Using SSL for Web Service Access

Question

Hi,
I'm not sure if this the best forum, but this is technically a J2EE question.
I'm using JDeveloper and OC4J. I have a java class that I'm publishing as a stateful webservice; however, the only clients will be other java routines. (I generated a WSDL file and then stubs.) This webservice has to run on a Windows 2000 box inside of OC4J. I have this done and can call it from across the network from a Linux box. This all works fine. However, I need to add security preferably by going to SSL. I can't find out how to do this. Does anyone know? Do I manually edit the generated stub files? Any chance there is some sample code somewhere?
thanks,
Joe Gamache

Answer 1

Please look at Appendix A of the "Web Services Developer's Guide" from iAS v9.0.2 covers Oracle SOAP. The section, "Working With Oracle9 iAS SOAP
Transport Security", covers using SSL.
Here is a simple example with steps:
Prerequisites
1 . Suppose you have configured Apache to use SSL , that is
-     Apache has a valid server certificate
-     Apache requires the client certificate
-     Apache has a bundle of root certificates of CA with wich it can trust client certificates
-     Apache is in front of OC4J with mod_oc4j (9.0.2) or mod_proxy ( 1.0.2.2)
For more information on this please refer to Oracle9i Application Server Security Guide
2. Have a working knowledge of Oracle Wallet Manager
Steps
The following steps let you use an https web services client
1.     First you need a certificate store in order to store the private key , the client X509 certificate and some trusted authorities. This store in our case is a wallet exported by Oracle Wallet Manager.
2.     In order to generate a correct wallet you need :
a.     Start the Oracle Wallet Manager ( OWM )
b.     Create a new empty wallet
c.     Generate a Certificate Signing Request (CSR )
d.     Import the X509 certificate that the CA generated from the CSR
e.     Import the root certificate of the CA that trusts the server certificate you would like to connect to ( that of Apache )
f.     Export the wallet
3.     Let's call exported_wallet the wallet that we exported from OWM , and lets put it under c:\temp . Suppose that the wallet password is camarda.
4.     The JDK you plan to use for your client , in the extension directory ( that is $JDK_HOME/jre/lib/ext ) , must contains the following library
a.     jcert.jar
b.     jsse.jar
c.     jssl-1_1.jar
5.     Oracle SSL library use JNI in order to implement some low level encryption API , so you need a shared library usually located in $ORACLE_HOME/bin . For NT platform this library is njssl9.dll . Be sure to have this library in your path
6.     Now given a WDSL , use the Jdeveloper wizard to generate a proxy
7.     Modify the URL end-point from http to https
8.     Add to the proxy the following lines of code
System.setProperty("ssl.SocketFactory.provider","oracle.security.ssl.OracleSSLSocketFactoryImpl");
System.setProperty("ssl.ServerSocketFactory.provider","oracle.security.ssl.OracleSSLServerSocketFactoryImpl");
System.setProperty("java.protocol.handler.pkgs","HTTPClient");
System.setProperty("oracle.wallet.location","C:\\temp\\exported_wallet");
System.setProperty("oracle.wallet.password","camarda");
Example
In red : modified
In blue : added
import oracle.soap.transport.http.OracleSOAPHTTPConnection;
import java.net.URL;
import org.apache.soap.Constants;
import org.apache.soap.Fault;
import org.apache.soap.SOAPException;
import org.apache.soap.rpc.Call;
import org.apache.soap.rpc.Parameter;
import org.apache.soap.rpc.Response;
import org.w3c.dom.Element;
import java.util.Vector;
import java.util.Properties;
import oracle.xml.parser.v2.*;
* Generated by the Oracle9i JDeveloper Web Services Stub/Skeleton Generator.
* Date Created: Mon May 20 14:24:48 CEST 2002
* WSDL URL: http://26.2.197.119:8888/InterOp/Services.wsdl
public class AnagInquireServicesEJBStub {
public String endpoint = "https://26.2.197.119/InterOp/AnagInquireServices";
private OracleSOAPHTTPConnection m_httpConnection = null;
public AnagInquireServicesEJBStub() {
m_httpConnection = new OracleSOAPHTTPConnection();
public Element ricercaPF(String istat1, String istat2, String codiceFiscale) throws Exception {
System.setProperty("ssl.SocketFactory.provider","oracle.security.ssl.OracleSSLSocketFactoryImpl");
System.setProperty("ssl.ServerSocketFactory.provider","oracle.security.ssl.OracleSSLServerSocketFactoryImpl");
System.setProperty("java.protocol.handler.pkgs","HTTPClient");
System.setProperty("oracle.wallet.location","C:\\temp\\exported_wallet");
System.setProperty("oracle.wallet.password","camarda");
Element returnVal = null;
URL endpointURL = new URL(endpoint);
Call call = new Call();
call.setSOAPTransport(m_httpConnection);
call.setTargetObjectURI("AnagInquireServices");
call.setMethodName("ricercaPF");
call.setEncodingStyleURI(Constants.NS_URI_LITERAL_XML);
Vector params = new Vector();
params.addElement(new Parameter("istat1", String.class, istat1, Constants.NS_URI_SOAP_ENC));
params.addElement(new Parameter("istat2", String.class, istat2, Constants.NS_URI_SOAP_ENC));
params.addElement(new Parameter("codiceFiscale", String.class, codiceFiscale, Constants.NS_URI_SOAP_ENC));
call.setParams(params);
Response response = call.invoke(endpointURL, "");
if (!response.generatedFault()) {
Parameter result = response.getReturnValue();
returnVal = (Element)result.getValue();
else {
Fault fault = response.getFault();
throw new SOAPException(fault.getFaultCode(), fault.getFaultString());
return returnVal;
public void setMaintainSession(boolean maintainSession) {
m_httpConnection.setMaintainSession(maintainSession);
public boolean getMaintainSession() {
return m_httpConnection.getMaintainSession();
public void setTransportProperties(Properties props) {
m_httpConnection.setProperties(props);
public Properties getTransportProperties() {
return m_httpConnection.getProperties();
public static void main( String args[] ) {
AnagInquireServicesEJBStub a = new AnagInquireServicesEJBStub();
try {
XMLElement e = (XMLElement) a.ricercaPF("102030","102030","CMRGPP69M29D761K");
e.print(System.out);
} catch (Exception ex) {
ex.printStackTrace();
} finally {