XMLRPC SSL implementation details

[de...@areujoking.com]

Hi all,

I am working with XMLRPC and SSL. I have the server under control, however
my I need to be able to create a client that is able the use an SSL
transport as well as participate (successfully) in mutual client
authentication.

I've had a good look around the javadocs and the source and it seems that
I need to setup the DefaultXmlRpcTransportFactory to do SSL using
SecurityTool. But unfortunately it gets more complex than that (sorry).

Security tool sets System properties, my client will be embedded in other
people's applications that do their own SSL transactions and so setting
the properties system wide is going to stop their applications from
running. So that approach isn't going to work.

I had the same problem a while ago with Axis and I ended up writing a full
SecureSocketFactory to get around the problem. My question is, do I need
to do a similar thing here, if so, what is the best approach, and if not,
is there a better way?

Thanks for your help,
Deakin

Re: XMLRPC SSL implementation details

[Daniel <da...@yorku.ca>]

Hi,

Further to my previous post:
http://marc.theaimsgroup.com/?l=xmlrpc-user&m=110235999608209&w=2

which only details how to use https globally because of the use of:
   HttpsURLConnection.setDefaultSSLSocketFactory(socketFactory);
(example class at:
http://www.yorku.ca/dkha/docs/xmlrpc/SecureXmlRpcTest.java)

you can create your own XmlRpcTransport implementation that would use
https and have it work "locally" for the app.  An example implementation
can be found here:
http://www.yorku.ca/dkha/docs/xmlrpc/SecureXmlRpcTransport.java

Then you just pass an instance of this class to the
SecureXmlRpcClient.execute(XmlRpcRequest, XmlRpcTransport) method.

You can easily modify the example driver program SecureXmlRpcTest.java
(above) to see how things work.

Hope this helps and good luck!

Regards,
Daniel

On Wed, 15 Jun 2005 dean@areujoking.com wrote:

>
> Hi all,
>
> I am working with XMLRPC and SSL. I have the server under control, however
> my I need to be able to create a client that is able the use an SSL
> transport as well as participate (successfully) in mutual client
> authentication.
>
> I've had a good look around the javadocs and the source and it seems that
> I need to setup the DefaultXmlRpcTransportFactory to do SSL using
> SecurityTool. But unfortunately it gets more complex than that (sorry).
>
> Security tool sets System properties, my client will be embedded in other
> people's applications that do their own SSL transactions and so setting
> the properties system wide is going to stop their applications from
> running. So that approach isn't going to work.
>
> I had the same problem a while ago with Axis and I ended up writing a full
> SecureSocketFactory to get around the problem. My question is, do I need
> to do a similar thing here, if so, what is the best approach, and if not,
> is there a better way?
>
> Thanks for your help,
> Deakin
>
>