You are viewing a plain text version of this content. The canonical link for it is here.
Posted to java-dev@axis.apache.org by di...@apache.org on 2002/01/11 19:44:07 UTC
cvs commit: xml-axis/java/samples/security Client.java LogHandler.java Service.java SignedSOAPEnvelope.java deployit.cmd keystore.jks securitydeploy.wsdd securityundeploy.wsdd testit.cmd undeployit.cmd
dims 02/01/11 10:44:07
Modified: java build.xml
Added: java/samples/security Client.java LogHandler.java
Service.java SignedSOAPEnvelope.java deployit.cmd
keystore.jks securitydeploy.wsdd
securityundeploy.wsdd testit.cmd undeployit.cmd
Log:
Initial checkin of a sample for Signed SOAP Messages. (uses xml-security)
Revision Changes Path
1.98 +9 -0 xml-axis/java/build.xml
Index: build.xml
===================================================================
RCS file: /home/cvs/xml-axis/java/build.xml,v
retrieving revision 1.97
retrieving revision 1.98
diff -u -r1.97 -r1.98
--- build.xml 7 Jan 2002 15:54:20 -0000 1.97
+++ build.xml 11 Jan 2002 18:44:06 -0000 1.98
@@ -15,6 +15,9 @@
SOAP Attachment support enablement:
activation.jar from http://java.sun.com/products/javabeans/glasgow/jaf.html
mailapi.jar from http://java.sun.com/products/javamail/
+ Security support enablement:
+ xmlsec.jar from fresh build of CVS from http://xml.apache.org/security/
+ Other support jars from http://cvs.apache.org/viewcvs.cgi/xml-security/libs/
Build Instructions:
To build, run
@@ -136,6 +139,10 @@
classname="javax.activation.DataHandler"
classpathref="classpath"/>
+ <available property="security.present"
+ classname="org.apache.xml.security.Init"
+ classpathref="classpath"/>
+
<available property="mailapi.present"
classname="javax.mail.internet.MimeMessage"
classpathref="classpath"/>
@@ -164,6 +171,7 @@
<echo message="activation.present=${activation.present}" />
<echo message="mailapi.present=${mailapi.present}" />
<echo message="attachments.present=${attachments.present}" />
+ <echo message="security.present=${security.present}" />
<echo message=""/>
<echo message="--- Property values ---" />
<echo message="debug=${debug}" />
@@ -245,6 +253,7 @@
<exclude name="samples/userguide/example6/*Impl.java" />
<exclude name="samples/userguide/example6/*TestCase.java" />
<exclude name="samples/attachments/**/*.java" unless="attachments.present"/>
+ <exclude name="samples/security/**/*.java" unless="security.present"/>
</javac>
</target>
1.1 xml-axis/java/samples/security/Client.java
Index: Client.java
===================================================================
/*
* The Apache Software License, Version 1.1
*
*
* Copyright (c) 2001 The Apache Software Foundation. All rights
* reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. The end-user documentation included with the redistribution,
* if any, must include the following acknowledgment:
* "This product includes software developed by the
* Apache Software Foundation (http://www.apache.org/)."
* Alternately, this acknowledgment may appear in the software itself,
* if and wherever such third-party acknowledgments normally appear.
*
* 4. The names "Axis" and "Apache Software Foundation" must
* not be used to endorse or promote products derived from this
* software without prior written permission. For written
* permission, please contact apache@apache.org.
*
* 5. Products derived from this software may not be called "Apache",
* nor may "Apache" appear in their name, without prior written
* permission of the Apache Software Foundation.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* <http://www.apache.org/>.
*/
package samples.security;
import org.apache.axis.client.Call;
import org.apache.axis.client.Service;
import org.apache.axis.utils.Options;
import java.io.*;
import java.security.cert.X509Certificate;
import java.security.KeyStore;
import java.security.PrivateKey;
import org.apache.axis.*;
import org.apache.axis.message.SOAPEnvelope;
import org.apache.axis.message.SOAPBodyElement;
import org.apache.axis.message.MessageElement;
import org.apache.axis.message.SOAPHeader;
import org.apache.axis.client.ServiceClient;
import org.apache.axis.transport.http.HTTPTransport ;
import org.apache.axis.utils.*;
import org.apache.xml.security.signature.XMLSignature;
import org.w3c.dom.Element;
import org.w3c.dom.Document;
public class Client
{
static void main(String[] args) throws Exception {
Options opts = new Options(args);
ServiceClient sc = new ServiceClient(opts.getURL());
sc.set(HTTPTransport.ACTION, "");
SOAPEnvelope env = new SOAPEnvelope();
SOAPBodyElement sbe = new SOAPBodyElement(XMLUtils.StringToElement("http://localhost:8080/LogTestService","testMethod", ""));
env.addBodyElement(sbe);
env = new SignedSOAPEnvelope(env);
System.out.println("\n============= Request ==============");
XMLUtils.PrettyElementToStream(env.getAsDOM(), System.out);
Message msg = new Message(env);
sc.setRequestMessage(msg);
sc.invoke();
MessageContext mc = sc.getMessageContext();
System.out.println("\n============= Response ==============");
XMLUtils.PrettyElementToStream(mc.getResponseMessage().getSOAPEnvelope().getAsDOM(), System.out);
}
}
1.1 xml-axis/java/samples/security/LogHandler.java
Index: LogHandler.java
===================================================================
/*
* The Apache Software License, Version 1.1
*
*
* Copyright (c) 2001 The Apache Software Foundation. All rights
* reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. The end-user documentation included with the redistribution,
* if any, must include the following acknowledgment:
* "This product includes software developed by the
* Apache Software Foundation (http://www.apache.org/)."
* Alternately, this acknowledgment may appear in the software itself,
* if and wherever such third-party acknowledgments normally appear.
*
* 4. The names "Axis" and "Apache Software Foundation" must
* not be used to endorse or promote products derived from this
* software without prior written permission. For written
* permission, please contact apache@apache.org.
*
* 5. Products derived from this software may not be called "Apache",
* nor may "Apache" appear in their name, without prior written
* permission of the Apache Software Foundation.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* <http://www.apache.org/>.
*/
package samples.security;
import org.apache.axis.AxisFault;
import org.apache.axis.Handler;
import org.apache.axis.MessageContext;
import org.apache.axis.handlers.BasicHandler;
import org.apache.axis.AxisFault;
import org.apache.axis.Message;
import org.apache.axis.MessageContext;
import org.apache.axis.utils.JavaUtils;
import org.apache.log4j.Category;
import java.io.FileWriter;
import java.io.PrintWriter;
import java.io.FileOutputStream;
import java.io.PrintWriter;
import java.util.Date;
public class LogHandler extends BasicHandler {
static Category category =
Category.getInstance(LogHandler.class.getName());
long start = 0;
public void invoke(MessageContext msgContext) throws AxisFault
{
/** Log an access each time we get invoked.
*/
try {
Handler serviceHandler = msgContext.getServiceHandler();
String filename = (String)getOption("filename");
if ((filename == null) || (filename.equals("")))
throw new AxisFault("Server.NoLogFile",
"No log file configured for the LogHandler!",
null, null);
FileOutputStream fos = new FileOutputStream(filename, true);
PrintWriter writer = new PrintWriter(fos);
Integer numAccesses =
(Integer)serviceHandler.getOption("accesses");
if (numAccesses == null)
numAccesses = new Integer(0);
numAccesses = new Integer(numAccesses.intValue() + 1);
Date date = new Date();
String result = date + ": service " +
msgContext.getTargetService() +
" accessed " + numAccesses + " time(s).";
serviceHandler.setOption("accesses", numAccesses);
writer.println(result);
Message inMsg = msgContext.getRequestMessage();
Message outMsg = msgContext.getResponseMessage();
writer.println( "=======================================================" );
writer.println( "= " + JavaUtils.getMessage("elapsed00",
"" + (System.currentTimeMillis() - start)));
writer.println( "= " + JavaUtils.getMessage("inMsg00",
(inMsg == null ? "null" : inMsg.getSOAPPart().getAsString())));
writer.println( "= " + JavaUtils.getMessage("outMsg00",
(outMsg == null ? "null" : outMsg.getSOAPPart().getAsString())));
writer.println( "=======================================================" );
// Here you can also use outMsg.getSOAPEnvelope().getAsDOM()
// instead of outMsg.getSOAPPart().getAsString()
writer.close();
} catch (Exception e) {
throw AxisFault.makeFault(e);
}
}
public void undo(MessageContext msgContext)
{
try {
Handler serviceHandler = msgContext.getServiceHandler();
String filename = (String)getOption("filename");
if ((filename == null) || (filename.equals("")))
throw new AxisFault("Server.NoLogFile",
"No log file configured for the LogHandler!",
null, null);
FileWriter fw = new FileWriter( filename, true );
PrintWriter pw = new PrintWriter( fw );
pw.println( "=====================" );
pw.println( "= " + JavaUtils.getMessage("fault00") );
pw.println( "=====================" );
pw.close();
} catch( Exception e ) {
category.error( e );
}
}
}
1.1 xml-axis/java/samples/security/Service.java
Index: Service.java
===================================================================
/*
* The Apache Software License, Version 1.1
*
*
* Copyright (c) 2001 The Apache Software Foundation. All rights
* reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. The end-user documentation included with the redistribution,
* if any, must include the following acknowledgment:
* "This product includes software developed by the
* Apache Software Foundation (http://www.apache.org/)."
* Alternately, this acknowledgment may appear in the software itself,
* if and wherever such third-party acknowledgments normally appear.
*
* 4. The names "Axis" and "Apache Software Foundation" must
* not be used to endorse or promote products derived from this
* software without prior written permission. For written
* permission, please contact apache@apache.org.
*
* 5. Products derived from this software may not be called "Apache",
* nor may "Apache" appear in their name, without prior written
* permission of the Apache Software Foundation.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* <http://www.apache.org/>.
*/
package samples.security;
public class Service
{
public String testMethod()
{
return "Hi, you've reached the testMethod.";
}
}
1.1 xml-axis/java/samples/security/SignedSOAPEnvelope.java
Index: SignedSOAPEnvelope.java
===================================================================
/*
* The Apache Software License, Version 1.1
*
*
* Copyright (c) 2001 The Apache Software Foundation. All rights
* reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. The end-user documentation included with the redistribution,
* if any, must include the following acknowledgment:
* "This product includes software developed by the
* Apache Software Foundation (http://www.apache.org/)."
* Alternately, this acknowledgment may appear in the software itself,
* if and wherever such third-party acknowledgments normally appear.
*
* 4. The names "Axis" and "Apache Software Foundation" must
* not be used to endorse or promote products derived from this
* software without prior written permission. For written
* permission, please contact apache@apache.org.
*
* 5. Products derived from this software may not be called "Apache",
* nor may "Apache" appear in their name, without prior written
* permission of the Apache Software Foundation.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* <http://www.apache.org/>.
*/
package samples.security;
import org.apache.axis.client.Call;
import org.apache.axis.client.Service;
import org.apache.axis.utils.Options;
import java.io.*;
import java.security.cert.X509Certificate;
import java.security.KeyStore;
import java.security.PrivateKey;
import org.apache.axis.*;
import org.apache.axis.configuration.NullProvider;
import org.apache.axis.encoding.DeserializationContext;
import org.apache.axis.message.SOAPEnvelope;
import org.apache.axis.message.SOAPBodyElement;
import org.apache.axis.message.MessageElement;
import org.apache.axis.message.SOAPHeader;
import org.apache.axis.client.ServiceClient;
import org.apache.axis.client.AxisClient;
import org.apache.axis.transport.http.HTTPTransport ;
import org.apache.axis.utils.*;
import org.apache.xml.security.signature.XMLSignature;
import org.w3c.dom.Element;
import org.w3c.dom.Document;
import org.xml.sax.InputSource;
public class SignedSOAPEnvelope extends SOAPEnvelope
{
static String SOAPSECNS = "http://schemas.xmlsoap.org/soap/security/2000-12";
static String SOAPSECprefix = "SOAP-SEC";
static String keystoreType = "JKS";
static String keystoreFile = "keystore.jks";
static String keystorePass = "xmlsecurity";
static String privateKeyAlias = "test";
static String privateKeyPass = "xmlsecurity";
static String certificateAlias = "test";
static {
org.apache.xml.security.Init.init();
}
public SignedSOAPEnvelope (SOAPEnvelope env) {
try {
env.addMapping(new Mapping(SOAPSECNS,SOAPSECprefix));
env.addAttribute(Constants.URI_SOAP_ENV,"actor","some-uri");
env.addAttribute(Constants.URI_SOAP_ENV,"mustUnderstand","1");
SOAPHeader header = new SOAPHeader(XMLUtils.StringToElement(SOAPSECNS,"Signature", ""));
env.addHeader(header);
Document doc = env.getAsDocument();
KeyStore ks = KeyStore.getInstance(keystoreType);
FileInputStream fis = new FileInputStream(keystoreFile);
ks.load(fis, keystorePass.toCharArray());
PrivateKey privateKey = (PrivateKey) ks.getKey(privateKeyAlias,
privateKeyPass.toCharArray());
Element soapHeaderElement = (Element)((Element)doc.getFirstChild()).getElementsByTagNameNS("*","Header").item(0);
Element soapSignatureElement = (Element)soapHeaderElement.getElementsByTagNameNS("*","Signature").item(0);
String BaseURI = "http://xml-security";
XMLSignature sig = new XMLSignature(doc, BaseURI,
XMLSignature.ALGO_ID_SIGNATURE_DSA);
soapSignatureElement.appendChild(sig.getElement());
sig.addDocument("#Body");
X509Certificate cert =
(X509Certificate) ks.getCertificate(certificateAlias);
sig.addKeyInfo(cert);
sig.addKeyInfo(cert.getPublicKey());
sig.sign(privateKey);
ByteArrayOutputStream baos = new ByteArrayOutputStream();
org.apache.xml.security.utils.XMLUtils.outputDOMc14nWithComments(doc, baos);
InputSource is = new InputSource(new java.io.ByteArrayInputStream(baos.toByteArray()));
DeserializationContext dser = null ;
AxisClient tmpEngine = new AxisClient(new NullProvider());
MessageContext msgContext = new MessageContext(tmpEngine);
dser = new DeserializationContext(is, msgContext,
Message.REQUEST, this );
dser.parse();
}
catch( Exception e ) {
e.printStackTrace();
throw new RuntimeException( e.toString() );
}
}
}
1.1 xml-axis/java/samples/security/deployit.cmd
Index: deployit.cmd
===================================================================
rem this assumes webserver is running on port 8080
@echo off
java org.apache.axis.client.AdminClient %* securitydeploy.wsdd
1.1 xml-axis/java/samples/security/keystore.jks
<<Binary file>>
1.1 xml-axis/java/samples/security/securitydeploy.wsdd
Index: securitydeploy.wsdd
===================================================================
<deployment xmlns="http://xml.apache.org/axis/wsdd/"
xmlns:java="http://xml.apache.org/axis/wsdd/providers/java">
<!-- define the logging handler configuration -->
<handler name="track" type="java:samples.security.LogHandler">
<parameter name="filename" value="MyService.log"/>
</handler>
<!-- define the service, using the log handler we just defined -->
<service name="http://localhost:8080/LogTestService" provider="java:RPC">
<requestFlow>
<handler type="track"/>
</requestFlow>
<parameter name="className" value="samples.security.Service"/>
<parameter name="methodName" value="*"/>
</service>
</deployment>
1.1 xml-axis/java/samples/security/securityundeploy.wsdd
Index: securityundeploy.wsdd
===================================================================
<undeployment xmlns="http://xml.apache.org/axis/wsdd/"
xmlns:java="http://xml.apache.org/axis/wsdd/providers/java">
<!-- define the logging handler configuration -->
<handler name="track" type="java:samples.security.LogHandler">
<parameter name="filename" value="MyService.log"/>
</handler>
<!-- define the service, using the log handler we just defined -->
<service name="http://localhost:8080/LogTestService" provider="java:RPC">
<requestFlow>
<handler type="track"/>
</requestFlow>
<parameter name="className" value="samples.security.Service"/>
<parameter name="methodName" value="*"/>
</service>
</undeployment>
1.1 xml-axis/java/samples/security/testit.cmd
Index: testit.cmd
===================================================================
rem this assumes webserver is running on port 8080
@echo off
java samples.security.Client %*
1.1 xml-axis/java/samples/security/undeployit.cmd
Index: undeployit.cmd
===================================================================
rem this assumes webserver is running on port 8080
@echo off
java org.apache.axis.client.AdminClient %* securityundeploy.wsdd