May 2008 - jbossws-issues - Jboss List Archives

[JBoss JIRA] Created: (JBWS-1999) WS-Security Usename Token Profile JAAS Implementation for JSE based WebServices

by Thomas Diesler (JIRA)

WS-Security Usename Token Profile JAAS Implementation for JSE based WebServices ------------------------------------------------------------------------------- Key: JBWS-1999 URL: http://jira.jboss.com/jira/browse/JBWS-1999 Project: JBoss Web Services Issue Type: Task Security Level: Public (Everyone can see) Components: jbossws-native Reporter: Thomas Diesler Fix For: jbossws-native-2.0.4 Karl de Boer sais: I created a Username TokenProfile implementation where the userid pwd are verified against the active JAAS SecurityManager I want to share this with you. It appears to me there is only support for EJB based webservices for this. So i had to create it myself in the form of a messagehandler and some glue to integrate with JBossSX. In general i think the focus is to much on EJB Based services. I prefer the WSDL first approach to define a proper SOA. It is not a perfect implementation. I do'nt do anything with Nonce and Timestamp and i also do not support passwordDigest. So i also do not use any keystores (PasswordText is protect by the transport layer in my case (SSL)). I saw there is an issue in JIRA where the keystore shoud not be required. This is such a case. I also was surprised that JBossWS does not check anymore for the requires Username section in Jboss-wsse-server.xml. But for this there is also as JIRA issue What i did in a separate messagehandler should perhaps be moved to the WSSecurityDispatcher, which takes care of all WSSecurity related stuff. To activate the messagehandler processing i simply adjusted the default the standard-jaxws-endpoint-config.xml <endpoint-config> <config-name>Standard WSSecurity Endpoint</config-name> <post-handler-chains> <javaee:handler-chain> <javaee:protocol-bindings>##SOAP11_HTTP</javaee:protocol-bindings> <javaee:handler> <javaee:handler-name>WSSecurity Handler</javaee:handler-name> <javaee:handler-class>org.jboss.ws.extensions.security.jaxws.WSSecurityHandlerServer</javaee:handler-class> </javaee:handler> <javaee:handler> <javaee:handler-name>UserNameTokenProfileMessageHandler</javaee:handler-name> <javaee:handler-class>nl.jnc.common.services.wssecurity.UserNameTokenProfileMessageHandler</javaee:handler-class> </javaee:handler> </javaee:handler-chain> </post-handler-chains> </endpoint-config> I did not investigate how to link the authenticated user (principal) and associated roles to the WebServiceContext. I directly refer to the SecurityAssociation class which stores Subject and Principal in threadlocal. In the SEI implementaion is use the princiap and roles like this (cloul be improved): private boolean isUserInRole(String roleName) { Subject sub = SecurityAssociation.getSubject(); if (sub != null) { Set<Principal> set = SecurityAssociation.getSubject().getPrincipals(); if (set!= null) { for (Principal p : set) { if (p instanceof SimpleGroup) { SimpleGroup ng = (SimpleGroup) p; Enumeration mem = ng.members(); while (mem.hasMoreElements()) { Principal p1 = (Principal) mem.nextElement(); if (p1.getName().equalsIgnoreCase(roleName)) return true; } } } } } return false; } Attached you will find the rest. You are free to use it the way you like. In the WsSecurityManager you will also find some a method to authenticate a user with a certificate but this is not tested. I use the security implementation against an LDAP (LdapLoginModule). The users are system accounts, the data(sections) returned by the service are governed by the roles a system users has. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

15 years, 3 months

3
10
0 / 0

[JBoss JIRA] Created: (JBWS-2117) web.xml modified to web.xml.org - Subsequent runs fail

by Thomas Diesler (JIRA)

web.xml modified to web.xml.org - Subsequent runs fail ------------------------------------------------------ Key: JBWS-2117 URL: http://jira.jboss.com/jira/browse/JBWS-2117 Project: JBoss Web Services Issue Type: Bug Security Level: Public (Everyone can see) Affects Versions: jbossws-2.0.0 Reporter: Thomas Diesler Assigned To: Thomas Diesler Fix For: jbossws-native-2.0.3 -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

15 years, 3 months

2
7
0 / 0

[JBoss JIRA] Created: (JBWS-1683) Fix JAXR samples for XFire

by Thomas Diesler (JIRA)

Fix JAXR samples for XFire -------------------------- Key: JBWS-1683 URL: http://jira.jboss.com/jira/browse/JBWS-1683 Project: JBoss Web Services Issue Type: Bug Security Level: Public (Everyone can see) Components: integration-sunri Reporter: Thomas Diesler Fix For: jbossws-2.1.0 2007-06-01 06:12:43,257 ERROR [org.jboss.jaxr.juddi.transport.SaajTransport:94] Exception:: org.w3c.dom.DOMException: NAMESPACE_ERR: An attempt is made to create or change an object in a way which is incorrect with regard to namespaces. at com.sun.org.apache.xerces.internal.dom.CoreDocumentImpl.checkDOMNSErr(CoreDocumentImpl.java:2409) at com.sun.org.apache.xerces.internal.dom.AttrNSImpl.setName(AttrNSImpl.java:150) at com.sun.org.apache.xerces.internal.dom.AttrNSImpl.<init>(AttrNSImpl.java:111) at com.sun.org.apache.xerces.internal.dom.CoreDocumentImpl.createAttributeNS(CoreDocumentImpl.java:2012) at com.sun.xml.messaging.saaj.soap.SOAPDocumentImpl.createAttributeNS(SOAPDocumentImpl.java:161) at com.sun.org.apache.xerces.internal.dom.ElementImpl.setAttributeNS(ElementImpl.java:684) at com.sun.xml.messaging.saaj.soap.impl.ElementImpl.setAttributeNS(ElementImpl.java:1241) at com.sun.xml.messaging.saaj.soap.impl.ElementImpl.addAttributeBare(ElementImpl.java:499) at com.sun.xml.messaging.saaj.soap.impl.ElementImpl.addAttributeBare(ElementImpl.java:471) at com.sun.xml.messaging.saaj.soap.impl.ElementImpl.addAttribute(ElementImpl.java:454) at org.jboss.jaxr.juddi.transport.SaajTransport.appendAttributes(SaajTransport.java:156) at org.jboss.jaxr.juddi.transport.SaajTransport.appendElements(SaajTransport.java:180) at org.jboss.jaxr.juddi.transport.SaajTransport.appendElements(SaajTransport.java:181) at org.jboss.jaxr.juddi.transport.SaajTransport.createSOAPMessage(SaajTransport.java:136) at org.jboss.jaxr.juddi.transport.SaajTransport.send(SaajTransport.java:77) at org.apache.juddi.proxy.RegistryProxy.execute(RegistryProxy.java:368) at org.apache.juddi.AbstractRegistry.saveBusiness(AbstractRegistry.java:582) at org.apache.ws.scout.registry.BusinessLifeCycleManagerImpl.executeOperation(BusinessLifeCycleManagerImpl.java:532) at org.apache.ws.scout.registry.BusinessLifeCycleManagerImpl.saveOrganizations(BusinessLifeCycleManagerImpl.java:389) at org.jboss.test.ws.jaxws.samples.jaxr.scout.query.JaxrBusinessQueryTestCase.setUp(JaxrBusinessQueryTestCase.java:58) -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

15 years, 3 months

2
12
0 / 0

[JBoss JIRA] Created: (JBWS-2119) WebServiceRef injection from DD doesn't work

by Thomas Diesler (JIRA)

WebServiceRef injection from DD doesn't work -------------------------------------------- Key: JBWS-2119 URL: http://jira.jboss.com/jira/browse/JBWS-2119 Project: JBoss Web Services Issue Type: Bug Security Level: Public (Everyone can see) Affects Versions: jbossws-2.0.1 Reporter: Thomas Diesler Assigned To: Heiko Braun Fix For: jbossws-native-2.0.3 Specifying a service-ref in ejb-jar.xml like this doesn't work. <?xml version="1.0" encoding="UTF-8"?> <ejb-jar xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/ejb-jar_3_0.xsd" version="3.0"> <description>jBoss test application </description> <display-name>Test</display-name> <enterprise-beans> <session> <ejb-name>StatelessBean</ejb-name> <service-ref> <service-ref-name>service/Endpoint3</service-ref-name> <service-interface>org.jboss.ejb3.test.webservices.jsr181.EndpointInterface</service-interface> <mapped-name>jbossws-client/service/TestService</mapped-name> <injection-target> <injection-target-class>org.jboss.ejb3.test.webservices.jsr181.StatelessBean</injection-target-class> <injection-target-name>endpoint3</injection-target-name> </injection-target> </service-ref> </session> </enterprise-beans> </ejb-jar> -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

15 years, 4 months

2
2
0 / 0

[JBoss JIRA] Created: (JBWS-2114) Soap attachments are dropped on server response when added in ejb3 jaxws handler

by Thomas Diesler (JIRA)

Soap attachments are dropped on server response when added in ejb3 jaxws handler -------------------------------------------------------------------------------- Key: JBWS-2114 URL: http://jira.jboss.com/jira/browse/JBWS-2114 Project: JBoss Web Services Issue Type: Bug Security Level: Public (Everyone can see) Components: jbossws-native Environment: windows, linux, jdk1.5 Reporter: Thomas Diesler Assigned To: Heiko Braun Fix For: jbossws-2.0.0 Soap attachments were dropped on server responses. Attachment can be added on a handler's handleResponse method; however it mysteriously disappeared on the outgoing soap message. The problem was in the ServiceEndpointInvoker. It overwrote the SOAPMessage in the MessageContext. In this class, the method invokeServiceEndpoint was overwritten by ServiceEndpointInvokerEJB21, which invokes the EJB via the ServiceEndpointInterceptor. This ServiceEndpointInterceptor invokes the EJB and also the handlers; it creates the correct SOAPMessage and sets it in the ContextContext. Unfortunately, it was overwritten later by the ServiceEndpointInvoker. Fixes are attached. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

15 years, 4 months

2
3
0 / 0

[JBoss JIRA] Created: (JBWS-2195) MTOM services seem to return two extra bytes at the end

by Heiko Braun (JIRA)

MTOM services seem to return two extra bytes at the end ------------------------------------------------------- Key: JBWS-2195 URL: http://jira.jboss.com/jira/browse/JBWS-2195 Project: JBoss Web Services Issue Type: Bug Security Level: Public (Everyone can see) Affects Versions: jbossws-native-3.0.1 Reporter: Heiko Braun Fix For: jbossws-native-3.0.3 -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

15 years, 4 months

4
4
0 / 0

[JBoss JIRA] Created: (JBWS-2090) Setup mailing lists for metro, cxf user forums

by Thomas Diesler (JIRA)

Setup mailing lists for metro,cxf user forums --------------------------------------------- Key: JBWS-2090 URL: http://jira.jboss.com/jira/browse/JBWS-2090 Project: JBoss Web Services Issue Type: Task Security Level: Public (Everyone can see) Reporter: Thomas Diesler Assigned To: Heiko Braun Fix For: jbossws-3.0.2 -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

15 years, 4 months

5
17
0 / 0

[JBoss JIRA] Created: (JBWS-2196) FastInfoset interoperability

by Thomas Diesler (JIRA)

FastInfoset interoperability ---------------------------- Key: JBWS-2196 URL: http://jira.jboss.com/jira/browse/JBWS-2196 Project: JBoss Web Services Issue Type: Task Security Level: Public (Everyone can see) Components: jbossws-integration Reporter: Thomas Diesler Alexander Philippou sais MSFT doesn't offer a Fast Infoset implementation. For WCF, Fast Infoset is provided by Noemax's WCF-Xtensions. I assume that general JBossWS<->WCF interop is given so we just need to focus on trying Fast Infoset as message encoding. This will also test content negotiation, which again is provided only by WCF-Xtensions. We have raised a test service, its wsdl is at http://www.noemax.com:8080/BenchmarkService?wsdl. It will be great if you can run a client to test it. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

15 years, 5 months

2
1
0 / 0

[JBoss JIRA] Created: (JBWS-1862) RPC DII Calls Assume child element of soap:body is called 'result' in the response message.

by Darran Lofthouse (JIRA)

RPC DII Calls Assume child element of soap:body is called 'result' in the response message. ------------------------------------------------------------------------------------------- Key: JBWS-1862 URL: http://jira.jboss.com/jira/browse/JBWS-1862 Project: JBoss Web Services Issue Type: Bug Security Level: Public (Everyone can see) Components: jbossws-jaxrpc Affects Versions: jbossws-1.2.1 Reporter: Darran Lofthouse Assigned To: Darran Lofthouse Fix For: jbossws-2.0.3 RPC DII Calls Assume child element of soap:body is called 'result' in the response message. For document style endpoints it will fall back to checking the type but for RPC calls if the name does not match the following error will be reported. java.rmi.RemoteException: Call invocation failed; nested exception is: org.jboss.ws.WSException: Cannot find child element: result at org.jboss.ws.core.jaxrpc.client.CallImpl.invokeInternal(CallImpl.java:526) at org.jboss.ws.core.jaxrpc.client.CallImpl.invoke(CallImpl.java:276) ... Caused by: org.jboss.ws.WSException: Cannot find child element: result at org.jboss.ws.core.CommonSOAPBinding.getParameterFromMessage(CommonSOAPBinding.java:866) at org.jboss.ws.core.CommonSOAPBinding.unbindResponseMessage(CommonSOAPBinding.java:586) at org.jboss.ws.core.CommonClient.invoke(CommonClient.java:356) at org.jboss.ws.core.jaxrpc.client.CallImpl.invokeInternal(CallImpl.java:507) ... 2 more -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

15 years, 5 months

4
8
0 / 0

[JBoss JIRA] Created: (JBWS-2165) Fix xop tests with maven build

by Thomas Diesler (JIRA)

Fix xop tests with maven build ------------------------------ Key: JBWS-2165 URL: http://jira.jboss.com/jira/browse/JBWS-2165 Project: JBoss Web Services Issue Type: Task Security Level: Public (Everyone can see) Components: jbossws-metro Reporter: Thomas Diesler Fix For: jbossws-metro-3.0.2 -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

15 years, 5 months

2
10
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jbossws-issues May 2008