them to get things done like refreshing a report and getting the results as an HTML stream.
    Does anyone have any examples/doc?
    Thanks.

    Hi,
    Let me ponder Ted's statement above. Indeed we do not test our web services sdk outside of our .NET and Java consumers but we do support using directly WSDL as long as the SOAP engine you are using is WS-Interoperable Basic Profile 1.O compliant (as we are compliant) or if issue can be reproduced using our java or .net consumers.
    Below a couple of links in our web service documentation that mention WS-I BP and WSDL:
    http://devlibrary.businessobjects.com/BusinessObjectsXIR2SP2/en/en/WS_SDK/wssdk_consumer/default
    http://devlibrary.businessobjects.com/BusinessObjectsXIR2SP2/en/en/WS_SDK/wssdk_consumer/doc/wssdk_dg/InstallingDevEnvironment11.html
    Let me also mention new SP2 release web services: BI Process Web Service and Query as a Web Service, these do not include consumers.

  • Single point of entry to apex app

    Hi,
    I understand there is a feature in apex where we can lock down the application entry point to a particular page. E.g. all requests to my app should come from http://server:port/entrypage.
    I looked everywhere within the toolset for this feature, but didn't find anything like it. Is such a feature really available? Can someone me in the right direction if so?
    Thanks.
    Shuba

    Here ya go, It is called deep linking:
    How to disable "deep linking" feature?

Maybe you are looking for