September 2009 - jbossws-dev - Jboss List Archives

by Alessio Soldano

Hi there, just FYI yesterday I've tagged and released to maven repo a Beta1 of JBossWS-Native 3.2.1. This will be a chance for updating the native ws stack in JBoss AS 5.2 Beta1 before the freeze and for Andrew Dinn to do some tests regarding a bug he's most probably found with the 3.2.0.GA (http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4256703#4256703). Cheers Alessio -- Alessio Soldano Web Service Lead, JBoss

14 years, 7 months

1
1
0 / 0

[JBoss Web Services Development] - Re: JBossSTS SOAP protocol handler

by alessio.soldano＠jboss.com

"anil.saldhana(a)jboss.com" wrote : Dan, the question was whether the SAML assertion can be used as the authentication construct rather than username/pwd or a X509 certificate (as supported by the WS-Security implementation in JBossWS). This was what Stefan and I were referring to. Generally speaking I'd love to support authentication based on SAML assertion, but that's not supported in jbosws right now (and yes, doing that in the same way for all stack is probably a tough issue). We can create a jira for this. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4256536#4256536 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4256536

14 years, 7 months

1
0
0 / 0

[JBoss Web Services Development] - Re: JBossSTS SOAP protocol handler

by beve

anonymous wrote : Dan, the question was whether the SAML assertion can be used as the authentication construct rather than username/pwd or a X509 certificate (as supported by the WS-Security implementation in JBossWS). So we are talking about the STS own requirements for authenticating and authorizing requests for security tokens. (This would be the item 1. in Anils post right). anonymous wrote : | Maybe you can have a single username/pwd for the ESB layer with the STS to pass in the WS-S headers. Or better some type of X509 certificate that is mutually agreed on. This is how we have currently set this up. We are currently using a username/pwd for this in the ESB but I'll look into using X509 certificate instead. Thanks, /Daniel View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4256527#4256527 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4256527

14 years, 7 months

1
0
0 / 0

[JBoss Web Services Development] - Re: JBossSTS SOAP protocol handler

by anil.saldhana＠jboss.com

Dan, the question was whether the SAML assertion can be used as the authentication construct rather than username/pwd or a X509 certificate (as supported by the WS-Security implementation in JBossWS). This was what Stefan and I were referring to. At this time, I think you should forget about the authentication aspect and just focus on passing the saml assertion to the wst client and let the STS handle the token. Maybe you can have a single username/pwd for the ESB layer with the STS to pass in the WS-S headers. Or better some type of X509 certificate that is mutually agreed on. There are two different things: 1) There needs to be a security context for the client and the STS to interact. This is what is passed in the ws-s headers. Can be username/pwd or x509 cert. 2) And then there is the payload (in this case, the SAML assertion) that the STS will use to validate. >From what I see, the item 1 is a trust association between the ESB and ESB client. We can set it up once. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4256412#4256412 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4256412

14 years, 7 months

1
0
0 / 0

[JBoss Web Services Development] - Re: JBossSTS SOAP protocol handler

by beve

Hi Alessio, thanks for your comments! anonymous wrote : Don't know if this can be covered in the existing WSTrustClient, in that case we might probably have a single jaxws handler (and that might even be part of the jbossws-framework project). I'll take a look at what's supported in the WSTrustClient. Currently we only extract the SAML Assertion and pass it along to WSTrustClient which in turn calls JBossSTS. JBossSTS can be configured to sign the SAML tokens that it has issued and check this when when it is validating the token. At the moment we thought of adding this to the identity project but I'll let Anil and Jeff comment on this. At least at this stage this makes sense I think as this is specific to the WSTrustClient. Regards, /Daniel View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4256333#4256333 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4256333

14 years, 7 months

1
0
0 / 0

[JBoss Web Services Development] - Re: JBossSTS SOAP protocol handler

by alessio.soldano＠jboss.com

Yes, providing jaxws handlers for calling the STS is probably the easiest way here. I think the issue Anil's referring too is that "basic" security configuration (enc/dec and sign) is different from stack to stack, because of the different ws-security implementations, hence the need for having 3 different handlers. Don't know if this can be covered in the existing WSTrustClient, in that case we might probably have a single jaxws handler (and that might even be part of the jbossws-framework project). View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4256327#4256327 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4256327

14 years, 7 months

1
0
0 / 0

[JBoss Web Services Development] - Re: JBossSTS SOAP protocol handler

by beve

anonymous wrote : I am unsure we can get this done in the WS layer in a generic way. I foresee a need to have multiple handlers - one for JBossWS WS-S impl, one for CXF and other for Metro. I'm sure you are right and I'd like to know what issues you see here? The example given only uses standard JAX-WS code, nothing specific to JBossWS. Is this handled completely different for CXF and Metro perhaps? As you can probably tell I've never used them:) Thanks, /Daniel View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4256236#4256236 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4256236

14 years, 7 months

1
0
0 / 0

[JBoss Web Services Development] - Re: JBossSTS SOAP protocol handler

by anil.saldhana＠jboss.com

I am unsure we can get this done in the WS layer in a generic way. I foresee a need to have multiple handlers - one for JBossWS WS-S impl, one for CXF and other for Metro. All these handlers can do the same thing. But they need to handler the appropriate server impl. View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4256229#4256229 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4256229

14 years, 7 months

1
0
0 / 0

[JBoss Web Services Development] - JBossSTS SOAP protocol handler

by beve

Hi, we are currently working on adding SAML Token support to JBossESB: (http://www.jboss.org/index.html?module=bb&op=viewtopic&t=161206). After posting to the JBoss Identity forum: (http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4255969#4255969) I was advised to post here and get some input from the ws team. What we are trying to do is this: We have a existing SAML Token in a SOAP Security Header and this is sent to our target web service. We have written a SOAP Protocol Handler that extracts the SAML Token and calls JBossSTS to have it validated. (http://anonsvn.jboss.org/repos/labs/labs/jbossesb/workspace/dbevenius/sam...) Would be great to hear your thoughts on this and if you think this is the correct way to proceed. Thanks, /Daniel View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4256162#4256162 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4256162

14 years, 7 months

1
0
0 / 0

[JBoss Web Services Development] - Bad URL for jar resources in WSConsume

by chrholm

Hi We are using WSConsume to generate stubs for a WSDL document. We put the document in the jar-file along with the generated stubs, and specify the wsdlLocation as "file.wsdl". The @WebServiceClient file then contains the following part in a static block: | static { | URL url = null; | try { | URL baseUrl; | baseUrl = foo.Bar.class.getResource("."); | url = new URL(baseUrl, "file.wsdl"); | } catch (MalformedURLException e) { | logger.warning("Failed to create URL for the wsdl Location: 'file.wsdl', retrying as a local file"); | logger.warning(e.getMessage()); | } | PXORDER_WSDL_LOCATION = url; | } | I don't know why it makes use of the baseURL, but this fails when the resource is in a jar file. A simpler approach (that works in a jar file also), is to simply do: | static { | URL url = null; | try { | url = foo.Bar.class.getResource("file.wsdl"); | } catch (MalformedURLException e) { | logger.warning("Failed to create URL for the wsdl Location: 'file.wsdl', retrying as a local file"); | logger.warning(e.getMessage()); | } | PXORDER_WSDL_LOCATION = url; | } | View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4255319#4255319 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=4255319

14 years, 7 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jbossws-dev September 2009