RE: How to make client using SSL

["GANDHIRAJAN,AYYAPPAN (HP-India,ex2)" <ay...@hp.com>]

Hi Greg,

Did you get a chance to work with two way SSL? If so, could u please tell me
steps involved?

I have tried once to use two way SSL, but I ended up with error message
saying "401: Unauthorized user".

Thanks in advance.

regards,
Ayyappan Gandhirajan

-----Original Message-----
From: Greg Hess [mailto:ghess@wrappedapps.com]
Sent: Friday, February 27, 2004 2:04 AM
To: axis-user@ws.apache.org
Subject: RE: How to make client using SSL


Sharon,

Just ask the locator class for a stub using the method that asks for a
URL arg, and that's it.

ServiceProviderServiceLocator loc = new ServiceProviderServiceLocator();
m_stub = (ServiceProviderSoapBindingStub) loc.getServiceProvider(new
URL("https://domain/services/ServiceProvider"));

I am impressed at how easy it was to use Basic-Auth and SSL to secure my
WebService. My code didn't change at all, just passed the https url and
had the stub setUsername and setPassword and bingo.

You will have to add the Server Cert in the java truststore in order to
complete the SSLHandshaking though. Just use keytool -import.

1) Get the server certificate (server.cer)

2) Create a security folder in your containers lib

3) Go to JAVA_HOME/jre/lib/security and copy cacerts to the
container/lib/security and rename server.truststore

4) Place server.cer into that container/lib/security/server.truststore

5) Use keytool to import the cert into truststore for eg:

keytool -import -v -trustcacerts -alias tomcat -file server.cer
-keystore server.truststore -storepass changeit

6) Tell the jvm about the new truststore for eg:

<system-property
javax.net.ssl.trustStore="c:\\resin\\lib\\security\\server.truststore"/>

7) Pass the https url to your locator and should work.

More info at:

http://www.j2ee-security.net/book/dnlds/Chapter11-WebService_Security.pd
f  

Should work :-).

Cheers,

Greg

> -----Original Message-----
> From: Zhao Sharon-CSC002 [mailto:Sharon.Zhao@motorola.com]
> Sent: Thursday, February 26, 2004 3:02 PM
> To: 'axis-user@ws.apache.org'
> Subject: How to make client using SSL
> 
> Hi ,
>   I am using Axis created client stub. How do I make the client using
> TLS/SSL (under J2SE 1.4.2)? Do I need to change the client stub?
Please
> provide me some guidline here.
> 
> Thanks,
> 
> Sharon Zhao
> iDEN/WLAN, GTSS
> Motorola Inc.

RE: How to make client using SSL

[Greg Hess <gh...@wrappedapps.com>]

Hi Ayyappan,

I assume you mean developing secure clients and servers. If so yes. As
your SOAP Web Service is accessed over http just set your web server up
for ssl as per you container docs and then request you service using
https, that's it.

The only difference with the client is that you need to also add the
server cert to the truststore in order to complete SSLHandshacking.

If you received a 401: Unauthorized user this error was not thrown by
obtaining an SSL conection, if you received this error you had actually
succesfully connected via SSL but was denied access because of missing
authorization parameters like username and password. Not sure what
method of authentication the service was implementing but if it was
Basic-Auth use the stub methods setUsername and setPassoword with valid
credentials to be authorized to use the web service.

Cheers,

Greg

> -----Original Message-----
> From: GANDHIRAJAN,AYYAPPAN (HP-India,ex2)
> [mailto:ayyappan.gandhirajan@hp.com]
> Sent: Monday, March 01, 2004 12:12 AM
> To: 'axis-user@ws.apache.org'
> Subject: RE: How to make client using SSL
> 
> Hi Greg,
> 
> Did you get a chance to work with two way SSL? If so, could u please
tell
> me
> steps involved?
> 
> I have tried once to use two way SSL, but I ended up with error
message
> saying "401: Unauthorized user".
> 
> Thanks in advance.
> 
> regards,
> Ayyappan Gandhirajan
> 
> -----Original Message-----
> From: Greg Hess [mailto:ghess@wrappedapps.com]
> Sent: Friday, February 27, 2004 2:04 AM
> To: axis-user@ws.apache.org
> Subject: RE: How to make client using SSL
> 
> 
> Sharon,
> 
> Just ask the locator class for a stub using the method that asks for a
> URL arg, and that's it.
> 
> ServiceProviderServiceLocator loc = new
ServiceProviderServiceLocator();
> m_stub = (ServiceProviderSoapBindingStub) loc.getServiceProvider(new
> URL("https://domain/services/ServiceProvider"));
> 
> I am impressed at how easy it was to use Basic-Auth and SSL to secure
my
> WebService. My code didn't change at all, just passed the https url
and
> had the stub setUsername and setPassword and bingo.
> 
> You will have to add the Server Cert in the java truststore in order
to
> complete the SSLHandshaking though. Just use keytool -import.
> 
> 1) Get the server certificate (server.cer)
> 
> 2) Create a security folder in your containers lib
> 
> 3) Go to JAVA_HOME/jre/lib/security and copy cacerts to the
> container/lib/security and rename server.truststore
> 
> 4) Place server.cer into that container/lib/security/server.truststore
> 
> 5) Use keytool to import the cert into truststore for eg:
> 
> keytool -import -v -trustcacerts -alias tomcat -file server.cer
> -keystore server.truststore -storepass changeit
> 
> 6) Tell the jvm about the new truststore for eg:
> 
> <system-property
>
javax.net.ssl.trustStore="c:\\resin\\lib\\security\\server.truststore"/>
> 
> 7) Pass the https url to your locator and should work.
> 
> More info at:
> 
>
http://www.j2ee-security.net/book/dnlds/Chapter11-WebService_Security.pd
> f
> 
> Should work :-).
> 
> Cheers,
> 
> Greg
> 
> > -----Original Message-----
> > From: Zhao Sharon-CSC002 [mailto:Sharon.Zhao@motorola.com]
> > Sent: Thursday, February 26, 2004 3:02 PM
> > To: 'axis-user@ws.apache.org'
> > Subject: How to make client using SSL
> >
> > Hi ,
> >   I am using Axis created client stub. How do I make the client
using
> > TLS/SSL (under J2SE 1.4.2)? Do I need to change the client stub?
> Please
> > provide me some guidline here.
> >
> > Thanks,
> >
> > Sharon Zhao
> > iDEN/WLAN, GTSS
> > Motorola Inc.