Web Service, SSL and Client Authentication

I tried to enable SSL with client authentication over a web service. I am using App Server 10.1.3.4.
The test page requires my certificate (firefox asks me to choose the certificate) the response page of the web service returns this error:
java.security.PrivilegedActionException: javax.xml.soap.SOAPException: Bad response: 405 Method Not Allowed
Has anyone used web services with SSL client authentication?
Any clue why?
Regards

Any comment?
Thank you.

Similar Messages

Web Service (SSL) and certificates (keytool) with INternet Explorer

Hi,
Followed this steps http://www.grallandco.com/blog/archives/2006/10/using_htts_with.html to have a secure SSL WEb service (with client authorization).
Tested from Jdeveloper it worked O.K.
Now I would like to test it with Internet explorer, but now server ask for certificate before internet show parameters page to invoke Web Service.
I generated self signed certificates and keystore using keytool. (This keystore is used by the OC4J and my proxy client).
Imported this certificate (.cer) to internet explorer succesfully, but when access URL for the web service (https) internet does not show this certificate to use it, so failed to connect...
keytool certificates could be used by INternet explorer for this purposes?, what am I doing wrong?
Thanks
J.

Hi,
I already configured HTTPS - client authenticate for OC4J, and you can work with follow step:
1: Create keystore for OC4J by java keytool
2: Using openssl to create certificate for your server (privatekey, certificate)
3. Using keytool to import your server's certificate (2) to keystore (1)
4. Generate client certificate (4)
5. Sign on client certificate (4) by privatekey and server certificate (20
6. Import client certificate to windows - (should create keystore with format pkcs12)
You can using "Java Certificate Services" to help you create keystore with multi format or sign cert....
Rgs

Authenticating to weblogic web service using a client cert with webserver

I am trying to think of how to authenticate a client to a weblogic web service
using a client certificate. The wrinkle is that a Web Server (iis or whatever)
will be handling the ssl part and forwarding non-secure to weblogic. The cert
will still be accessable in the request using: HttpServletRequest req.getAttribute("javax.net.ssl.peer_certificates).
At this point it is not clear to me what I can do. When does CertAuthenticator
get called? Can I even use it? Will I have to write my own version of the weblogic.soap.server.servlet.StatelessBeanAdapter
class?
Any help will be appreciated, even explaining why it can't be done.
Thanks,
Scott

I am trying to think of how to authenticate a client to a weblogic web service
using a client certificate. The wrinkle is that a Web Server (iis or whatever)
will be handling the ssl part and forwarding non-secure to weblogic. The cert
will still be accessable in the request using: HttpServletRequest req.getAttribute("javax.net.ssl.peer_certificates).
At this point it is not clear to me what I can do. When does CertAuthenticator
get called? Can I even use it? Will I have to write my own version of the weblogic.soap.server.servlet.StatelessBeanAdapter
class?
Any help will be appreciated, even explaining why it can't be done.
Thanks,
Scott

External Web Service - User and password in HTTP header

Hi!
How is it possible to add user and password in the HTTP header in a external web service call?
I have created a "Portal Service from WSDL file - Client side" with the wizard in SAP Developer Studio. I following the Java Development Guide - Web Service Security, and use the secured service connection. I have also created a new System Landscape, but should the new system be based on HTTP, my own PAR or what?
How can I check that the user and password is added to the HTTP header or the SOAP envelope? Do I have to scan http traffic with a proxy as Paros or can I find the request sent from SAP EP in the logs?
Cheers
Asle

Hello All,
I have been struggling a bit while putting a reasonable security framework on a jax-rpc style web service. I'm using JWSDP1.2 to set up the webservice. I've tried to outline my problem below. Please correct me where I'm wrong.
I've been through the Sun's WS tutorials, but they are not really clear on security. However, from them I surmised that there are two decent authentication techniques. HTTP Basic and mutual authentication (MA) . Both have their drawbacks though. HTTP Basic suffers from poor encryption while MA is a bit difficult to set up on both client and server sides. Another problem with MA is that there is no central repository for users/passwords.
OK, what I would really like to do is use my own user database to verify users/passwords i.e. use a HTTP Basic like authentication (but at application level) but run it over SSL for encryption. It seems simple, but is it possible?
Also, I have noted that when I use HTTP Basic on the service side, and use a java client, then setting username/password has no effect. In other words, I can always access the web-service, even with wrong username/password.
Sorry for the long post. Hope someone can help. Thanks.

Getting .ServiceException while invoking a web service from a client

I created a web service and then created a web service client from wsdl in eclipse. I am getting the following error when trying to call the web service from client.
javax.xml.rpc.ServiceException: There is no stub implementation for the interface: examples.ejb.ejb20.basic.statelessSession.TraderBeanService
Please find the files here -
wsdl - http://www.sourcepod.com/uneksu63-9627
Trade.java - http://www.sourcepod.com/mltizr21-9628
TradeResult.java - http://www.sourcepod.com/npledh19-9629
TradeResultService - http://www.sourcepod.com/hbjevm45-9630
TradeResultServiceLocator.java - http://www.sourcepod.com/mrpagh85-9631
TradeResultSoapBindingStub.java - http://www.sourcepod.com/zjrkjv91-9632
package examples.ejb.ejb20.basic.statelessSession;
import javax.xml.ws.WebServiceRef;
import javax.xml.namespace.QName;
public class HelloClient {
    @WebServiceRef(wsdlLocation="http://localhost:7001/webservice/services/TraderBean?wsdl")
    String url = "http://localhost:7001/webservice/services/TraderBean?wsdl";
         QName qname = new QName("http://statelessSession.basic.ejb20.ejb.examples", "TraderBeanService");
    public static void main(String[] args) {
        try {
            HelloClient client = new HelloClient();
            client.doTest(args);
        } catch(Exception e) {
            e.printStackTrace();
    public void doTest(String[] args) {
        try {
             TraderBeanServiceLocator service = new TraderBeanServiceLocator(url,qname);
            TraderBean port = (TraderBean) service.getPort(TraderBeanService.class);
            System.out.println("Invoking the sayHello operation on the port.");
            TradeResult response = port.buy("INR", 100);
            System.out.println(response.getNumberTraded());
        } catch(Exception e) {
            e.printStackTrace();
}How to solve the stub implementation error?
Edited by: 901007 on 12 Aug, 2012 10:57 AM

That did not work either. There was getPorts() and not getPort() and I used getPorts(). And I am getting the below error,
java.lang.ClassCastException: java.util.HashMap$KeyIterator
But when I try like the below,
    @WebServiceRef(wsdlLocation="http://localhost:7001/webservice/services/TraderBean?wsdl")
    String url = "http://localhost:7001/webservice/services/TraderBean?wsdl";
    QName qname = new QName("http://statelessSession.basic.ejb20.ejb.examples", "TraderBeanService");
            TraderBeanServiceLocator service = new TraderBeanServiceLocator();
            TraderBean port = (TraderBean) service.getPort(TraderBean.class);
            System.out.println("Invoking the sayHello operation on the port.");
            TradeResult response = port.buy("INR", 200);
            System.out.println(response.getNumberTraded());I am getting the below error,
Invoking the sayHello operation on the port.
AxisFault
faultCode: {http://schemas.xmlsoap.org/soap/envelope/}Server.userException
faultSubcode:
faultString: java.lang.InstantiationException: examples.ejb.ejb20.basic.statelessSession.TraderBean
faultActor:
faultNode:
faultDetail:
     {http://xml.apache.org/axis/}hostname:Gopi_Desktop
java.lang.InstantiationException: examples.ejb.ejb20.basic.statelessSession.TraderBean
As you can see the statement"Invoking the sayHello operation on the port." is getting printed but after that error is thrown.
I tried changing it to, TraderBean port = (TraderBean) service.getPort(qname, TraderBeanServiceLocator.class);
But even this is throwing the same error, java.lang.InstantiationException: examples.ejb.ejb20.basic.statelessSession.TraderBean
I changed my webservice using Axis2 web service runtime and this time when I try to invoke using client, I am getting the following,
[WARN] Weblogic's StAX implementation is unsupported and some Axiom features will not work as expected! Please use Woodstox instead.
Exception in thread "Main Thread" org.apache.axis2.AxisFault: javax.xml.stream.XMLStreamException: Error at line:1 col:217 ':' Already got a ':' in name
     at org.apache.axis2.util.Utils.getInboundFaultFromMessageContext(Utils.java:531)
     at org.apache.axis2.description.OutInAxisOperationClient.handleResponse(OutInAxisOperation.java:375)
     at org.apache.axis2.description.OutInAxisOperationClient.send(OutInAxisOperation.java:421)
     at org.apache.axis2.description.OutInAxisOperationClient.executeImpl(OutInAxisOperation.java:229)
     at org.apache.axis2.client.OperationClient.execute(OperationClient.java:165)
     at examples.ejb.ejb20.basic.statelessSession.TraderBeanStub.addTwoNumbers(TraderBeanStub.java:185)
     at examples.ejb.ejb20.basic.statelessSession.TestClient.main(TestClient.java:15)
If you need more details, I can post the steps I did to build it...
Any help is greately appreciated.
Edited by: 901007 on 15 Aug, 2012 10:27 PM
Edited by: 901007 on 15 Aug, 2012 10:49 PM

BPM Process As a Web-Service Username and Password

Hi all,
We have exposed a Process as a Web-Service WSDL to another system . We use Username Token Profile to enter the username and password to connect to the Web-Service..
Now what we do is we have a role in our project and we create a dummy Web-Service user and add the role to that user and then use its password and username to call the Web-Service.
Can we change this?
Can we have a dummy username and password not associated with any role in BPM used in our Web-Service?

Did you use PAPI code inside your web service or did u just use PAPI Web Services ( like did u just pressed the button Launch PAPI Web Services ) and it created the WSDL for you and u used it to create the client?
I am using the latest version of OBPM..
Oracle 10.3.10
Can you let me know what do u mean by PAPI interface.. Is it the PAPI code of is the PAPI Web Service which is built by BPM automatically and could be used?
Edited by: user8707382 on Sep 10, 2009 9:00 AM

Trouble Publishing a Web Service in Rich Client

I have been working on trying to create a web service in Rich Client and keep getting this blank window.I'm not sure what the problem is but one thing that I notice about this window is the Java logo on the top left.I tried uninstalling and downgrading my Java but that didn't help. I currently have Java build 1.6.0_45-b06 installed. My Rich Client version is 12.5.3 with the 1475 build. I believe it is software related because I had a coworker try and us his user name and passowrd on my computer with his administrator account and he was getting this window as well.
Another problem I am having is getting the Web Services to refresh. There are times when it will just say "Refreshing, please wait...". When I click the refresh button will attempt to refresh for a half a second and then stop.
Best,
Ryan

Hi Ryan,
Will you please provide the details of BO server version? And for java and software related queries please review your configurations with PAM (Product Availability Matrix) available at SAP marketplace.
Regards,
Aashutosh

Oracle Web Services Manager and Stateful Services

Hi,
I was wondering if anybody could help or provide guidance on stateful web services and the OWSM.
I've registered a stateful web service with the OWSM. I also selected the "Keep-Alive" option as well, but this prob. doesn't pertain to stateful web services. But it doesn't seem to register the fact that its a stateful web service. When I call it, I have a packet analyzer that looks at the TCP trace and no Session id is sent back in the headers on the client side, which is on a separate box. Obviously, running it directly with Java and Axis works fine.
We are using a gateway for the OWSM, not an agent. The web service is successful in getting called through OWSM but the problem is that no session information is sent back to client so subsequent calls fail b/c the web service requires the state and what the previous call was. This web service is a .NET service and resides on a different server/box than the Oracle SOA suite.
Are there any tutorials/information out there that would tell me how to register a stateful web service with the OWSM? Eventually we'd like to connect the OWSM to an ESB and that would require it to be stateful as well obviously.
Thanks again,
Nathan

On OTN, documentation library. Search for Oracle Web Service Manager and there you will see the Extensibility Guide.
http://www.oracle.com/pls/as10131/drilldown?word=Oracle+Web+Services+Manager&wildcards=0&remark=federated_search

Entering values in Web Services ID and Description, for External Catalog

Hi,
I am trying to connect to an external Vendor Catalog from ERP. Pl note that we just have ERP ECC 6.0 and no SRM. I went to SPRO and followed menu path 'Materials Management >> Purchasing >> Web Services: ID and Description'. I am not sure what to enter in 1) Seq. Number 2) Name of Parameter for Web Service and 3) Call Structure COLUMNS.
I have URL from Vendor, User Name and Password. I need to know what values are mandatory here so I can successfully connect to external Catalog. If someone can give me sample values, I can try.
Any help is appreciated,
Niranjan

Update on 08/23/2011.
We are able to connect to Vendor Catalog, select items in Cart. When I press 'Place Order' button, I see all items populated in SAP PO ME21N screen. We can then add other information and create PO. This is working great. We have another question. Heard that with ERP ECC 6.0, we can only connect 1 vendor catalog. But with SRM, we can connect more than 1 vendor catalog. Is there a BAPI or change SAP code to connect more than 1 vendor catalog from ECC 6.0 ?

Error while trying to publish a web service in UDDI client

hi
i m getting this error when trying to publish my web service in UDDI client.I have
configured my uddi client using Visual Administrator.I created a local test registry.The name of my registry is QuickCarRentalRegistry_Local.I created this at admin level.I also tried at level 1 Tier.But it was giving the same error.
The error is " Internet Explorer Script Error".my ie version is 7.0
In my alert window it displays error: 'ur_txt' is undefined.
Regards
mythri.

Hi mythri.
Did you find a way out of this error? Could you share the solution with me? Because I am facing a problem that looks just like the one you had.
Thanks in advance.
Renan

Web Services, Schemas, and the xsi:type attribute

Hi List,
I have several questions reqarding web services, schemas, and the use of the xsi:type
attribute in messages.
Schemas:
Q1: How complex can a web service schema be?
Q2: Is it reasonable for a schema to contain derived types by extension [1]?
Q3: Could you use the International Purchase Order Schema [2] with a web service?
xsi:type
Q1: Is it reasonable for a web service to use the xsi:type attribute in the message(s)?
If I am interpreting Section 4.1.15 of the BasicProfile-1.0a [3] correctly, this
appears to be appropriate in certain circumstances.
Q2: When is it appropriate to use the xsi:type attribute? If a schema contains
derived types by extension [1]? If a schema contains xsd:anyType?
Q3: How does using the xsi:type attribute affect interoperability?
And finally,
Q4: Are there any examples available demonstrating the use of the xsi:type attribute
in messages?
Whew !!!
TIA,
Kent
[1] http://www.w3.org/TR/xmlschema-0/#DerivExt
[2] http://www.w3.org/TR/xmlschema-0/#ipo.xsd
[3] http://www.ws-i.org/Profiles/Basic/2003-08/BasicProfile-1.0a.html

Hi Kent,
A few answers inline...
HTH,
Bruce
Kent Kvarfordt wrote:
>
Hi List,
I have several questions reqarding web services, schemas, and the use of the xsi:type
attribute in messages.
Schemas:
Q1: How complex can a web service schema be?There are limits in converting the schema between language
representations, see this section [a] in the docs on roundtripping
generated data types.
[a]
http://edocs.bea.com/wls/docs81/webserv/assemble.html#1074725
Q2: Is it reasonable for a schema to contain derived types by extension [1]?
Q3: Could you use the International Purchase Order Schema [2] with a web service?
xsi:type
Q1: Is it reasonable for a web service to use the xsi:type attribute in the message(s)?
If I am interpreting Section 4.1.15 of the BasicProfile-1.0a [3] correctly, this
appears to be appropriate in certain circumstances.I've not seen this used.
http://www.ws-i.org/Profiles/Basic/2003-08/BasicProfile-1.0a.html#refinement34259632
>
Q2: When is it appropriate to use the xsi:type attribute? If a schema contains
derived types by extension [1]? If a schema contains xsd:anyType?
Q3: How does using the xsi:type attribute affect interoperability?My thought is that since this is not commonly used, then your risk of
interop failure is high.
>
And finally,
Q4: Are there any examples available demonstrating the use of the xsi:type attribute
in messages?Sorry, I looked and could not find any examples.
>
Whew !!!
TIA,
Kent
[1] http://www.w3.org/TR/xmlschema-0/#DerivExt
[2] http://www.w3.org/TR/xmlschema-0/#ipo.xsd
[3] http://www.ws-i.org/Profiles/Basic/2003-08/BasicProfile-1.0a.html

Java Web Services wrapper and connection management.

We are currently evaluating the use of the SES Java web-services for a custom front end. I've downloaded the sample code and have read through the documentation but I'm confused on a few points.
We will be OSSO protecting the app, so the flow I think I need to use is (on the OracleSearchService object):
*setSoapURL
*proxyLogin
*setSearchUser
*doOracleSearch
(do whatever with results)
From what I can tell each one of these does a separate call into the actual web service. Does this keep a connection open between these calls and if so how do we need to manage our connections in this case. Is there an explicit close method we should be calling? I see that we can get an OracleSoapHTTPConnection from the undocumented getConnection method on OracleSearchService but I'm unsure if we are supposed to interact with it directly.
In a related vein how should we managing our OracleSearchService objects? Should we save an instance for each user in our httpSession, or just create a new instance on each call?
Any insights appreciated,
Jason

No Problem at all
Nomally the Web Service is big different between Web application. or you can build your Web service structure like web application structure. It depends on the web server:
If the Web Server of hosting company has WEB Service framework, you just need know how to deploy your Web service to Web Service framework and How to deploy to Web Server. In this case, you need deploy it two time, one is for Web Server framework and one is for Web Service framework
If the Web Server of hosting company doesn't has WEB Service framework, you need build your own Web Service framework into a web application, then you just need know how to deploy your web application with Web service into Web Server framework

Error calling[Standalone proxy]uFF1Aexternal web service(SSL + anonymous)

hi SDNer
      I use Standalone proxy to call external web service(SSL + anonymous)
web service Endpoint is : https://localhost:8443/HelloWorldService/services/HelloWorld
NWDS VERSION: NWDS-IDE-700SP12
Standalone SEI is :
HelloWorld
HelloWorldHttpBindingStub
HelloWorldImpl
HelloWorldPortType
Calling Code as following:
               //1. Access the implementation class of the service interface
               HelloWorldImpl ws = new HelloWorldImpl();
               //2. Create the instance of a logical port
               Remote remote = ws.getLogicalPort();
               HelloWorldHttpBindingStub stub = (HelloWorldHttpBindingStub) remote;
               //3.
               SecurityProtocol securityProtocol =
                    (SecurityProtocol) stub._getGlobalProtocols().getProtocol(
                         "SecurityProtocol");
               AuthenticationContext ac =
                    securityProtocol.getAuthenticationContext();
               ac.setIgnoreSSLServerCertificate(true);
               //4. invoke the business methods
               String ver = stub.example(str1, str2);
Exception is :
java.rmi.RemoteException: Service call exception; nested exception is:
     iaik.security.ssl.SSLException: Peer sent alert: Alert Fatal: handshake failure
     at com.sap.ws.HelloWorldHttpBindingStub.example(HelloWorldHttpBindingStub.java:84)
     at com.sap.ws.HelloWorldHttpBindingStub.example(HelloWorldHttpBindingStub.java:94)
     at TestHelloWorld.wsHelloWorld(TestHelloWorld.java:55)
     at TestHelloWorld.main(TestHelloWorld.java:24)
Caused by: iaik.security.ssl.SSLException: Peer sent alert: Alert Fatal: handshake failure
     at iaik.security.ssl.r.f(Unknown Source)
     at iaik.security.ssl.x.b(Unknown Source)
     at iaik.security.ssl.x.a(Unknown Source)
     at iaik.security.ssl.r.d(Unknown Source)
     at iaik.security.ssl.SSLTransport.startHandshake(Unknown Source)
     at iaik.security.ssl.SSLTransport.getOutputStream(Unknown Source)
     at iaik.security.ssl.SSLSocket.getOutputStream(Unknown Source)
     at com.sap.engine.services.webservices.jaxm.soap.HTTPSocket.initStreamsFromSocket(HTTPSocket.java:669)
     at com.sap.engine.services.webservices.jaxm.soap.HTTPSocket.initializeStreams(HTTPSocket.java:470)
     at com.sap.engine.services.webservices.jaxm.soap.HTTPSocket.getOutputStream(HTTPSocket.java:427)
     at com.sap.engine.services.webservices.jaxrpc.wsdl2java.soapbinding.HTTPTransport.getRequestStream(HTTPTransport.java:355)
     at com.sap.engine.services.webservices.jaxrpc.wsdl2java.soapbinding.MimeHttpBinding.outputMessage(MimeHttpBinding.java:550)
     at com.sap.engine.services.webservices.jaxrpc.wsdl2java.soapbinding.MimeHttpBinding.call(MimeHttpBinding.java:1432)
     at com.sap.ws.HelloWorldHttpBindingStub.example(HelloWorldHttpBindingStub.java:77)
     ... 3 more

Hi
Answer is pure assumption
The error "iaik.security.ssl.SSLException: Peer sent alert: Alert Fatal: handshake failure" is mentioned in the the OSS note
Note 1157248 - SAP Business Connector with SSL / Common Problems
Pls take opinion from SAP / Basis before implementing the note
Regards
Madhan D

Difference between Web Service Developer and Web Compononent Developer?

What's the difference between Web services Developer and Web Component Developer? What's their job description. I'm aiming to be a web application developer. Which track should I follow?

Here is another article on J2SE vs JEE:
http://www.velocityrevies.com/forums/t151124-what-is-j2se-vs-j2ee.html
I believe the people who said JSE is only for desktop development are not correct, as well as their saying their are 2 kinds of developer (web service and component).
As I understand it, web service developers provide a way to expose the data and functionality of a program written in a particular language (such as Java or C#) as XML documents to anyone subscribing to the service over the internet. The remote applications subscribing to the service therefore can be written in any other language. For example, imagine a Cobol program trying to get data from a program written in Java. Since both cobol and Java should have ways to parse XML documents, they don't have to know each other's syntax. There are many programs written in many many languages in the web and XML is a standard way for them to communicate. Web Services are an advanced topic and you shouldn't worry about it until you master web applications and/or desktop applications.
As I understand it, a web component developer creates java widgets that produce some visual image with basic functionality associated with it. For example, an html button. These widgets are used by other developers for the presentation layer when creating a web application or desktop application. I'm not sure about this definition since I never messed with web component development. I suggest you keep way from this specialized area on concentrate on web applications and/or desktop applications.
You can consider application development as devided into two general categories. Web development and Desktop development (there are others). Web development is further broken down into browser based applications and mobile device applications. I suspect their are more jobs in web development than desktop development. I therefore suggest you concentrate on browder based web development (just my opinion). However, each has their advantages and disadvantages over each other, depending on the task at hand(http://stackoverflow.com/questions/905365/desktop-development-versus-web-development)
Disclaimer:
http://myweb.accessus.net/~090/univdisc.html

Difference between Web Service URL and Report Manager URL

What is the difference between Web Service URL and Report Manager URL in Reporting Service configuration manager in SQl Server 2008 Reporting Setrvices

Another way to put it is the Web Service URL is just that, its used for services that are connecting to issue API calls. The Report Manager URL is the nice GUI that users should use. If you click the links, you should see the difference. I
am sure you have likely done that, but functionally one is for programmatic purposes and the other to be the front end graphical user interface.
Sometimes pictures help as well...
http://bretstateham.com/reporting-services-architecture-diagram%E2%80%A6/

Web Service, SSL and Client Authentication

Similar Messages

Maybe you are looking for