You are viewing a plain text version of this content. The canonical link for it is here.
Posted to java-user@axis.apache.org by Andreas Fey <fe...@the-agent-factory.de> on 2007/10/31 15:21:24 UTC
Axis2 Security with Rampart
Hi,
i recently tried to secure our webservices with rampart. I did this
first for all webservice methods, and it worked well (after several
hours of unsuccessfull tries...).
But now, some of these methods have to be unsecured to enable simple
access for guest users.
I left everything unchanged except the sevice.xml, where i added a
<operation> tag for each of the secured methods and placed a <parameter>
tag inside it. Everything inside this tag was places directly under the
<service> tag at root level before.=20
Now it looks like:
<service>
[bla...]
<messageReceivers>
<messageReceiver mep=3D"http://www.w3.org/2004/08/wsdl/in-out"
class=3D"org.apache.axis2.rpc.receivers.RPCMessageReceiver"/>
</messageReceivers>
<parameter name=3D"ServiceClass">
de.tafmobile.server.services.appgenerator.sbl.ws.AppGeneratorService
</parameter>
<module ref=3D"rampart"/>
<operation name=3D"uploadMobilePhoneImage">
<messageReceiver
class=3D"org.apache.axis2.rpc.receivers.RPCMessageReceiver"/>
<parameter name=3D"InflowSecurity">
<action>
<items>UsernameToken</items>
<passwordCallbackClass>de.tafmobile.server.Axis2PasswordCallbackHandler</pa=
sswordCallbackClass>
</action>
</parameter>
</operation>
[/bla...]
</service>
The problem is, that this seems to have no effect; results of the
secured methods can be obtained without any security stuff. To
complicate this i bit more, if i call a webservice method directly via
URL (instead of using ".wsdl" after the service URL use
"/<methodname>"), an error concerning a missing security - tag is
displayed. But, just to make this clear, if i call the method via Axis2
Java Code, i get no error but results!
Thank you very much for your help,
Andreas
---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org
Re: Axis2 Security with Rampart
Posted by Andreas Fey <fe...@the-agent-factory.de>.
Hi,
it's 1.3, like the axis2 version which i'm using.
Best,
Andreas
Am Dienstag, den 31.10.2000, 09:29 -0500 schrieb Martin Gainty:
> Hello Andreas-
>
> which version Rampart are you using?
>
> Thanks/
> Martin--
> ----- Original Message -----
> From: "Andreas Fey" <fe...@the-agent-factory.de>
> To: <ax...@ws.apache.org>
> Sent: Wednesday, October 31, 2007 9:21 AM
> Subject: Axis2 Security with Rampart
>
>
> > Hi,
> >
> > i recently tried to secure our webservices with rampart. I did this
> > first for all webservice methods, and it worked well (after several
> > hours of unsuccessfull tries...).
> >
> > But now, some of these methods have to be unsecured to enable simple
> > access for guest users.
> >
> > I left everything unchanged except the sevice.xml, where i added a
> > <operation> tag for each of the secured methods and placed a <parameter>
> > tag inside it. Everything inside this tag was places directly under the
> > <service> tag at root level before.=20
> > Now it looks like:
> >
> > <service>
> > [bla...]
> >
> > <messageReceivers>
> > <messageReceiver mep=3D"http://www.w3.org/2004/08/wsdl/in-out"
> > class=3D"org.apache.axis2.rpc.receivers.RPCMessageReceiver"/>
> > </messageReceivers>
> >
> > <parameter name=3D"ServiceClass">
> > de.tafmobile.server.services.appgenerator.sbl.ws.AppGeneratorService
> > </parameter>
> >
> > <module ref=3D"rampart"/>
> >
> > <operation name=3D"uploadMobilePhoneImage">
> > <messageReceiver
> > class=3D"org.apache.axis2.rpc.receivers.RPCMessageReceiver"/>
> >
> > <parameter name=3D"InflowSecurity">
> > <action>
> > <items>UsernameToken</items>
> >
> <passwordCallbackClass>de.tafmobile.server.Axis2PasswordCallbackHandler</pa=
> > sswordCallbackClass>
> > </action>
> > </parameter>
> > </operation>
> >
> > [/bla...]
> > </service>
> >
> > The problem is, that this seems to have no effect; results of the
> > secured methods can be obtained without any security stuff. To
> > complicate this i bit more, if i call a webservice method directly via
> > URL (instead of using ".wsdl" after the service URL use
> > "/<methodname>"), an error concerning a missing security - tag is
> > displayed. But, just to make this clear, if i call the method via Axis2
> > Java Code, i get no error but results!
> >
> >
> > Thank you very much for your help,
> >
> > Andreas
> >
> >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
> > For additional commands, e-mail: axis-user-help@ws.apache.org
> >
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
> For additional commands, e-mail: axis-user-help@ws.apache.org
>
>
--
Dipl. Inf. (FH) Andreas Fey
Development
#############################################
Besuchen Sie uns am 07. und 08.11.2007
auf der Insight E-Commerce Konferenz in Jena.
Weitere Informationen finden Sie unter:
www.insight-e-commerce.de
#############################################
the agent factory GmbH Tel: +49 3641 573 3485
c/o Intershop Tower Fax: +49 3641 573 3488
Leutragraben 1
D-07743 Jena Email: fey@the-agent-factory.de
Germany Web: www.the-agent-factory.de
Geschäftsführer/Managing Director: Michael Selle
Registergericht/Register Court: Amtsgericht Jena
Handelsregisternummer/Trade Register Number: HRB 209769
the agent factory GmbH is member of TowerByte eG
More information can be found at www.towerbyte.de.
This email may contain confidential and/or privileged information.
If you are not the intended recipient (or have received this email
in error) please notify the sender immediately and destroy this
email. Any unauthorised copying, disclosure or distribution of the
material in this email is strictly forbidden.