You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by srinivas thallapalli <sr...@gmail.com> on 2015/01/21 06:33:50 UTC
Security Related Questions
1. Can WS-Policy be used to control the access to a service, like limited
number of access to a service in day and only particular users are allowed
to access the service etc.
2. How Authorization can be achieved for a SOAP service.
--
View this message in context: http://cxf.547215.n5.nabble.com/Security-Related-Questions-tp5753340.html
Sent from the cxf-user mailing list archive at Nabble.com.
RE: Security Related Questions
Posted by Andrei Shakirin <as...@talend.com>.
Hi,
> -----Original Message-----
> From: srinivas thallapalli [mailto:sree.tallapalli@gmail.com]
> Sent: Freitag, 23. Januar 2015 10:53
> To: users@cxf.apache.org
> Subject: RE: Security Related Questions
>
> Hi Andrei,
>
> Thanks for providing very good resources.
>
> If I proceed with Custom Assertion and Interceptor provider approach, Will I be
> able to see the corresponding policy element in my generated WSDL
> automatically or we need to add the Policy element to WSDL manually.
> Basically I am using Java first approach.
You have to add policies into WSDL or use @Policy annotation (http://cxf.apache.org/docs/annotations.html).
Regards,
Andrei.
>
> Thanks
>
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Security-
> Related-Questions-tp5753340p5753441.html
> Sent from the cxf-user mailing list archive at Nabble.com.
RE: Security Related Questions
Posted by srinivas thallapalli <sr...@gmail.com>.
Hi Andrei,
Thanks for providing very good resources.
If I proceed with Custom Assertion and Interceptor provider approach, Will I
be able to see the corresponding policy element in my generated WSDL
automatically or we need to add the Policy element to WSDL manually.
Basically I am using Java first approach.
Thanks
--
View this message in context: http://cxf.547215.n5.nabble.com/Security-Related-Questions-tp5753340p5753441.html
Sent from the cxf-user mailing list archive at Nabble.com.
RE: Security Related Questions
Posted by Andrei Shakirin <as...@talend.com>.
Hi,
I have described it a bit in my blog: http://ashakirin.blogspot.de/2012/02/using-ws-policy-in-cxf-projects.html "Create custom policy assertions and associate interceptors".
There are some details in CXF documentation: http://cxf.apache.org/docs/developing-assertions.html.
You can take as sample any existing policy assertion (for example IssuedToken) and look how it is implemented in CXF in sense of Assertion Interface and Interceptors Provider. The policy assertion functionality is easily extendable.
You can also look into Talend ESB code based on CXF, it supports some proprietary policy assertions: https://github.com/Talend/tesb-rt-se/tree/master/policies/compression-policy.
Regards,
Andrei.
> -----Original Message-----
> From: srinivas thallapalli [mailto:sree.tallapalli@gmail.com]
> Sent: Freitag, 23. Januar 2015 08:21
> To: users@cxf.apache.org
> Subject: RE: Security Related Questions
>
> Thanks for reply.
>
> Could you please elaborate "proprietary policy assertion to activate custom
> interceptors". Please share some samples/links, if you have any sample
> proprietary policy assertion to activate custom interceptors to achieve similar
> to what I was looking for.
>
>
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Security-
> Related-Questions-tp5753340p5753438.html
> Sent from the cxf-user mailing list archive at Nabble.com.
RE: Security Related Questions
Posted by srinivas thallapalli <sr...@gmail.com>.
Thanks for reply.
Could you please elaborate "proprietary policy assertion to activate custom
interceptors". Please share some samples/links, if you have any sample
proprietary policy assertion to activate custom interceptors to achieve
similar to what I was looking for.
--
View this message in context: http://cxf.547215.n5.nabble.com/Security-Related-Questions-tp5753340p5753438.html
Sent from the cxf-user mailing list archive at Nabble.com.
RE: Security Related Questions
Posted by Andrei Shakirin <as...@talend.com>.
Hi,
> 1. Can WS-Policy be used to control the access to a service, like limited number
> of access to a service in day and only particular users are allowed to access the
> service etc.
Limited number of access (throttling) cannot be specified by standard WS-Policy. Basically you can add proprietary policy assertion to activate custom interceptors doing that.
There is also no standard policy assertion to authorization (allow/disallow access to service operations), but proprietary assertion can be introduced as well.
>
> 2. How Authorization can be achieved for a SOAP service.
There are some options here:
1) Simple authorization (annotation or configuration based). Here you will specify which roles/users are allowed to access service methods.
Look into http://cxf.apache.org/docs/security.html#Security-Authorization (SimpleAuthorizingInterceptor.java, SecureAnnotationsInterceptor.java and corresponded tests).
2) XACML partly supported in CXF. However, it is more involved solution. See AbstractXACMLAuthorizingInterceptor.java, https://issues.apache.org/jira/browse/CXF-4657
3) OAuth: http://cxf.apache.org/docs/jax-rs-oauth2.html
Regards,
Andrei.
>
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Security-
> Related-Questions-tp5753340.html
> Sent from the cxf-user mailing list archive at Nabble.com.