You are viewing a plain text version of this content. The canonical link for it is here.
Posted to soap-user@xml.apache.org by Michael Paolini <pa...@us.ibm.com> on 2000/12/05 17:29:22 UTC
SSL
What is the current status of SSL in Apache SOAP? Has the base code been
checked in yet?
Thanks,
Mike
----------------------------------------------------------------------------------------------------------------------------------
"A doctor can bury his mistakes, an architect can only advise his client to
plant vines...." -Frank Lloyd Wright
Internet ID: paolini@us.ibm.com
IBM Internal e-mail ID: PAOLINI/Austin/IBM
Re: SSL
Posted by Sanjiva Weerawarana <sa...@watson.ibm.com>.
Hi George,
[I have cc'ed this to soap-dev because there's discussion of
committing code. Please keep soap-dev cc'ed of any code change
discussions in general.]
Please DO NOT commit the server-side SSL implementation code you
posted earlier. I am not a security guy, but I have to buy the
argument that Darrel posted which said we can't define a security
solution ourselves .. the security community has to do it or
it'll not be accepted. As such, I am putting a -1 on committing
any code that implements a security solution without it coming
with participation from the security community.
The problem with URLConnection in JDK 1.2 is that it doesn't give
access to the content when an HTTP 500 is received. That's broken
for SOAP. Later JDKs have apparently fixed it, but we cannot
not support 1.2 (I think we even support 1.1.* yet, which is a
good thing). "we should get Sun to fix it" is a nice thought, but
it doesn't work that way .. :-)
SSL on the client-side is ABSOLUTELY useful for SOAP. What that
says is that authentication is done via some other mechanism,
say HTTP Basic, and SSL is used to make the interactions secure.
I would like to get the client-side SSL code committed ASAP so
that we can include it in the next Apache SOAP release.
Sanjiva.
----- Original Message -----
From: "George I Matkovits" <ma...@uswest.net>
To: <so...@xml.apache.org>; <pa...@us.ibm.com>;
<le...@lawson.com>; <sa...@watson.ibm.com>; <ma...@lawson.com>
Sent: Wednesday, December 06, 2000 11:00 PM
Subject: Re: SSL
> I have not checked it in yet. I use a URL connection with an Apache
front-end (which does the server side SSL) to a backend Tomcat. I
> never had any problems but I am told that the Soap V3 people do not want an
URL based SSL solution but a socket based one. I have
> been trying to get the latest CVS working since 12/1 but no luck (this is
the CVS base I would have to do the check in against). I got
> the base again tonight and hope to have better luck. Soap from the Apache
CVS base does the 1st Soap request OK and then deep-ends in
> re-establishing its context for the 2nd call. Should I check it in when it
can not be tested? I would like to get the latest WSTK
> also with Apache Soap, just now I do not really know what to do next! I
would very much appreciate any advise. My current version of
> Soap is from 9/18 and it is rather dated. The Soap changes are rather
trivial (thanks to Java) I fail to understand what the big deal
> is with SSL, it is simple when done with Java over an URL connection. If
there are any problems with error status then we should get
> Sun to fix it. SSL over sockets can be done but that is more like
traditional procedure programming and some of the URL based client
> side cookie management (which we need for servlet state management) might
not work properly. Only extensive testing could uncover
> these kind of problems but NOT with the currently NOT REALLY WORKING CVS
BASE. (-:
> Thank you - George
>
> p.s. I am sorry for not checking in SSL earlier but SSL without encrypted
passwords and without automated generation of the SERVER's
> ACL (for many client's with different encrypted passwords) is NOT a security
solution! (-: It would be professionally IRRESPONSIBLE to
> give just an SSL solution to the community without providing a complete
Security package! I have been working on that and my last
> posting is almost there on the old 9/18 base) If SSL would help WSTK then I
will do my best but could I just do it with WSTK, please?
> (my company would like to get a license ASAP and probably would have no
problem with returning any changes made against the WSTK Code
> Base. It would be in our interest to have it included in any future
releases.)
> Michael Paolini wrote:
>
> > What is the current status of SSL in Apache SOAP? Has the base code been
> > checked in yet?
> >
> > Thanks,
> > Mike
> >
>
> ----------------------------------------------------------------------------
------------------------------------------------------
> >
> > "A doctor can bury his mistakes, an architect can only advise his client
to
> > plant vines...." -Frank Lloyd Wright
> >
> > Internet ID: paolini@us.ibm.com
> > IBM Internal e-mail ID: PAOLINI/Austin/IBM
>
Re: SSL
Posted by Sanjiva Weerawarana <sa...@watson.ibm.com>.
Hi George,
[I have cc'ed this to soap-dev because there's discussion of
committing code. Please keep soap-dev cc'ed of any code change
discussions in general.]
Please DO NOT commit the server-side SSL implementation code you
posted earlier. I am not a security guy, but I have to buy the
argument that Darrel posted which said we can't define a security
solution ourselves .. the security community has to do it or
it'll not be accepted. As such, I am putting a -1 on committing
any code that implements a security solution without it coming
with participation from the security community.
The problem with URLConnection in JDK 1.2 is that it doesn't give
access to the content when an HTTP 500 is received. That's broken
for SOAP. Later JDKs have apparently fixed it, but we cannot
not support 1.2 (I think we even support 1.1.* yet, which is a
good thing). "we should get Sun to fix it" is a nice thought, but
it doesn't work that way .. :-)
SSL on the client-side is ABSOLUTELY useful for SOAP. What that
says is that authentication is done via some other mechanism,
say HTTP Basic, and SSL is used to make the interactions secure.
I would like to get the client-side SSL code committed ASAP so
that we can include it in the next Apache SOAP release.
Sanjiva.
----- Original Message -----
From: "George I Matkovits" <ma...@uswest.net>
To: <so...@xml.apache.org>; <pa...@us.ibm.com>;
<le...@lawson.com>; <sa...@watson.ibm.com>; <ma...@lawson.com>
Sent: Wednesday, December 06, 2000 11:00 PM
Subject: Re: SSL
> I have not checked it in yet. I use a URL connection with an Apache
front-end (which does the server side SSL) to a backend Tomcat. I
> never had any problems but I am told that the Soap V3 people do not want an
URL based SSL solution but a socket based one. I have
> been trying to get the latest CVS working since 12/1 but no luck (this is
the CVS base I would have to do the check in against). I got
> the base again tonight and hope to have better luck. Soap from the Apache
CVS base does the 1st Soap request OK and then deep-ends in
> re-establishing its context for the 2nd call. Should I check it in when it
can not be tested? I would like to get the latest WSTK
> also with Apache Soap, just now I do not really know what to do next! I
would very much appreciate any advise. My current version of
> Soap is from 9/18 and it is rather dated. The Soap changes are rather
trivial (thanks to Java) I fail to understand what the big deal
> is with SSL, it is simple when done with Java over an URL connection. If
there are any problems with error status then we should get
> Sun to fix it. SSL over sockets can be done but that is more like
traditional procedure programming and some of the URL based client
> side cookie management (which we need for servlet state management) might
not work properly. Only extensive testing could uncover
> these kind of problems but NOT with the currently NOT REALLY WORKING CVS
BASE. (-:
> Thank you - George
>
> p.s. I am sorry for not checking in SSL earlier but SSL without encrypted
passwords and without automated generation of the SERVER's
> ACL (for many client's with different encrypted passwords) is NOT a security
solution! (-: It would be professionally IRRESPONSIBLE to
> give just an SSL solution to the community without providing a complete
Security package! I have been working on that and my last
> posting is almost there on the old 9/18 base) If SSL would help WSTK then I
will do my best but could I just do it with WSTK, please?
> (my company would like to get a license ASAP and probably would have no
problem with returning any changes made against the WSTK Code
> Base. It would be in our interest to have it included in any future
releases.)
> Michael Paolini wrote:
>
> > What is the current status of SSL in Apache SOAP? Has the base code been
> > checked in yet?
> >
> > Thanks,
> > Mike
> >
>
> ----------------------------------------------------------------------------
------------------------------------------------------
> >
> > "A doctor can bury his mistakes, an architect can only advise his client
to
> > plant vines...." -Frank Lloyd Wright
> >
> > Internet ID: paolini@us.ibm.com
> > IBM Internal e-mail ID: PAOLINI/Austin/IBM
>
Re: SSL
Posted by Sanjiva Weerawarana <sa...@watson.ibm.com>.
Hi George,
[I have cc'ed this to soap-dev because there's discussion of
committing code. Please keep soap-dev cc'ed of any code change
discussions in general.]
Please DO NOT commit the server-side SSL implementation code you
posted earlier. I am not a security guy, but I have to buy the
argument that Darrel posted which said we can't define a security
solution ourselves .. the security community has to do it or
it'll not be accepted. As such, I am putting a -1 on committing
any code that implements a security solution without it coming
with participation from the security community.
The problem with URLConnection in JDK 1.2 is that it doesn't give
access to the content when an HTTP 500 is received. That's broken
for SOAP. Later JDKs have apparently fixed it, but we cannot
not support 1.2 (I think we even support 1.1.* yet, which is a
good thing). "we should get Sun to fix it" is a nice thought, but
it doesn't work that way .. :-)
SSL on the client-side is ABSOLUTELY useful for SOAP. What that
says is that authentication is done via some other mechanism,
say HTTP Basic, and SSL is used to make the interactions secure.
I would like to get the client-side SSL code committed ASAP so
that we can include it in the next Apache SOAP release.
Sanjiva.
----- Original Message -----
From: "George I Matkovits" <ma...@uswest.net>
To: <so...@xml.apache.org>; <pa...@us.ibm.com>;
<le...@lawson.com>; <sa...@watson.ibm.com>; <ma...@lawson.com>
Sent: Wednesday, December 06, 2000 11:00 PM
Subject: Re: SSL
> I have not checked it in yet. I use a URL connection with an Apache
front-end (which does the server side SSL) to a backend Tomcat. I
> never had any problems but I am told that the Soap V3 people do not want an
URL based SSL solution but a socket based one. I have
> been trying to get the latest CVS working since 12/1 but no luck (this is
the CVS base I would have to do the check in against). I got
> the base again tonight and hope to have better luck. Soap from the Apache
CVS base does the 1st Soap request OK and then deep-ends in
> re-establishing its context for the 2nd call. Should I check it in when it
can not be tested? I would like to get the latest WSTK
> also with Apache Soap, just now I do not really know what to do next! I
would very much appreciate any advise. My current version of
> Soap is from 9/18 and it is rather dated. The Soap changes are rather
trivial (thanks to Java) I fail to understand what the big deal
> is with SSL, it is simple when done with Java over an URL connection. If
there are any problems with error status then we should get
> Sun to fix it. SSL over sockets can be done but that is more like
traditional procedure programming and some of the URL based client
> side cookie management (which we need for servlet state management) might
not work properly. Only extensive testing could uncover
> these kind of problems but NOT with the currently NOT REALLY WORKING CVS
BASE. (-:
> Thank you - George
>
> p.s. I am sorry for not checking in SSL earlier but SSL without encrypted
passwords and without automated generation of the SERVER's
> ACL (for many client's with different encrypted passwords) is NOT a security
solution! (-: It would be professionally IRRESPONSIBLE to
> give just an SSL solution to the community without providing a complete
Security package! I have been working on that and my last
> posting is almost there on the old 9/18 base) If SSL would help WSTK then I
will do my best but could I just do it with WSTK, please?
> (my company would like to get a license ASAP and probably would have no
problem with returning any changes made against the WSTK Code
> Base. It would be in our interest to have it included in any future
releases.)
> Michael Paolini wrote:
>
> > What is the current status of SSL in Apache SOAP? Has the base code been
> > checked in yet?
> >
> > Thanks,
> > Mike
> >
>
> ----------------------------------------------------------------------------
------------------------------------------------------
> >
> > "A doctor can bury his mistakes, an architect can only advise his client
to
> > plant vines...." -Frank Lloyd Wright
> >
> > Internet ID: paolini@us.ibm.com
> > IBM Internal e-mail ID: PAOLINI/Austin/IBM
>
Re: SSL
Posted by Sanjiva Weerawarana <sa...@watson.ibm.com>.
Hi George,
[I have cc'ed this to soap-dev because there's discussion of
committing code. Please keep soap-dev cc'ed of any code change
discussions in general.]
Please DO NOT commit the server-side SSL implementation code you
posted earlier. I am not a security guy, but I have to buy the
argument that Darrel posted which said we can't define a security
solution ourselves .. the security community has to do it or
it'll not be accepted. As such, I am putting a -1 on committing
any code that implements a security solution without it coming
with participation from the security community.
The problem with URLConnection in JDK 1.2 is that it doesn't give
access to the content when an HTTP 500 is received. That's broken
for SOAP. Later JDKs have apparently fixed it, but we cannot
not support 1.2 (I think we even support 1.1.* yet, which is a
good thing). "we should get Sun to fix it" is a nice thought, but
it doesn't work that way .. :-)
SSL on the client-side is ABSOLUTELY useful for SOAP. What that
says is that authentication is done via some other mechanism,
say HTTP Basic, and SSL is used to make the interactions secure.
I would like to get the client-side SSL code committed ASAP so
that we can include it in the next Apache SOAP release.
Sanjiva.
----- Original Message -----
From: "George I Matkovits" <ma...@uswest.net>
To: <so...@xml.apache.org>; <pa...@us.ibm.com>;
<le...@lawson.com>; <sa...@watson.ibm.com>; <ma...@lawson.com>
Sent: Wednesday, December 06, 2000 11:00 PM
Subject: Re: SSL
> I have not checked it in yet. I use a URL connection with an Apache
front-end (which does the server side SSL) to a backend Tomcat. I
> never had any problems but I am told that the Soap V3 people do not want an
URL based SSL solution but a socket based one. I have
> been trying to get the latest CVS working since 12/1 but no luck (this is
the CVS base I would have to do the check in against). I got
> the base again tonight and hope to have better luck. Soap from the Apache
CVS base does the 1st Soap request OK and then deep-ends in
> re-establishing its context for the 2nd call. Should I check it in when it
can not be tested? I would like to get the latest WSTK
> also with Apache Soap, just now I do not really know what to do next! I
would very much appreciate any advise. My current version of
> Soap is from 9/18 and it is rather dated. The Soap changes are rather
trivial (thanks to Java) I fail to understand what the big deal
> is with SSL, it is simple when done with Java over an URL connection. If
there are any problems with error status then we should get
> Sun to fix it. SSL over sockets can be done but that is more like
traditional procedure programming and some of the URL based client
> side cookie management (which we need for servlet state management) might
not work properly. Only extensive testing could uncover
> these kind of problems but NOT with the currently NOT REALLY WORKING CVS
BASE. (-:
> Thank you - George
>
> p.s. I am sorry for not checking in SSL earlier but SSL without encrypted
passwords and without automated generation of the SERVER's
> ACL (for many client's with different encrypted passwords) is NOT a security
solution! (-: It would be professionally IRRESPONSIBLE to
> give just an SSL solution to the community without providing a complete
Security package! I have been working on that and my last
> posting is almost there on the old 9/18 base) If SSL would help WSTK then I
will do my best but could I just do it with WSTK, please?
> (my company would like to get a license ASAP and probably would have no
problem with returning any changes made against the WSTK Code
> Base. It would be in our interest to have it included in any future
releases.)
> Michael Paolini wrote:
>
> > What is the current status of SSL in Apache SOAP? Has the base code been
> > checked in yet?
> >
> > Thanks,
> > Mike
> >
>
> ----------------------------------------------------------------------------
------------------------------------------------------
> >
> > "A doctor can bury his mistakes, an architect can only advise his client
to
> > plant vines...." -Frank Lloyd Wright
> >
> > Internet ID: paolini@us.ibm.com
> > IBM Internal e-mail ID: PAOLINI/Austin/IBM
>
Re: SSL
Posted by George I Matkovits <ma...@uswest.net>.
I have not checked it in yet. I use a URL connection with an Apache front-end (which does the server side SSL) to a backend Tomcat. I
never had any problems but I am told that the Soap V3 people do not want an URL based SSL solution but a socket based one. I have
been trying to get the latest CVS working since 12/1 but no luck (this is the CVS base I would have to do the check in against). I got
the base again tonight and hope to have better luck. Soap from the Apache CVS base does the 1st Soap request OK and then deep-ends in
re-establishing its context for the 2nd call. Should I check it in when it can not be tested? I would like to get the latest WSTK
also with Apache Soap, just now I do not really know what to do next! I would very much appreciate any advise. My current version of
Soap is from 9/18 and it is rather dated. The Soap changes are rather trivial (thanks to Java) I fail to understand what the big deal
is with SSL, it is simple when done with Java over an URL connection. If there are any problems with error status then we should get
Sun to fix it. SSL over sockets can be done but that is more like traditional procedure programming and some of the URL based client
side cookie management (which we need for servlet state management) might not work properly. Only extensive testing could uncover
these kind of problems but NOT with the currently NOT REALLY WORKING CVS BASE. (-:
Thank you - George
p.s. I am sorry for not checking in SSL earlier but SSL without encrypted passwords and without automated generation of the SERVER's
ACL (for many client's with different encrypted passwords) is NOT a security solution! (-: It would be professionally IRRESPONSIBLE to
give just an SSL solution to the community without providing a complete Security package! I have been working on that and my last
posting is almost there on the old 9/18 base) If SSL would help WSTK then I will do my best but could I just do it with WSTK, please?
(my company would like to get a license ASAP and probably would have no problem with returning any changes made against the WSTK Code
Base. It would be in our interest to have it included in any future releases.)
Michael Paolini wrote:
> What is the current status of SSL in Apache SOAP? Has the base code been
> checked in yet?
>
> Thanks,
> Mike
>
> ----------------------------------------------------------------------------------------------------------------------------------
>
> "A doctor can bury his mistakes, an architect can only advise his client to
> plant vines...." -Frank Lloyd Wright
>
> Internet ID: paolini@us.ibm.com
> IBM Internal e-mail ID: PAOLINI/Austin/IBM
Re: SSL
Posted by George I Matkovits <ma...@uswest.net>.
I have not checked it in yet. I use a URL connection with an Apache front-end (which does the server side SSL) to a backend Tomcat. I
never had any problems but I am told that the Soap V3 people do not want an URL based SSL solution but a socket based one. I have
been trying to get the latest CVS working since 12/1 but no luck (this is the CVS base I would have to do the check in against). I got
the base again tonight and hope to have better luck. Soap from the Apache CVS base does the 1st Soap request OK and then deep-ends in
re-establishing its context for the 2nd call. Should I check it in when it can not be tested? I would like to get the latest WSTK
also with Apache Soap, just now I do not really know what to do next! I would very much appreciate any advise. My current version of
Soap is from 9/18 and it is rather dated. The Soap changes are rather trivial (thanks to Java) I fail to understand what the big deal
is with SSL, it is simple when done with Java over an URL connection. If there are any problems with error status then we should get
Sun to fix it. SSL over sockets can be done but that is more like traditional procedure programming and some of the URL based client
side cookie management (which we need for servlet state management) might not work properly. Only extensive testing could uncover
these kind of problems but NOT with the currently NOT REALLY WORKING CVS BASE. (-:
Thank you - George
p.s. I am sorry for not checking in SSL earlier but SSL without encrypted passwords and without automated generation of the SERVER's
ACL (for many client's with different encrypted passwords) is NOT a security solution! (-: It would be professionally IRRESPONSIBLE to
give just an SSL solution to the community without providing a complete Security package! I have been working on that and my last
posting is almost there on the old 9/18 base) If SSL would help WSTK then I will do my best but could I just do it with WSTK, please?
(my company would like to get a license ASAP and probably would have no problem with returning any changes made against the WSTK Code
Base. It would be in our interest to have it included in any future releases.)
Michael Paolini wrote:
> What is the current status of SSL in Apache SOAP? Has the base code been
> checked in yet?
>
> Thanks,
> Mike
>
> ----------------------------------------------------------------------------------------------------------------------------------
>
> "A doctor can bury his mistakes, an architect can only advise his client to
> plant vines...." -Frank Lloyd Wright
>
> Internet ID: paolini@us.ibm.com
> IBM Internal e-mail ID: PAOLINI/Austin/IBM