You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by bu...@apache.org on 2013/06/20 16:48:27 UTC
svn commit: r866640 - in /websites/production/cxf/content:
cache/docs.pageCache docs/xml-key-management-service-xkms.html
Author: buildbot
Date: Thu Jun 20 14:48:27 2013
New Revision: 866640
Log:
Production update by buildbot for cxf
Modified:
websites/production/cxf/content/cache/docs.pageCache
websites/production/cxf/content/docs/xml-key-management-service-xkms.html
Modified: websites/production/cxf/content/cache/docs.pageCache
==============================================================================
Binary files - no diff available.
Modified: websites/production/cxf/content/docs/xml-key-management-service-xkms.html
==============================================================================
--- websites/production/cxf/content/docs/xml-key-management-service-xkms.html (original)
+++ websites/production/cxf/content/docs/xml-key-management-service-xkms.html Thu Jun 20 14:48:27 2013
@@ -25,6 +25,8 @@
<meta http-equiv="Content-type" content="text/html;charset=UTF-8">
<meta name="keywords" content="business integration, EAI, SOA, Service Oriented Architecture, web services, SOAP, JBI, JMS, WSDL, XML, EDI, Electronic Data Interchange, standards support, integration standards, application integration, middleware, software, solutions, services, CXF, open source">
<meta name="description" content="Apache CXF, Services Framework - XML Key Management Service (XKMS)">
+
+
<title>
Apache CXF -- XML Key Management Service (XKMS)
</title>
@@ -125,7 +127,7 @@ Apache CXF -- XML Key Management Service
<h2><a shape="rect" name="XMLKeyManagementService%28XKMS%29-Usecase"></a>Use case</h2>
-<p>CXF security uses asymmetric algorithms for different purposes: encryption of symmetric keys and payloads, signing security tokens and messages, proof of possession.<br clear="none">
+<p>CXF uses asymmetric algorithms for different purposes: encryption of symmetric keys and payloads, signing security tokens and messages, proof of possession.<br clear="none">
Normally the public keys (in form of X509 certificates) are stored in java keystores.</p>
<p>For example, if sender encrypts the message payload sending to the receiver, he should have access to receiver certificate saved in local keystore. <br clear="none">
@@ -165,47 +167,95 @@ This design makes XKMS internal implemen
For example certificate can be searched firstly in the LDAP repository by LDAP lookup handler and, if it is not found there, additionally looked in remote PKI using appropriate lookup handler. Validation operation logic is organized in chain is well: first validation handler checks format and expire date of X509 certificate, next one checks certificate trust chain.</p>
<p>Currently XKMS Service supports simple file based and LDAP backends.<br clear="none">
-Sample spring configuration of XKMS handlers for file backend looks like:</p>
+Sample spring configuration of XKMS handlers looks like:</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="code-xml">
- <span class="code-tag"><bean id=<span class="code-quote">"dateValidator"</span> class=<span class="code-quote">"org.apache.cxf.xkms.x509.validator.DateValidator"</span> /></span>
+<beans xmlns=<span class="code-quote">"http://www.springframework.org/schema/beans"</span>
+ <span class="code-keyword">xmlns:cxf</span>=<span class="code-quote">"http://cxf.apache.org/core"</span> <span class="code-keyword">xmlns:jaxws</span>=<span class="code-quote">"http://cxf.apache.org/jaxws"</span>
+ <span class="code-keyword">xmlns:test</span>=<span class="code-quote">"http://apache.org/hello_world_soap_http"</span> <span class="code-keyword">xmlns:xsi</span>=<span class="code-quote">"http://www.w3.org/2001/XMLSchema-instance"</span>
+ <span class="code-keyword">xmlns:util</span>=<span class="code-quote">"http://www.springframework.org/schema/util"</span>
+ xsi:schemaLocation="
+ http://cxf.apache.org/core
+ http://cxf.apache.org/schemas/core.xsd
+ http://www.springframework.org/schema/beans
+ http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
+ http://cxf.apache.org/jaxws
+ http://cxf.apache.org/schemas/jaxws.xsd
+ http://www.springframework.org/schema/util
+ http://www.springframework.org/schema/util/spring-util-2.0.xsd">
+
+
+ <span class="code-tag"><bean id=<span class="code-quote">"dateValidator"</span> class=<span class="code-quote">"org.apache.cxf.xkms.x509.validator.DateValidator"</span> /></span>
+
+ <bean id=<span class="code-quote">"trustedAuthorityValidator"</span>
+ class=<span class="code-quote">"org.apache.cxf.xkms.x509.validator.TrustedAuthorityValidator"</span>>
+ <span class="code-tag"><constructor-arg ref=<span class="code-quote">"certificateRepo"</span> /></span>
+ <span class="code-tag"></bean></span>
+
+ <span class="code-tag"><bean id=<span class="code-quote">"x509Locator"</span> class=<span class="code-quote">"org.apache.cxf.xkms.x509.handlers.X509Locator"</span>></span>
+ <span class="code-tag"><constructor-arg ref=<span class="code-quote">"certificateRepo"</span> /></span>
+ <span class="code-tag"></bean></span>
+
+ <bean id=<span class="code-quote">"x509Register"</span>
+ class=<span class="code-quote">"org.apache.cxf.xkms.x509.handlers.x509Register"</span>>
+ <span class="code-tag"><constructor-arg ref=<span class="code-quote">"certificateRepo"</span> /></span>
+ <span class="code-tag"></bean></span>
+
+
+ <span class="code-tag"><span class="code-comment"><!-- LDAP based implementation --></span></span>
+
+ <bean id=<span class="code-quote">"certificateRepo"</span>
+ class=<span class="code-quote">"org.apache.cxf.xkms.x509.repo.ldap.LdapCertificateRepo"</span>>
+ <span class="code-tag"><constructor-arg ref=<span class="code-quote">"ldapServerConfig"</span> /></span>
+ <span class="code-tag"><constructor-arg ref=<span class="code-quote">"ldapSchemaConfig"</span> /></span>
+ <span class="code-tag"><constructor-arg value=<span class="code-quote">"dc=example,dc=com"</span> /></span>
+ <span class="code-tag"></bean></span>
+
+ <span class="code-tag"><bean id=<span class="code-quote">"ldapServerConfig"</span> class=<span class="code-quote">"org.apache.cxf.xkms.x509.repo.ldap.LdapServerConfig"</span>></span>
+ <span class="code-tag"><constructor-arg value=<span class="code-quote">"ldap://localhost:2389"</span> /></span>
+ <span class="code-tag"><constructor-arg value=<span class="code-quote">"cn=Directory Manager,dc=example,dc=com"</span> /></span>
+ <span class="code-tag"><constructor-arg value=<span class="code-quote">"test"</span> /></span>
+ <span class="code-tag"><constructor-arg value=<span class="code-quote">"2"</span> /></span>
+ <span class="code-tag"></bean></span>
+
+ <span class="code-tag"><bean id=<span class="code-quote">"ldapSchemaConfig"</span> class=<span class="code-quote">"org.apache.cxf.xkms.x509.repo.ldap.LdapSchemaConfig"</span>></span>
+ <span class="code-tag"><property name=<span class="code-quote">"certObjectClass"</span> value=<span class="code-quote">"inetOrgPerson"</span> /></span>
+ <span class="code-tag"><property name=<span class="code-quote">"attrUID"</span> value=<span class="code-quote">"uid"</span> /></span>
+ <span class="code-tag"><property name=<span class="code-quote">"attrIssuerID"</span> value=<span class="code-quote">"manager"</span> /></span>
+ <span class="code-tag"><property name=<span class="code-quote">"attrSerialNumber"</span> value=<span class="code-quote">"employeeNumber"</span> /></span>
+ <span class="code-tag"><property name=<span class="code-quote">"attrCrtBinary"</span> value=<span class="code-quote">"userCertificate;binary"</span> /></span>
+ <span class="code-tag"><property name=<span class="code-quote">"constAttrNamesCSV"</span> value=<span class="code-quote">"sn"</span> /></span>
+ <span class="code-tag"><property name=<span class="code-quote">"constAttrValuesCSV"</span> value=<span class="code-quote">"X509 certificate"</span> /></span>
+ <span class="code-tag"><property name=<span class="code-quote">"serviceCertRDNTemplate"</span> value=<span class="code-quote">"cn=%s,ou=services"</span> /></span>
+ <span class="code-tag"><property name=<span class="code-quote">"serviceCertUIDTemplate"</span> value=<span class="code-quote">"cn=%s"</span> /></span>
+ <span class="code-tag"><property name=<span class="code-quote">"trustedAuthorityFilter"</span> value=<span class="code-quote">"(&#038;(objectClass=inetOrgPerson)(ou:dn:=CAs))"</span> /></span>
+ <span class="code-tag"><property name=<span class="code-quote">"intermediateFilter"</span> value=<span class="code-quote">"(objectClass=inetOrgPerson)"</span> /></span>
+ <span class="code-tag"></bean></span>
+
+
+ <span class="code-tag"><span class="code-comment"><!-- File based implementation --></span></span>
+
+ <!-- bean id=<span class="code-quote">"certificateRepo"</span>
+ class=<span class="code-quote">"org.apache.cxf.xkms.x509.repo.file.FileCertificateRepo"</span>>
+ <span class="code-tag"><constructor-arg value=<span class="code-quote">"../conf/certs"</span> /></span>
+ <span class="code-tag"></bean--></span>
- <span class="code-tag"><bean id=<span class="code-quote">"x509FileLocator"</span> class=<span class="code-quote">"org.apache.cxf.xkms.x509.locator.FileLocator"</span>></span>
- <span class="code-tag"><constructor-arg value=<span class="code-quote">"../conf/certs"</span> /></span>
- <span class="code-tag"></bean></span>
-
- <span class="code-tag"><bean id=<span class="code-quote">"fileRegisterHandler"</span> class=<span class="code-quote">"org.apache.cxf.xkms.x509.handlers.FileRegisterHandler"</span>></span>
- <span class="code-tag"><constructor-arg value=<span class="code-quote">"../conf/certs"</span> /></span>
- <span class="code-tag"></bean></span>
-
- <span class="code-tag"><bean id=<span class="code-quote">"xkmsProviderBean"</span> class=<span class="code-quote">"org.apache.cxf.xkms.service.XKMSService"</span>></span>
- <span class="code-tag"><property name=<span class="code-quote">"validators"</span>></span>
- <span class="code-tag"><list></span>
- <span class="code-tag"><ref bean=<span class="code-quote">"dateValidator"</span> /></span>
- <span class="code-tag"></list></span>
- <span class="code-tag"></property></span>
- <span class="code-tag"><property name=<span class="code-quote">"locators"</span>></span>
- <span class="code-tag"><list></span>
- <span class="code-tag"><ref bean=<span class="code-quote">"x509FileLocator"</span> /></span>
- <span class="code-tag"></list></span>
- <span class="code-tag"></property></span>
- <span class="code-tag"><property name=<span class="code-quote">"keyRegisterHandlers"</span>></span>
- <span class="code-tag"><list></span>
- <span class="code-tag"><ref bean=<span class="code-quote">"fileRegisterHandler"</span> /></span>
- <span class="code-tag"></list></span>
- <span class="code-tag"></property></span>
- <span class="code-tag"></bean></span>
-
- <jaxws:endpoint id=<span class="code-quote">"XKMSService"</span> <span class="code-keyword">xmlns:serviceNamespace</span>=<span class="code-quote">"http://www.w3.org/2002/03/xkms#wsdl"</span>
- serviceName=<span class="code-quote">"serviceNamespace:XKMSService"</span> endpointName=<span class="code-quote">"serviceNamespace:XKMSPort"</span>
- implementor=<span class="code-quote">"#xkmsProviderBean"</span> address=<span class="code-quote">"/XKMS"</span>>
- <span class="code-tag"></jaxws:endpoint></span>
+<span class="code-tag"></beans></span>
</pre>
</div></div>
-<h4><a shape="rect" name="XMLKeyManagementService%28XKMS%29-IntegrationXKMSclientintoCXFsecurity."></a>Integration XKMS client into CXF security.</h4>
+<p>dateValidator and trustedAuthorityValidator beans are implementations of Validator interface for validity date and trusted chain validation. <br clear="none">
+x509Locator and x509Register are implementations of Locator and Register interfaces for X509 certificates.<br clear="none">
+certificateRepo is repository implementation for LDAP backend. LdapServerConfig and LdapSchemaConfig contain LDAP configuration described in the following table:</p>
+
+<div class="table-wrap">
+<table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh">Property</th><th colspan="1" rowspan="1" class="confluenceTh">Sample Value</th><th colspan="1" rowspan="1" class="confluenceTh">Description</th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">ldapServerConfig arguments</td><td colspan="1" rowspan="1" class="confluenceTd"> </td><td colspan="1" rowspan="1" class="confluenceTd"> URL, baseDN and credentials of LDAP Server</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">certObjectClass</td><td colspan="1" rowspan="1" class="confluenceTd">inetOrgPerson</td><td colspan="1" rowspan="1" class="confluenceTd">LDAP object class used to store certificates</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">attrUID</td><td colspan="1" rowspan="1" class="confluenceTd">uid</td><td colspan="1" rowspan="1" class="confluenceTd">Attribute containing X509 subject DN</td></tr><tr><td colspan="1" rowspan="1" class="conf
luenceTd">attrIssuerID</td><td colspan="1" rowspan="1" class="confluenceTd">manager</td><td colspan="1" rowspan="1" class="confluenceTd">LDAP attribute containing X509 issuer DN</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">attrSerialNumber</td><td colspan="1" rowspan="1" class="confluenceTd">employeeNumber</td><td colspan="1" rowspan="1" class="confluenceTd">LDAP attribute containing X509 serial number</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">attrCrtBinary</td><td colspan="1" rowspan="1" class="confluenceTd">userCertificate</td><td colspan="1" rowspan="1" class="confluenceTd">LDAP attribute containing X509 certificate content</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">constAttrNamesCSV</td><td colspan="1" rowspan="1" class="confluenceTd">sn</td><td colspan="1" rowspan="1" class="confluenceTd">Comma separated list of mandatory LDAP attributes</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">constAttrValuesC
SV</td><td colspan="1" rowspan="1" class="confluenceTd">X509 certificate</td><td colspan="1" rowspan="1" class="confluenceTd">Comma separated list of mandatory LDAP attributes values</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">serviceCertRDNTemplate</td><td colspan="1" rowspan="1" class="confluenceTd">cn=%s,ou=services</td><td colspan="1" rowspan="1" class="confluenceTd">Relative distinguished name for service certificates</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">serviceCertUIDTemplate</td><td colspan="1" rowspan="1" class="confluenceTd">cn=%s</td><td colspan="1" rowspan="1" class="confluenceTd">Template to transform service QName to DN for storing into attrUID</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">trustedAuthorityFilter</td><td colspan="1" rowspan="1" class="confluenceTd">(&(objectClass=inetOrgPerson)(ou:dn:=CAs))</td><td colspan="1" rowspan="1" class="confluenceTd">Filter to determine trusted CAs for truste
d chain validation</td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">intermediateFilter</td><td colspan="1" rowspan="1" class="confluenceTd">(objectClass=inetOrgPerson)</td><td colspan="1" rowspan="1" class="confluenceTd">Filter to determine intermediate certificates for trusted chain validation</td></tr></tbody></table>
+</div>
+
+
+<h4><a shape="rect" name="XMLKeyManagementService%28XKMS%29-IntegrationXKMSclientintoCXFruntime."></a>Integration XKMS client into CXF runtime.</h4>
-<p>XKMS client can be integrated into CXF and WSS4J using custom Crypto provider implementation. In this case XKMS service will be automatically invoked when WSS4J requires or validates certificate. Details are described in this <a shape="rect" class="external-link" href="http://ashakirin.blogspot.de/2013/04/cxf-security-getting-certificates-from.html" rel="nofollow">blog</a>.</p>
+<p>XKMS client can be integrated into CXF and WSS4J using custom Crypto provider implementation. In this case XKMS service will be automatically invoked when WSS4J requires or validates certificate. Details are described in this <a shape="rect" class="external-link" href="http://ashakirin.blogspot.de/2013/04/cxf-security-getting-certificates-from.html" rel="nofollow">blog</a>. Sample XKMS based implementation of WSS4J Crypto interface is contributed into XKMS Client component. </p>
<h4><a shape="rect" name="XMLKeyManagementService%28XKMS%29-DataFormats"></a>Data Formats</h4>