You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@cxf.apache.org by ychawla <pr...@yahoo.com> on 2012/02/22 18:16:31 UTC

WS Security Properties Reference

Hello All, 
I am working on making the keystore and password parameters configurable in
my CXF/Camel Web Service.  There is documentation on the CXF web site shows
how to create a passwordCallbackRef as a Spring Bean.  This is helpful
because the user (or certificate alias) and password can be injected in and
configured.

Most documentation that I have seen shows how to use a Properties file that
is in the Classpath to configure the keystore properties.  For example:

<entry key="signaturePropFile" value="client.properties"/>

I didn't want to bake a properties file into a bundle or WAR and I found
this way to do it with Spring Util Properties

   <bean id="wss4jOutInterceptor"
class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
     <constructor-arg>
         <map>
             <entry key="action" value="Signature"/>
             <entry key="user" value="${alias}"/>
             <entry key="passwordCallbackRef">
             	<ref bean="passwordCallbackBean"/>
             </entry>
             *<entry key="SignaturePropRefId" value="wsCryptoProperties"/>
             <entry key="wsCryptoProperties" value-ref="wsCryptoProperties"
/>*
         </map>
     </constructor-arg>
   </bean>
	
  
  <util:properties id="wsCryptoProperties">
    
    <prop
key="org.apache.ws.security.crypto.provider">org.apache.ws.security.components.crypto.Merlin</prop>
    
    <prop
key="org.apache.ws.security.crypto.merlin.keystore.type">jks</prop>
    
    <prop
key="org.apache.ws.security.crypto.merlin.keystore.password">${KeystorePassword}</prop>
    
    <prop
key="org.apache.ws.security.crypto.merlin.file">${KeystoreLocation}</prop>
  </util:properties>

	<bean id="passwordCallbackBean"
class="org.mypackage.ws.security.ClientCallback">
		<property name="certificateAlias" value="${alias}"/>
		<property name="privateKeyPassword" value="${privateKeyPassword}"/>
	</bean>

I think it would be really helpful to have this way of configuring the
keystore properties on the CXF documentation page.  Can I go ahead and
update the CXF WIKI?

H/T to David Valero for the the code.

Thanks,
Yogesh

--
View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Properties-Reference-tp5505704p5505704.html
Sent from the cxf-user mailing list archive at Nabble.com.

Re: WS Security Properties Reference

Posted by ychawla <pr...@yahoo.com>.

Hello All,
Just confirmed this.  The constant value changed.  This is good to know if
someone is using Spring to configure the interceptors:

1.5.x
    /**
     * The key that hold the refernce of the
<code>java.util.Properties</code> 
     * object holding complete info about signature Crypto implementation. 
     * This should contain all information that would contain in an
equivalent 
     * .properties file which includes the Crypto implementation class name.
     * 
     * Refer to documentation of {@link #SIG_PROP_FILE}.
     */
    public final static String SIG_PROP_REF_ID = "SignaturePropRefId";

1.6.x

    /**
     * The key that holds the reference of the
<code>java.util.Properties</code> 
     * object holding complete information about the signature Crypto
implementation. 
     * This should contain all information that would contain in an
equivalent 
     * properties file which includes the Crypto implementation class name.
     * 
     * Refer to documentation of {@link #SIG_PROP_FILE}.
     */
    public final static String SIG_PROP_REF_ID = "signaturePropRefId";

Thanks,
Yogesh

--
View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Properties-Reference-tp5505704p5551010.html
Sent from the cxf-user mailing list archive at Nabble.com.

Re: WS Security Properties Reference

Posted by ychawla <pr...@yahoo.com>.

Thanks Colm.  I changed the attribute to lower case and it worked.  In WSS4J
1.5, the attribute could be upper case.  Looks like this is a subtle
difference between the two.

Appreciate the help!

-Yogesh

--
View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Properties-Reference-tp5505704p5544311.html
Sent from the cxf-user mailing list archive at Nabble.com.

Re: WS Security Properties Reference

Posted by Colm O hEigeartaigh <co...@apache.org>.

The configuration tag should be "signaturePropRefId" and not
"SignaturePropRefId".

Colm.

On Wed, Mar 7, 2012 at 4:49 AM, ychawla <pr...@yahoo.com> wrote:
> Thanks Dan,
> I noticed in CXF 2.4.6 which uses WSS4J 1.6.x that SignaturePropRefId is not
> working.  When I configure using the reference, I get the following NPE:
>
> java.lang.NullPointerException
>        at
> org.apache.ws.security.message.WSSecSignature.getSigningCerts(WSSecSignature.java:785)[wss4j-1.6.4.jar:1.6.4]
>        at
> org.apache.ws.security.message.WSSecSignature.prepare(WSSecSignature.java:168)[wss4j-1.6.4.jar:1.6.4]
>        at
> org.apache.ws.security.message.WSSecSignature.build(WSSecSignature.java:362)[wss4j-1.6.4.jar:1.6.4]
>        at
> org.apache.ws.security.action.SignatureAction.execute(SignatureAction.java:61)[wss4j-1.6.4.jar:1.6.4]
>        at
> org.apache.ws.security.handler.WSHandler.doSenderAction(WSHandler.java:202)[wss4j-1.6.4.jar:1.6.4]
>        at
> org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor.access$200(WSS4JOutInterceptor.java:52)[cxf-rt-ws-security-2.4.6.jar:2.4.6]
>        at
> org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor$WSS4JOutInterceptorInternal.handleMessage(WSS4JOutInterceptor.java:260)[cxf-rt-ws-security-2.4.6.jar:2.4.6]
>        at
> org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor$WSS4JOutInterceptorInternal.handleMessage(WSS4JOutInterceptor.java:136)[cxf-rt-ws-security-2.4.6.jar:2.4.6]
>
> Although it does not explicitly say it, the Crypto object is null which
> probably means it couldn't open the keystore.
>
> When I switch back to a properties file:
>
> <entry key="signaturePropFile" value="etc/Client_Sign.properties" />
>
> It works fine.  I don't like baking the properties file into my bundle and
> prefer the other configuration:
>
>                <entry key="SignaturePropRefId" value="wsCryptoPropertiesOut"/>
>                <entry key="wsCryptoPropertiesOut"
> value-ref="wsCryptoPropertiesOut" />
>
>        <util:properties id="wsCryptoPropertiesOut">
>                <prop
> key="org.apache.ws.security.crypto.provider">org.apache.ws.security.components.crypto.Merlin</prop>
>                <prop key="org.apache.ws.security.crypto.merlin.keystore.type">jks</prop>
>                <prop
> key="org.apache.ws.security.crypto.merlin.keystore.password">password</prop>
>                <prop
> key="org.apache.ws.security.crypto.merlin.keystore.alias">alias</prop>
>                <prop
> key="org.apache.ws.security.crypto.merlin.keystore.file">keystore.jks</prop>
>        </util:properties>
>
> Any ideas on how to get this working in CXF 2.4.6 with WSS4J 1.6?
>
> Thanks,
> Yogesh
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Properties-Reference-tp5505704p5543154.html
> Sent from the cxf-user mailing list archive at Nabble.com.



-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

Re: WS Security Properties Reference

Posted by ychawla <pr...@yahoo.com>.

Thanks Dan,
I noticed in CXF 2.4.6 which uses WSS4J 1.6.x that SignaturePropRefId is not
working.  When I configure using the reference, I get the following NPE:

java.lang.NullPointerException
	at
org.apache.ws.security.message.WSSecSignature.getSigningCerts(WSSecSignature.java:785)[wss4j-1.6.4.jar:1.6.4]
	at
org.apache.ws.security.message.WSSecSignature.prepare(WSSecSignature.java:168)[wss4j-1.6.4.jar:1.6.4]
	at
org.apache.ws.security.message.WSSecSignature.build(WSSecSignature.java:362)[wss4j-1.6.4.jar:1.6.4]
	at
org.apache.ws.security.action.SignatureAction.execute(SignatureAction.java:61)[wss4j-1.6.4.jar:1.6.4]
	at
org.apache.ws.security.handler.WSHandler.doSenderAction(WSHandler.java:202)[wss4j-1.6.4.jar:1.6.4]
	at
org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor.access$200(WSS4JOutInterceptor.java:52)[cxf-rt-ws-security-2.4.6.jar:2.4.6]
	at
org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor$WSS4JOutInterceptorInternal.handleMessage(WSS4JOutInterceptor.java:260)[cxf-rt-ws-security-2.4.6.jar:2.4.6]
	at
org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor$WSS4JOutInterceptorInternal.handleMessage(WSS4JOutInterceptor.java:136)[cxf-rt-ws-security-2.4.6.jar:2.4.6]

Although it does not explicitly say it, the Crypto object is null which
probably means it couldn't open the keystore.

When I switch back to a properties file:

<entry key="signaturePropFile" value="etc/Client_Sign.properties" />

It works fine.  I don't like baking the properties file into my bundle and
prefer the other configuration:

		<entry key="SignaturePropRefId" value="wsCryptoPropertiesOut"/>
             	<entry key="wsCryptoPropertiesOut"
value-ref="wsCryptoPropertiesOut" />

	<util:properties id="wsCryptoPropertiesOut">
		<prop
key="org.apache.ws.security.crypto.provider">org.apache.ws.security.components.crypto.Merlin</prop>
		<prop key="org.apache.ws.security.crypto.merlin.keystore.type">jks</prop>
		<prop
key="org.apache.ws.security.crypto.merlin.keystore.password">password</prop>
		<prop
key="org.apache.ws.security.crypto.merlin.keystore.alias">alias</prop>
		<prop
key="org.apache.ws.security.crypto.merlin.keystore.file">keystore.jks</prop>
	</util:properties>

Any ideas on how to get this working in CXF 2.4.6 with WSS4J 1.6?

Thanks,
Yogesh


--
View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Properties-Reference-tp5505704p5543154.html
Sent from the cxf-user mailing list archive at Nabble.com.

Re: WS Security Properties Reference

Posted by Daniel Kulp <dk...@apache.org>.

> 
> I think it would be really helpful to have this way of configuring the
> keystore properties on the CXF documentation page.  Can I go ahead and
> update the CXF WIKI?

If you submit an ICLA:

http://www.apache.org/licenses/icla.txt

to Apache and then create a confluence account, we can grant edit access to 
update the WIKI.   Need the ICLA first though.


Dan



On Wednesday, February 22, 2012 9:16:31 AM ychawla wrote:
> Hello All,
> I am working on making the keystore and password parameters configurable in
> my CXF/Camel Web Service.  There is documentation on the CXF web site shows
> how to create a passwordCallbackRef as a Spring Bean.  This is helpful
> because the user (or certificate alias) and password can be injected in and
> configured.
> 
> Most documentation that I have seen shows how to use a Properties file that
> is in the Classpath to configure the keystore properties.  For example:
> 
> <entry key="signaturePropFile" value="client.properties"/>
> 
> I didn't want to bake a properties file into a bundle or WAR and I found
> this way to do it with Spring Util Properties
> 
>    <bean id="wss4jOutInterceptor"
> class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
>      <constructor-arg>
>          <map>
>              <entry key="action" value="Signature"/>
>              <entry key="user" value="${alias}"/>
>              <entry key="passwordCallbackRef">
>              	<ref bean="passwordCallbackBean"/>
>              </entry>
>              *<entry key="SignaturePropRefId" value="wsCryptoProperties"/>
>              <entry key="wsCryptoProperties" value-ref="wsCryptoProperties"
> />*
>          </map>
>      </constructor-arg>
>    </bean>
> 
> 
>   <util:properties id="wsCryptoProperties">
> 
>     <prop
> key="org.apache.ws.security.crypto.provider">org.apache.ws.security.componen
> ts.crypto.Merlin</prop>
> 
>     <prop
> key="org.apache.ws.security.crypto.merlin.keystore.type">jks</prop>
> 
>     <prop
> key="org.apache.ws.security.crypto.merlin.keystore.password">${KeystorePassw
> ord}</prop>
> 
>     <prop
> key="org.apache.ws.security.crypto.merlin.file">${KeystoreLocation}</prop>
>   </util:properties>
> 
> 	<bean id="passwordCallbackBean"
> class="org.mypackage.ws.security.ClientCallback">
> 		<property name="certificateAlias" value="${alias}"/>
> 		<property name="privateKeyPassword" value="${privateKeyPassword}"/>
> 	</bean>
> 
> I think it would be really helpful to have this way of configuring the
> keystore properties on the CXF documentation page.  Can I go ahead and
> update the CXF WIKI?
> 
> H/T to David Valero for the the code.
> 
> Thanks,
> Yogesh
> 
> --
> View this message in context:
> http://cxf.547215.n5.nabble.com/WS-Security-Properties-Reference-tp5505704p
> 5505704.html Sent from the cxf-user mailing list archive at Nabble.com.
-- 
Daniel Kulp
dkulp@apache.org - http://dankulp.com/blog
Talend Community Coder - http://coders.talend.com