[JBossWS] - Ignore certificate validation in client side (using JBoss4.
by J2EEUser
I want to use https for encryption using only Server side authentication. I created a self-signed certificated and installed it in the server.
In my client side I want to ignore the certificate validation.
I am using Jboss4.0.3sp1 application server and clientside is developed with jboss-axis client (axis-ws4ee.jar).
I tried the following options.
1. Created trustmanager to accept anycertificates and initialized sslcontext with my own trust manager
sample code
======
TrustManager[] trustAllCerts = new TrustManager[] {
new X509TrustManager() {
public java.security.cert.X509Certificate[] getAcceptedIssuers() {return null; }
public void checkClientTrusted(
java.security.cert.X509Certificate[] certs, String authType) {}
public void checkServerTrusted(
java.security.cert.X509Certificate[] certs, String authType) {}
}
} ;
SSLContext context;
context = SSLContext.getInstance("SSL");
HttpsURLConnection.setDefaultSSLSocketFactory(context.getSocketFactory());
============
2. Tried to set the AxisProeprties to sunfaketrustFactory
AxisProperties.setProperty("axis.socketSecureFactory" ,"org.apache.axis.components.net.SunFakeTrustSocketFactory");
None of the above are working.
Looks like SunFakeTrustSocketFactory class was removed in JBoss4.0.3sp1- axis-ws4ee.jar and it was availble in JBoss4.0.2- axis-ws4ee.jar
I need to fix this issue ASAP as our product needs to be released next week.
Any tip will be appreciate.
Thanks in advance,
RR
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4041456#4041456
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4041456
17 years, 8 months
[JBossWS] - Re: Problem with Context for WSAddressing in Jaxrpc and Jaxw
by Pires da Silva
thanks for answer.
I noticed this morning you used up-to-date jars for running your samples , jars that you retrieved from web sites (force.thirdparty.get property in your build.xml), so concerning Jaxws version -with @resource WebServiceContext- I just copied the jars jaxb-api and jaxb-impl instead of the previous older jars of Jboss AS 4.2.0.CR2 and it is ok, injection of WebServiceContext is working.
I mentioned there are lots of jars retrieved that way. From now I don't know exactly how to constitute a clean environment for our deployment.
I think it is better to use last version Jboss-1.2.0.SP1 (or may be next Jboss-1.2.1.GA) than version Jboss-1.0.3 I was previously working with.
So I'm using Jboss 4.0.2.CR2 with Jboss-1.2.0.SP1.
I'm using WSAddressing for session management, if possible HTTPS and basic authentication (which is easy through context if I remember well), MTOM to get/post binary content. To avoid interoperability problems in the previous version we delivered, we specified our API only through the description of the SOAP messages exchanged; I don't know from the moment how to constitude a SOAP message with a binary part (i.e. to be sent through MTOM instead of SOAP with attachments).
Do you thing it is possible without risks to propose our API as a web service instead of specifying the soap messages?
I will write a source code then generate the wsdl so I ask you if the generated wsdl will be compatible with any clients based on any web services stack?
Our deployment must be done soon so I'm asking you the versions appropriate of JbossAS and JbossWS.
Thanks a lot
CPires
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4041387#4041387
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4041387
17 years, 8 months