You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by "Shaw, Richard A" <ri...@atkinsglobal.com> on 2007/06/06 15:48:25 UTC
Talking to secure service
I've secured my service as per the hello_world_https sample but when I try to talk to my service it fails to get the WSDL.
I'm creating my service as follows -
QName serviceName = new QName("http://www.atkinsglobal.com/inform/dataaccess", "DataAccessService");
DataAccessService dataAccessService = new DataAccessService(new URL("http://localhost:9092/ChannelStore?wsdl"), serviceName);
I guess my problem is that my request for the wsdl is being rejected because I'm not asking for it securely.
My client config contains a the following conduit -
<http:conduit id="{http://www.atkinsglobal.com/inform/dataaccess}DataAccessPort.http-conduit">
How should I fix this ? Should I have a copy of the wsdl file locally ?
Richard Shaw
¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤
Richard Shaw
Technical Design Authority - Information Solutions Consultancy
Intelligent Transport Systems
Atkins Highways and Transportation
Woodcote Grove, Ashley Road, Epsom, Surrey, KT18 5BW
Tel: +44 (0) 1372 756407
Fax: +44 (0) 1372 740055
Mob: 07740 817586
E-mail: richard.shaw@atkinsglobal.com
www.atkinsglobal.com/its
This email and any attached files are confidential and copyright protected. If you are not the addressee, any dissemination of this communication is strictly prohibited. Unless otherwise expressly agreed in writing, nothing stated in this communication shall be legally binding.
The ultimate parent company of the Atkins Group is WS Atkins plc. Registered in England No. 1885586. Registered Office Woodcote Grove, Ashley Road, Epsom, Surrey KT18 5BW.
Consider the environment. Please don't print this e-mail unless you really need to.
Re: Talking to secure service
Posted by Sergey Beryozkin <se...@iona.com>.
Actually, you can just do HttpsURLConnection.setDefaultHostnameVerifier once at the start and not worry about casting of
URLConnections later on at all...
Cheers, Sergey
----- Original Message -----
From: "Sergey Beryozkin" <se...@iona.com>
To: <cx...@incubator.apache.org>
Sent: Thursday, June 07, 2007 12:27 PM
Subject: Re: Talking to secure service
Hi
I might've missed the answer to your question, but what you're seeing is the hostname verification in action, which is on by default
in JDK's HTTPs implementation....
I think CXF should allow to optionally disable it through the configuration. Alternatively, if you have an access to the
URLConnection instance, you may just want to check if it is the instance of HttpsURLConnection and if yes then set on it your own
implementation of the HostnameVerifier
http://java.sun.com/j2se/1.5.0/docs/api/javax/net/ssl/HostnameVerifier.html
it's a simple interface and you can just implement its single method to always return 'true'
Cheers, Sergey
----- Original Message -----
From: "Shaw, Richard A" <ri...@atkinsglobal.com>
To: <cx...@incubator.apache.org>
Sent: Wednesday, June 06, 2007 5:30 PM
Subject: RE: Talking to secure service
I've added the following to my system properties and it looks better but I still doesn't work (see below)
-Djavax.net.ssl.trustStore=etc/mosaic.truststore
-Djavax.net.ssl.keyStoreType=pkcs12
-Djavax.net.ssl.keyStore=etc/ChannelStore.p12
-Djavax.net.ssl.keyStorePassword=password
-Djavax.net.debug=SSL,handshake,data,trustmanager
I now get the following error -
HTTPS hostname wrong: should be <localhost>
Do I have to have localhost in my certificate somewhere ? Does it have to be the CN ?
Fianl question - shuold the hello_world_https sample be changed to get the wsdl from the service ?
Richard Shaw
¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤
Richard Shaw
Technical Design Authority - Information Solutions Consultancy
Intelligent Transport Systems
Atkins Highways and Transportation
Woodcote Grove, Ashley Road, Epsom, Surrey, KT18 5BW
Tel: +44 (0) 1372 756407
Fax: +44 (0) 1372 740055
Mob: 07740 817586
E-mail: richard.shaw@atkinsglobal.com
www.atkinsglobal.com/its
-----Original Message-----
From: Shaw, Richard A [mailto:richard.shaw@atkinsglobal.com]
Sent: 06 June 2007 14:48
To: cxf-user@incubator.apache.org
Subject: Talking to secure service
I've secured my service as per the hello_world_https sample but when I try to talk to my service it fails to get the WSDL.
I'm creating my service as follows -
QName serviceName = new QName("http://www.atkinsglobal.com/inform/dataaccess", "DataAccessService");
DataAccessService dataAccessService = new DataAccessService(new URL("http://localhost:9092/ChannelStore?wsdl"), serviceName);
I guess my problem is that my request for the wsdl is being rejected because I'm not asking for it securely.
My client config contains a the following conduit -
<http:conduit id="{http://www.atkinsglobal.com/inform/dataaccess}DataAccessPort.http-conduit">
How should I fix this ? Should I have a copy of the wsdl file locally ?
Richard Shaw
¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤
Richard Shaw
Technical Design Authority - Information Solutions Consultancy Intelligent Transport Systems
Atkins Highways and Transportation
Woodcote Grove, Ashley Road, Epsom, Surrey, KT18 5BW
Tel: +44 (0) 1372 756407
Fax: +44 (0) 1372 740055
Mob: 07740 817586
E-mail: richard.shaw@atkinsglobal.com
www.atkinsglobal.com/its
This email and any attached files are confidential and copyright protected. If you are not the addressee, any dissemination of this
communication is strictly prohibited. Unless otherwise expressly agreed in writing, nothing stated in this communication shall be
legally binding.
The ultimate parent company of the Atkins Group is WS Atkins plc. Registered in England No. 1885586. Registered Office Woodcote
Grove, Ashley Road, Epsom, Surrey KT18 5BW.
Consider the environment. Please don't print this e-mail unless you really need to.
This message has been scanned for viruses by MailControl - (see http://bluepages.wsatkins.co.uk/?6875772)
----------------------------
IONA Technologies PLC (registered in Ireland)
Registered Number: 171387
Registered Address: The IONA Building, Shelbourne Road, Dublin 4, Ireland
----------------------------
IONA Technologies PLC (registered in Ireland)
Registered Number: 171387
Registered Address: The IONA Building, Shelbourne Road, Dublin 4, Ireland
Re: Talking to secure service
Posted by Sergey Beryozkin <se...@iona.com>.
Hi
I might've missed the answer to your question, but what you're seeing is the hostname verification in action, which is on by default
in JDK's HTTPs implementation....
I think CXF should allow to optionally disable it through the configuration. Alternatively, if you have an access to the
URLConnection instance, you may just want to check if it is the instance of HttpsURLConnection and if yes then set on it your own
implementation of the HostnameVerifier
http://java.sun.com/j2se/1.5.0/docs/api/javax/net/ssl/HostnameVerifier.html
it's a simple interface and you can just implement its single method to always return 'true'
Cheers, Sergey
----- Original Message -----
From: "Shaw, Richard A" <ri...@atkinsglobal.com>
To: <cx...@incubator.apache.org>
Sent: Wednesday, June 06, 2007 5:30 PM
Subject: RE: Talking to secure service
I've added the following to my system properties and it looks better but I still doesn't work (see below)
-Djavax.net.ssl.trustStore=etc/mosaic.truststore
-Djavax.net.ssl.keyStoreType=pkcs12
-Djavax.net.ssl.keyStore=etc/ChannelStore.p12
-Djavax.net.ssl.keyStorePassword=password
-Djavax.net.debug=SSL,handshake,data,trustmanager
I now get the following error -
HTTPS hostname wrong: should be <localhost>
Do I have to have localhost in my certificate somewhere ? Does it have to be the CN ?
Fianl question - shuold the hello_world_https sample be changed to get the wsdl from the service ?
Richard Shaw
¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤
Richard Shaw
Technical Design Authority - Information Solutions Consultancy
Intelligent Transport Systems
Atkins Highways and Transportation
Woodcote Grove, Ashley Road, Epsom, Surrey, KT18 5BW
Tel: +44 (0) 1372 756407
Fax: +44 (0) 1372 740055
Mob: 07740 817586
E-mail: richard.shaw@atkinsglobal.com
www.atkinsglobal.com/its
-----Original Message-----
From: Shaw, Richard A [mailto:richard.shaw@atkinsglobal.com]
Sent: 06 June 2007 14:48
To: cxf-user@incubator.apache.org
Subject: Talking to secure service
I've secured my service as per the hello_world_https sample but when I try to talk to my service it fails to get the WSDL.
I'm creating my service as follows -
QName serviceName = new QName("http://www.atkinsglobal.com/inform/dataaccess", "DataAccessService");
DataAccessService dataAccessService = new DataAccessService(new URL("http://localhost:9092/ChannelStore?wsdl"), serviceName);
I guess my problem is that my request for the wsdl is being rejected because I'm not asking for it securely.
My client config contains a the following conduit -
<http:conduit id="{http://www.atkinsglobal.com/inform/dataaccess}DataAccessPort.http-conduit">
How should I fix this ? Should I have a copy of the wsdl file locally ?
Richard Shaw
¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤
Richard Shaw
Technical Design Authority - Information Solutions Consultancy Intelligent Transport Systems
Atkins Highways and Transportation
Woodcote Grove, Ashley Road, Epsom, Surrey, KT18 5BW
Tel: +44 (0) 1372 756407
Fax: +44 (0) 1372 740055
Mob: 07740 817586
E-mail: richard.shaw@atkinsglobal.com
www.atkinsglobal.com/its
This email and any attached files are confidential and copyright protected. If you are not the addressee, any dissemination of this
communication is strictly prohibited. Unless otherwise expressly agreed in writing, nothing stated in this communication shall be
legally binding.
The ultimate parent company of the Atkins Group is WS Atkins plc. Registered in England No. 1885586. Registered Office Woodcote
Grove, Ashley Road, Epsom, Surrey KT18 5BW.
Consider the environment. Please don't print this e-mail unless you really need to.
This message has been scanned for viruses by MailControl - (see http://bluepages.wsatkins.co.uk/?6875772)
----------------------------
IONA Technologies PLC (registered in Ireland)
Registered Number: 171387
Registered Address: The IONA Building, Shelbourne Road, Dublin 4, Ireland
RE: Talking to secure service
Posted by "Shaw, Richard A" <ri...@atkinsglobal.com>.
I've added the following to my system properties and it looks better but I still doesn't work (see below)
-Djavax.net.ssl.trustStore=etc/mosaic.truststore
-Djavax.net.ssl.keyStoreType=pkcs12
-Djavax.net.ssl.keyStore=etc/ChannelStore.p12
-Djavax.net.ssl.keyStorePassword=password
-Djavax.net.debug=SSL,handshake,data,trustmanager
I now get the following error -
HTTPS hostname wrong: should be <localhost>
Do I have to have localhost in my certificate somewhere ? Does it have to be the CN ?
Fianl question - shuold the hello_world_https sample be changed to get the wsdl from the service ?
Richard Shaw
¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤
Richard Shaw
Technical Design Authority - Information Solutions Consultancy
Intelligent Transport Systems
Atkins Highways and Transportation
Woodcote Grove, Ashley Road, Epsom, Surrey, KT18 5BW
Tel: +44 (0) 1372 756407
Fax: +44 (0) 1372 740055
Mob: 07740 817586
E-mail: richard.shaw@atkinsglobal.com
www.atkinsglobal.com/its
-----Original Message-----
From: Shaw, Richard A [mailto:richard.shaw@atkinsglobal.com]
Sent: 06 June 2007 14:48
To: cxf-user@incubator.apache.org
Subject: Talking to secure service
I've secured my service as per the hello_world_https sample but when I try to talk to my service it fails to get the WSDL.
I'm creating my service as follows -
QName serviceName = new QName("http://www.atkinsglobal.com/inform/dataaccess", "DataAccessService");
DataAccessService dataAccessService = new DataAccessService(new URL("http://localhost:9092/ChannelStore?wsdl"), serviceName);
I guess my problem is that my request for the wsdl is being rejected because I'm not asking for it securely.
My client config contains a the following conduit -
<http:conduit id="{http://www.atkinsglobal.com/inform/dataaccess}DataAccessPort.http-conduit">
How should I fix this ? Should I have a copy of the wsdl file locally ?
Richard Shaw
¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤
Richard Shaw
Technical Design Authority - Information Solutions Consultancy Intelligent Transport Systems
Atkins Highways and Transportation
Woodcote Grove, Ashley Road, Epsom, Surrey, KT18 5BW
Tel: +44 (0) 1372 756407
Fax: +44 (0) 1372 740055
Mob: 07740 817586
E-mail: richard.shaw@atkinsglobal.com
www.atkinsglobal.com/its
This email and any attached files are confidential and copyright protected. If you are not the addressee, any dissemination of this communication is strictly prohibited. Unless otherwise expressly agreed in writing, nothing stated in this communication shall be legally binding.
The ultimate parent company of the Atkins Group is WS Atkins plc. Registered in England No. 1885586. Registered Office Woodcote Grove, Ashley Road, Epsom, Surrey KT18 5BW.
Consider the environment. Please don't print this e-mail unless you really need to.
This message has been scanned for viruses by MailControl - (see http://bluepages.wsatkins.co.uk/?6875772)
RE: Talking to secure service
Posted by "Shaw, Richard A" <ri...@atkinsglobal.com>.
Thanks for the details. But can you answer the following -
How do I create a connection to my secure service ?
I'm using the following lines of code -
QName serviceName = new QName("http://www.atkinsglobal.com/inform/dataaccess", "DataAccessService");
QName portName = new QName("http://www.atkinsglobal.com/inform/dataaccess", "DataAccessPort");
DataAccessService dataAccessService = new DataAccessService(new URL("https://localhost:9095/DataAccessService?wsdl"), serviceName);
dataAccess = dataAccessService.getPort(portName, DataAccessI.class);
But this doesn't seem to be using CXF to fetch the wsdl file and therefore isn't adding security. I've enabled security in parallel to the CXF security which seems all wrong.
The wsdl that I get back from this service call seems to have the address set as http:// instead of https://
The hello_world_https sample has a local copy of the wsdl file instead of requesting it from the server, should I be doing this.
(For more details please see my other emails).
Richard Shaw
¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤
Richard Shaw
Technical Design Authority - Information Solutions Consultancy
Intelligent Transport Systems
Atkins Highways and Transportation
Woodcote Grove, Ashley Road, Epsom, Surrey, KT18 5BW
Tel: +44 (0) 1372 756407
Fax: +44 (0) 1372 740055
Mob: 07740 817586
E-mail: richard.shaw@atkinsglobal.com
www.atkinsglobal.com/its
-----Original Message-----
From: Fred Dushin [mailto:fred@dushin.net]
Sent: 07 June 2007 12:41
To: cxf-user@incubator.apache.org
Subject: Re: Talking to secure service
Hi Richard,
Not sure how "bleeding edge" you are, wrt CXF, but the SSL config model is about to go a substantial change. The old config model (configuring TLS paramters on a logical WSDL port) had some issues, particularly in container environments where you might have multiple WSDLs with the same http(s) address, but with different TLS parameters (or policies, if you will).
Cf http://tinyurl.com/2nldwn
Just a "head's up"
-Fred
On Jun 6, 2007, at 9:48 AM, Shaw, Richard A wrote:
> I've secured my service as per the hello_world_https sample but when I
> try to talk to my service it fails to get the WSDL.
>
> I'm creating my service as follows -
>
> QName serviceName = new QName("http://www.atkinsglobal.com/inform/
> dataaccess", "DataAccessService");
>
> DataAccessService dataAccessService = new DataAccessService(new URL
> ("http://localhost:9092/ChannelStore?wsdl"), serviceName);
>
> I guess my problem is that my request for the wsdl is being rejected
> because I'm not asking for it securely.
>
> My client config contains a the following conduit -
>
> <http:conduit id="{http://www.atkinsglobal.com/inform/dataaccess}
> DataAccessPort.http-conduit">
>
> How should I fix this ? Should I have a copy of the wsdl file locally
> ?
>
> Richard Shaw
>
> ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤
>
> Richard Shaw
> Technical Design Authority - Information Solutions Consultancy
> Intelligent Transport Systems
>
> Atkins Highways and Transportation
> Woodcote Grove, Ashley Road, Epsom, Surrey, KT18 5BW
>
> Tel: +44 (0) 1372 756407
> Fax: +44 (0) 1372 740055
> Mob: 07740 817586
> E-mail: richard.shaw@atkinsglobal.com
>
> www.atkinsglobal.com/its
>
>
>
> This email and any attached files are confidential and copyright
> protected. If you are not the addressee, any dissemination of this
> communication is strictly prohibited. Unless otherwise expressly
> agreed in writing, nothing stated in this communication shall be
> legally binding.
>
> The ultimate parent company of the Atkins Group is WS Atkins plc.
> Registered in England No. 1885586. Registered Office Woodcote Grove,
> Ashley Road, Epsom, Surrey KT18 5BW.
>
> Consider the environment. Please don't print this e-mail unless you
> really need to.
This message has been scanned for viruses by MailControl - (see http://bluepages.wsatkins.co.uk/?6875772)
Re: Talking to secure service
Posted by Fred Dushin <fr...@dushin.net>.
Hi Richard,
Not sure how "bleeding edge" you are, wrt CXF, but the SSL config
model is about to go a substantial change. The old config model
(configuring TLS paramters on a logical WSDL port) had some issues,
particularly in container environments where you might have multiple
WSDLs with the same http(s) address, but with different TLS
parameters (or policies, if you will).
Cf http://tinyurl.com/2nldwn
Just a "head's up"
-Fred
On Jun 6, 2007, at 9:48 AM, Shaw, Richard A wrote:
> I've secured my service as per the hello_world_https sample but
> when I try to talk to my service it fails to get the WSDL.
>
> I'm creating my service as follows -
>
> QName serviceName = new QName("http://www.atkinsglobal.com/inform/
> dataaccess", "DataAccessService");
>
> DataAccessService dataAccessService = new DataAccessService(new URL
> ("http://localhost:9092/ChannelStore?wsdl"), serviceName);
>
> I guess my problem is that my request for the wsdl is being
> rejected because I'm not asking for it securely.
>
> My client config contains a the following conduit -
>
> <http:conduit id="{http://www.atkinsglobal.com/inform/dataaccess}
> DataAccessPort.http-conduit">
>
> How should I fix this ? Should I have a copy of the wsdl file
> locally ?
>
> Richard Shaw
>
> ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø¤º°`°º¤ø,¸¸,ø¤
>
> Richard Shaw
> Technical Design Authority - Information Solutions Consultancy
> Intelligent Transport Systems
>
> Atkins Highways and Transportation
> Woodcote Grove, Ashley Road, Epsom, Surrey, KT18 5BW
>
> Tel: +44 (0) 1372 756407
> Fax: +44 (0) 1372 740055
> Mob: 07740 817586
> E-mail: richard.shaw@atkinsglobal.com
>
> www.atkinsglobal.com/its
>
>
>
> This email and any attached files are confidential and copyright
> protected. If you are not the addressee, any dissemination of this
> communication is strictly prohibited. Unless otherwise expressly
> agreed in writing, nothing stated in this communication shall be
> legally binding.
>
> The ultimate parent company of the Atkins Group is WS Atkins plc.
> Registered in England No. 1885586. Registered Office Woodcote
> Grove, Ashley Road, Epsom, Surrey KT18 5BW.
>
> Consider the environment. Please don't print this e-mail unless you
> really need to.