CXF interceptors - dynamic usage?

[nkunkov <nk...@gmail.com>]

Hi,
I'm adding an WSS4JInInterceptor and WSS4JOutInterceptor to my server that
will host the web services.

I realize I can either add the interceptors to the cxf.xml or add them in
manually if I'm using JaxWsServerFactoryBean to create a server etc...

I will have multiple clients making requests and each will be signing and
encrypting with it's own key.  In my interceptor I will need to identify the
client by reading either a header or a message content to know what keystore
alias to use to encrypt/decrypt the message.

How can i extract this identifying information before the message goes
through the WSS4JInInterceptor?

What is the best way of doing it?

Appreciate your help..

--
View this message in context: http://cxf.547215.n5.nabble.com/CXF-interceptors-dynamic-usage-tp4903991p4903991.html
Sent from the cxf-user mailing list archive at Nabble.com.

Re: CXF interceptors - dynamic usage?

[nkunkov <nk...@gmail.com>]

Thank you Colm.

I understand what you are saying.

I have another question though..  My application is such that it is a web
services server as well as web services client.

I plan to have two sets of interceptors - In and Out interceptor when the
application is a server (those would be deployed by cxf.xml)  and another
set of In and Out interceptors to use when the application is a web services
client.  These will be used as follows -  
endPoint.getInInterceptors().add(MyInterceptor);

Does this sound right?  I'm assuming these two sets of interceptors won't
interfere with each other.

Please, let me know what you think.

Thank you,
Nadia

--
View this message in context: http://cxf.547215.n5.nabble.com/CXF-interceptors-and-WS-Security-tp4903991p4910756.html
Sent from the cxf-user mailing list archive at Nabble.com.

Re: CXF interceptors - dynamic usage?

[Colm O hEigeartaigh <co...@apache.org>]

> I'm reading about "useReqSigCert"  - is this something that will help me?
> It will encrypt with the same cert as the one used in the signature, but to
> read the signature - doesn't my app need to know what certificate to use?

No, as to verify a signature you only need to be in possession of some
trusted issuer of the cert associated with the signature. So if you
have a server application and lots of different clients, ideally your
server application will have a few trusted certs in its truststore to
use to verify digital signatures. You can then use "useReqSigCert" to
encrypt the response using the same cert as was used to verify the
signature.

Colm.


On Fri, Oct 14, 2011 at 11:13 PM, nkunkov <nk...@gmail.com> wrote:
> I think i have to clarify my message a bit.
>
> My application will be both a web service client and a web service server.
>
> I implemented web service security using the interceptors and it works when
> my application is a client.  Since it knows where it sends the request it
> can give the interceptor an alias for the keystore and the right certificate
> will be used for encryption.
>
> But i'm struggling to implement security when my application is a server.
> The requests will be coming in from different clients. I need a way to
> identify each client to pass the interceptor the alias name so it can get
> the right certificate.  Or is there a way to do this seamlessly?
>
> I'm reading about "useReqSigCert"  - is this something that will help me?
> It will encrypt with the same cert as the one used in the signature, but to
> read the signature - doesn't my app need to know what certificate to use?
>
> I may not be understanding the security and the CXF very well so bear with
> me...
> Any help will be appreciated...
>
> Thank you,
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/CXF-interceptors-dynamic-usage-tp4903991p4904085.html
> Sent from the cxf-user mailing list archive at Nabble.com.
>



-- 
Colm O hEigeartaigh

http://coheigea.blogspot.com/
Talend - http://www.talend.com/apache

Re: CXF interceptors - dynamic usage?

[nkunkov <nk...@gmail.com>]

I think i have to clarify my message a bit.

My application will be both a web service client and a web service server.

I implemented web service security using the interceptors and it works when
my application is a client.  Since it knows where it sends the request it
can give the interceptor an alias for the keystore and the right certificate
will be used for encryption.

But i'm struggling to implement security when my application is a server.
The requests will be coming in from different clients. I need a way to
identify each client to pass the interceptor the alias name so it can get
the right certificate.  Or is there a way to do this seamlessly?

I'm reading about "useReqSigCert"  - is this something that will help me? 
It will encrypt with the same cert as the one used in the signature, but to
read the signature - doesn't my app need to know what certificate to use? 

I may not be understanding the security and the CXF very well so bear with
me...
Any help will be appreciated...

Thank you,

--
View this message in context: http://cxf.547215.n5.nabble.com/CXF-interceptors-dynamic-usage-tp4903991p4904085.html
Sent from the cxf-user mailing list archive at Nabble.com.