You are viewing a plain text version of this content. The canonical link for it is here.
Posted to rampart-dev@ws.apache.org by Roxanne Yee <ry...@akimeka.com> on 2008/07/14 19:53:06 UTC
Newbie Basics: Security Policy
If I simply wanted to implement a web service that used a User Name Token authentication system with a Username and Password in Plaintext (no SSL for now, cause I'm a little sketchy on how to actually set that up), what would I need to do if using the Policy handler configuration?
Thanks.
=> RY
Re: Newbie Basics: passwordCallbackHandler
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
Hi,
Does anyone know if there are any thorough tutorials on how to write a
> passwordCallbackHander explaining how the code works?
>
Password callback handlers explained [1] tutorial explains how password
callback handlers work in Rampart.
thanks,
nandana
[1] - http://www.wso2.org/library/3733
--
Nandana Mihindukulasooriya
WSO2 inc.
http://nandana83.blogspot.com/
http://www.wso2.org
RE: Newbie Basics: passwordCallbackHandler
Posted by Dimuthu Leelarathne <di...@wso2.com>.
Hi,
Even though samples have the same password callback handler for both the
client and server, in a real world client and server should have
separate password callbacks. With the current implementation client
doesn't even need a password callback class. He can just say the
following.
options.setUserName("dimuthul");
options.setPassword("secret");
The key usage of Username token for plain password would be
WSPasswordCallback.UNKNOWN. At the server-side you can always check
what type of a callback.
switch (passwordCallback.getUsage()) {
case WSPasswordCallback.UNKNOWN:
........
break;
......
.......
}
Thank you,
Dimuthu
On Mon, 2008-07-14 at 09:03 -1000, Roxanne Yee wrote:
> Another question: Is the passwordCallbackClass provided in the Rampart samples for the server or the client? If it is for both, the what would be the difference? I've read http://wso2.org/node/240/print/ and am still confused.
>
>
> -----Original Message-----
> From: Roxanne Yee [mailto:ryee@akimeka.com]
> Sent: Mon 7/14/2008 8:55 AM
> To: rampart-dev@ws.apache.org
> Subject: Newbie Basics: passwordCallbackHandler
>
> Does anyone know if there are any thorough tutorials on how to write a passwordCallbackHander explaining how the code works?
>
> Thanks.
>
> =>RY
>
Re: Newbie Basics: Specfic Project
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
You can see the default value is 300 [1],
*public* *static* *final* *int* DEFAULT_TIMESTAMP_TTL = 300;
you can set this value using the RampartConfig using the property
"timestampTTL" . see [2].
thanks,
nandana
[1] -
http://svn.apache.org/viewvc/webservices/rampart/trunk/java/modules/rampart-core/src/main/java/org/apache/rampart/policy/model/RampartConfig.java?view=markup
[2] - http://ws.apache.org/rampart/rampartconfig-guide.html
On Wed, Jul 16, 2008 at 9:17 PM, Roxanne Yee <ry...@akimeka.com> wrote:
> Does Rampart, by default, automatically attach a Timestamp of 300 seconds?
>
>
> -----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Tue 7/15/2008 7:18 PM
> To: rampart-dev@ws.apache.org
> Subject: Re: Newbie Basics: Specfic Project
>
> > just encryption?
> >
>
> Replace the
> <sp:SignedParts xmlns:sp="
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
> <sp:Body />
> </sp:SignedParts>
>
> element with this element
>
> <sp:EncryptedParts xmlns:sp="
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
> <sp:Body />
> </sp:EncryptedParts>
>
> for just encryption. You can find out more about security policy in
> http://wso2.org/library/3132 .
>
> thanks,
> nandana
>
>
> -----Original Message-----
> > From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> > Sent: Tue 7/15/2008 6:32 PM
> > To: rampart-dev@ws.apache.org
> > Subject: Re: Newbie Basics: Specfic Project
> >
> > > Also, how difficult would it be to implement these standards over SSL?
> > >
> > http://wso2.org/library/3190
> >
> > Signature
> > http://wso2.org/library/3415
> >
> > -----Original Message-----
> > > From: Roxanne Yee [mailto:ryee@akimeka.com]
> > > Sent: Tue 7/15/2008 6:07 PM
> > > To: rampart-dev@ws.apache.org
> > > Subject: Newbie Basics: Specfic Project
> > >
> > > Hey everyone,
> > >
> > > I'm working on a project that needs to be finished in the next day or
> two
> > > (For where I'm located, that's around July 16, 2008).^^'Sorry everyone
> > for
> > > such a late notice! If anyone could help with the following issues, it
> > would
> > > me MOST APPRECIATED!
> > >
> > > Server: Axis2 1.4 inside of Tomcat 6.0.16 using the Rampart 1.4 module
> to
> > > implement WSS Security
> > > Client: soapUI 2.0.2? plugin for Eclipse
> > >
> > > Simple WSS Configurations I would like to apply as separate
> > > configurations(e.x. Timestamp Only or in combination if there is time):
> > > - User Name Token w/ username and password
> > > - Timestamp
> > > - Signatures
> > > - Encryption
> > >
> > > It would be even better if someone could explain what is needed on the
> > > soapUI side as well (if they have any experience with it).
> > >
> > > Thanks.
> > >
> > > =>RY
> > >
> > > P.S.
> > > :< Unfortunately, I'm unable to be at my work station right now until
> > about
> > > 12 to 12 and a half hours from now. Thus I can't really apply any
> > > suggestions at the moment, but I would still like to gain as much
> > knowledge
> > > as possible. That way I'll have a lot to think about in case people
> > aren't
> > > around the mailing list when I'm at my work station.
> > >
> > >
> > >
> >
> >
> --
> Nandana Mihindukulasooriya
> WSO2 inc.
>
> http://nandana83.blogspot.com/
>
>
RE: Newbie Basics: Specfic Project
Posted by Roxanne Yee <ry...@akimeka.com>.
Does Rampart, by default, automatically attach a Timestamp of 300 seconds?
-----Original Message-----
From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
Sent: Tue 7/15/2008 7:18 PM
To: rampart-dev@ws.apache.org
Subject: Re: Newbie Basics: Specfic Project
> just encryption?
>
Replace the
<sp:SignedParts xmlns:sp="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<sp:Body />
</sp:SignedParts>
element with this element
<sp:EncryptedParts xmlns:sp="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<sp:Body />
</sp:EncryptedParts>
for just encryption. You can find out more about security policy in
http://wso2.org/library/3132 .
thanks,
nandana
-----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Tue 7/15/2008 6:32 PM
> To: rampart-dev@ws.apache.org
> Subject: Re: Newbie Basics: Specfic Project
>
> > Also, how difficult would it be to implement these standards over SSL?
> >
> http://wso2.org/library/3190
>
> Signature
> http://wso2.org/library/3415
>
> -----Original Message-----
> > From: Roxanne Yee [mailto:ryee@akimeka.com]
> > Sent: Tue 7/15/2008 6:07 PM
> > To: rampart-dev@ws.apache.org
> > Subject: Newbie Basics: Specfic Project
> >
> > Hey everyone,
> >
> > I'm working on a project that needs to be finished in the next day or two
> > (For where I'm located, that's around July 16, 2008).^^'Sorry everyone
> for
> > such a late notice! If anyone could help with the following issues, it
> would
> > me MOST APPRECIATED!
> >
> > Server: Axis2 1.4 inside of Tomcat 6.0.16 using the Rampart 1.4 module to
> > implement WSS Security
> > Client: soapUI 2.0.2? plugin for Eclipse
> >
> > Simple WSS Configurations I would like to apply as separate
> > configurations(e.x. Timestamp Only or in combination if there is time):
> > - User Name Token w/ username and password
> > - Timestamp
> > - Signatures
> > - Encryption
> >
> > It would be even better if someone could explain what is needed on the
> > soapUI side as well (if they have any experience with it).
> >
> > Thanks.
> >
> > =>RY
> >
> > P.S.
> > :< Unfortunately, I'm unable to be at my work station right now until
> about
> > 12 to 12 and a half hours from now. Thus I can't really apply any
> > suggestions at the moment, but I would still like to gain as much
> knowledge
> > as possible. That way I'll have a lot to think about in case people
> aren't
> > around the mailing list when I'm at my work station.
> >
> >
> >
>
>
--
Nandana Mihindukulasooriya
WSO2 inc.
http://nandana83.blogspot.com/
RE: Newbie Basics: Specfic Project
Posted by Roxanne Yee <ry...@akimeka.com>.
Actually, I should probably ask instead: are there any features that Rampart by default, automatically places in when you choose a configuration? Or do the users have full control? For instance, if we use a User Name Token, is a <Nonce> and a <Created> already attached?
-----Original Message-----
From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
Sent: Tue 7/15/2008 7:18 PM
To: rampart-dev@ws.apache.org
Subject: Re: Newbie Basics: Specfic Project
> just encryption?
>
Replace the
<sp:SignedParts xmlns:sp="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<sp:Body />
</sp:SignedParts>
element with this element
<sp:EncryptedParts xmlns:sp="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<sp:Body />
</sp:EncryptedParts>
for just encryption. You can find out more about security policy in
http://wso2.org/library/3132 .
thanks,
nandana
-----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Tue 7/15/2008 6:32 PM
> To: rampart-dev@ws.apache.org
> Subject: Re: Newbie Basics: Specfic Project
>
> > Also, how difficult would it be to implement these standards over SSL?
> >
> http://wso2.org/library/3190
>
> Signature
> http://wso2.org/library/3415
>
> -----Original Message-----
> > From: Roxanne Yee [mailto:ryee@akimeka.com]
> > Sent: Tue 7/15/2008 6:07 PM
> > To: rampart-dev@ws.apache.org
> > Subject: Newbie Basics: Specfic Project
> >
> > Hey everyone,
> >
> > I'm working on a project that needs to be finished in the next day or two
> > (For where I'm located, that's around July 16, 2008).^^'Sorry everyone
> for
> > such a late notice! If anyone could help with the following issues, it
> would
> > me MOST APPRECIATED!
> >
> > Server: Axis2 1.4 inside of Tomcat 6.0.16 using the Rampart 1.4 module to
> > implement WSS Security
> > Client: soapUI 2.0.2? plugin for Eclipse
> >
> > Simple WSS Configurations I would like to apply as separate
> > configurations(e.x. Timestamp Only or in combination if there is time):
> > - User Name Token w/ username and password
> > - Timestamp
> > - Signatures
> > - Encryption
> >
> > It would be even better if someone could explain what is needed on the
> > soapUI side as well (if they have any experience with it).
> >
> > Thanks.
> >
> > =>RY
> >
> > P.S.
> > :< Unfortunately, I'm unable to be at my work station right now until
> about
> > 12 to 12 and a half hours from now. Thus I can't really apply any
> > suggestions at the moment, but I would still like to gain as much
> knowledge
> > as possible. That way I'll have a lot to think about in case people
> aren't
> > around the mailing list when I'm at my work station.
> >
> >
> >
>
>
--
Nandana Mihindukulasooriya
WSO2 inc.
http://nandana83.blogspot.com/
Re: Newbie Basics: Specfic Project
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
> just encryption?
>
Replace the
<sp:SignedParts xmlns:sp="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<sp:Body />
</sp:SignedParts>
element with this element
<sp:EncryptedParts xmlns:sp="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<sp:Body />
</sp:EncryptedParts>
for just encryption. You can find out more about security policy in
http://wso2.org/library/3132 .
thanks,
nandana
-----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Tue 7/15/2008 6:32 PM
> To: rampart-dev@ws.apache.org
> Subject: Re: Newbie Basics: Specfic Project
>
> > Also, how difficult would it be to implement these standards over SSL?
> >
> http://wso2.org/library/3190
>
> Signature
> http://wso2.org/library/3415
>
> -----Original Message-----
> > From: Roxanne Yee [mailto:ryee@akimeka.com]
> > Sent: Tue 7/15/2008 6:07 PM
> > To: rampart-dev@ws.apache.org
> > Subject: Newbie Basics: Specfic Project
> >
> > Hey everyone,
> >
> > I'm working on a project that needs to be finished in the next day or two
> > (For where I'm located, that's around July 16, 2008).^^'Sorry everyone
> for
> > such a late notice! If anyone could help with the following issues, it
> would
> > me MOST APPRECIATED!
> >
> > Server: Axis2 1.4 inside of Tomcat 6.0.16 using the Rampart 1.4 module to
> > implement WSS Security
> > Client: soapUI 2.0.2? plugin for Eclipse
> >
> > Simple WSS Configurations I would like to apply as separate
> > configurations(e.x. Timestamp Only or in combination if there is time):
> > - User Name Token w/ username and password
> > - Timestamp
> > - Signatures
> > - Encryption
> >
> > It would be even better if someone could explain what is needed on the
> > soapUI side as well (if they have any experience with it).
> >
> > Thanks.
> >
> > =>RY
> >
> > P.S.
> > :< Unfortunately, I'm unable to be at my work station right now until
> about
> > 12 to 12 and a half hours from now. Thus I can't really apply any
> > suggestions at the moment, but I would still like to gain as much
> knowledge
> > as possible. That way I'll have a lot to think about in case people
> aren't
> > around the mailing list when I'm at my work station.
> >
> >
> >
>
>
--
Nandana Mihindukulasooriya
WSO2 inc.
http://nandana83.blogspot.com/
RE: Newbie Basics: Specfic Project
Posted by Roxanne Yee <ry...@akimeka.com>.
Thanks. How about what the restrictions are for <tag>[what's in here?]</tag> Are there any?
-----Original Message-----
From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
Sent: Tue 7/15/2008 7:11 PM
To: rampart-dev@ws.apache.org
Subject: Re: Newbie Basics: Specfic Project
On Wed, Jul 16, 2008 at 10:25 AM, Roxanne Yee <ry...@akimeka.com> wrote:
> I think that the thing that is most mysterious to me is what is allowed
> between all the rampart tags. Could anyone at least point me to the right
> source code file to look for these?
>
http://svn.apache.org/viewvc/webservices/rampart/trunk/java/modules/rampart-core/src/main/java/org/apache/rampart/policy/model/RampartConfig.java?view=markup
> -----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Tue 7/15/2008 6:32 PM
> To: rampart-dev@ws.apache.org
> Subject: Re: Newbie Basics: Specfic Project
>
> > Also, how difficult would it be to implement these standards over SSL?
> >
> http://wso2.org/library/3190
>
> Signature
> http://wso2.org/library/3415
>
> -----Original Message-----
> > From: Roxanne Yee [mailto:ryee@akimeka.com]
> > Sent: Tue 7/15/2008 6:07 PM
> > To: rampart-dev@ws.apache.org
> > Subject: Newbie Basics: Specfic Project
> >
> > Hey everyone,
> >
> > I'm working on a project that needs to be finished in the next day or two
> > (For where I'm located, that's around July 16, 2008).^^'Sorry everyone
> for
> > such a late notice! If anyone could help with the following issues, it
> would
> > me MOST APPRECIATED!
> >
> > Server: Axis2 1.4 inside of Tomcat 6.0.16 using the Rampart 1.4 module to
> > implement WSS Security
> > Client: soapUI 2.0.2? plugin for Eclipse
> >
> > Simple WSS Configurations I would like to apply as separate
> > configurations(e.x. Timestamp Only or in combination if there is time):
> > - User Name Token w/ username and password
> > - Timestamp
> > - Signatures
> > - Encryption
> >
> > It would be even better if someone could explain what is needed on the
> > soapUI side as well (if they have any experience with it).
> >
> > Thanks.
> >
> > =>RY
> >
> > P.S.
> > :< Unfortunately, I'm unable to be at my work station right now until
> about
> > 12 to 12 and a half hours from now. Thus I can't really apply any
> > suggestions at the moment, but I would still like to gain as much
> knowledge
> > as possible. That way I'll have a lot to think about in case people
> aren't
> > around the mailing list when I'm at my work station.
> >
> >
>
>
Re: Newbie Basics: Specfic Project
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
On Wed, Jul 16, 2008 at 10:25 AM, Roxanne Yee <ry...@akimeka.com> wrote:
> I think that the thing that is most mysterious to me is what is allowed
> between all the rampart tags. Could anyone at least point me to the right
> source code file to look for these?
>
http://svn.apache.org/viewvc/webservices/rampart/trunk/java/modules/rampart-core/src/main/java/org/apache/rampart/policy/model/RampartConfig.java?view=markup
> -----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Tue 7/15/2008 6:32 PM
> To: rampart-dev@ws.apache.org
> Subject: Re: Newbie Basics: Specfic Project
>
> > Also, how difficult would it be to implement these standards over SSL?
> >
> http://wso2.org/library/3190
>
> Signature
> http://wso2.org/library/3415
>
> -----Original Message-----
> > From: Roxanne Yee [mailto:ryee@akimeka.com]
> > Sent: Tue 7/15/2008 6:07 PM
> > To: rampart-dev@ws.apache.org
> > Subject: Newbie Basics: Specfic Project
> >
> > Hey everyone,
> >
> > I'm working on a project that needs to be finished in the next day or two
> > (For where I'm located, that's around July 16, 2008).^^'Sorry everyone
> for
> > such a late notice! If anyone could help with the following issues, it
> would
> > me MOST APPRECIATED!
> >
> > Server: Axis2 1.4 inside of Tomcat 6.0.16 using the Rampart 1.4 module to
> > implement WSS Security
> > Client: soapUI 2.0.2? plugin for Eclipse
> >
> > Simple WSS Configurations I would like to apply as separate
> > configurations(e.x. Timestamp Only or in combination if there is time):
> > - User Name Token w/ username and password
> > - Timestamp
> > - Signatures
> > - Encryption
> >
> > It would be even better if someone could explain what is needed on the
> > soapUI side as well (if they have any experience with it).
> >
> > Thanks.
> >
> > =>RY
> >
> > P.S.
> > :< Unfortunately, I'm unable to be at my work station right now until
> about
> > 12 to 12 and a half hours from now. Thus I can't really apply any
> > suggestions at the moment, but I would still like to gain as much
> knowledge
> > as possible. That way I'll have a lot to think about in case people
> aren't
> > around the mailing list when I'm at my work station.
> >
> >
>
>
RE: Newbie Basics: Specfic Project
Posted by Roxanne Yee <ry...@akimeka.com>.
I think that the thing that is most mysterious to me is what is allowed between all the rampart tags. Could anyone at least point me to the right source code file to look for these?
-----Original Message-----
From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
Sent: Tue 7/15/2008 6:32 PM
To: rampart-dev@ws.apache.org
Subject: Re: Newbie Basics: Specfic Project
> Also, how difficult would it be to implement these standards over SSL?
>
http://wso2.org/library/3190
Signature
http://wso2.org/library/3415
-----Original Message-----
> From: Roxanne Yee [mailto:ryee@akimeka.com]
> Sent: Tue 7/15/2008 6:07 PM
> To: rampart-dev@ws.apache.org
> Subject: Newbie Basics: Specfic Project
>
> Hey everyone,
>
> I'm working on a project that needs to be finished in the next day or two
> (For where I'm located, that's around July 16, 2008).^^'Sorry everyone for
> such a late notice! If anyone could help with the following issues, it would
> me MOST APPRECIATED!
>
> Server: Axis2 1.4 inside of Tomcat 6.0.16 using the Rampart 1.4 module to
> implement WSS Security
> Client: soapUI 2.0.2? plugin for Eclipse
>
> Simple WSS Configurations I would like to apply as separate
> configurations(e.x. Timestamp Only or in combination if there is time):
> - User Name Token w/ username and password
> - Timestamp
> - Signatures
> - Encryption
>
> It would be even better if someone could explain what is needed on the
> soapUI side as well (if they have any experience with it).
>
> Thanks.
>
> =>RY
>
> P.S.
> :< Unfortunately, I'm unable to be at my work station right now until about
> 12 to 12 and a half hours from now. Thus I can't really apply any
> suggestions at the moment, but I would still like to gain as much knowledge
> as possible. That way I'll have a lot to think about in case people aren't
> around the mailing list when I'm at my work station.
>
>
>
RE: Newbie Basics: Specfic Project
Posted by Roxanne Yee <ry...@akimeka.com>.
Would you happen to know where to find policies with just a timestamp and just encryption?
-----Original Message-----
From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
Sent: Tue 7/15/2008 6:32 PM
To: rampart-dev@ws.apache.org
Subject: Re: Newbie Basics: Specfic Project
> Also, how difficult would it be to implement these standards over SSL?
>
http://wso2.org/library/3190
Signature
http://wso2.org/library/3415
-----Original Message-----
> From: Roxanne Yee [mailto:ryee@akimeka.com]
> Sent: Tue 7/15/2008 6:07 PM
> To: rampart-dev@ws.apache.org
> Subject: Newbie Basics: Specfic Project
>
> Hey everyone,
>
> I'm working on a project that needs to be finished in the next day or two
> (For where I'm located, that's around July 16, 2008).^^'Sorry everyone for
> such a late notice! If anyone could help with the following issues, it would
> me MOST APPRECIATED!
>
> Server: Axis2 1.4 inside of Tomcat 6.0.16 using the Rampart 1.4 module to
> implement WSS Security
> Client: soapUI 2.0.2? plugin for Eclipse
>
> Simple WSS Configurations I would like to apply as separate
> configurations(e.x. Timestamp Only or in combination if there is time):
> - User Name Token w/ username and password
> - Timestamp
> - Signatures
> - Encryption
>
> It would be even better if someone could explain what is needed on the
> soapUI side as well (if they have any experience with it).
>
> Thanks.
>
> =>RY
>
> P.S.
> :< Unfortunately, I'm unable to be at my work station right now until about
> 12 to 12 and a half hours from now. Thus I can't really apply any
> suggestions at the moment, but I would still like to gain as much knowledge
> as possible. That way I'll have a lot to think about in case people aren't
> around the mailing list when I'm at my work station.
>
>
>
Re: Newbie Basics: Specfic Project
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
> Also, how difficult would it be to implement these standards over SSL?
>
http://wso2.org/library/3190
Signature
http://wso2.org/library/3415
-----Original Message-----
> From: Roxanne Yee [mailto:ryee@akimeka.com]
> Sent: Tue 7/15/2008 6:07 PM
> To: rampart-dev@ws.apache.org
> Subject: Newbie Basics: Specfic Project
>
> Hey everyone,
>
> I'm working on a project that needs to be finished in the next day or two
> (For where I'm located, that's around July 16, 2008).^^'Sorry everyone for
> such a late notice! If anyone could help with the following issues, it would
> me MOST APPRECIATED!
>
> Server: Axis2 1.4 inside of Tomcat 6.0.16 using the Rampart 1.4 module to
> implement WSS Security
> Client: soapUI 2.0.2? plugin for Eclipse
>
> Simple WSS Configurations I would like to apply as separate
> configurations(e.x. Timestamp Only or in combination if there is time):
> - User Name Token w/ username and password
> - Timestamp
> - Signatures
> - Encryption
>
> It would be even better if someone could explain what is needed on the
> soapUI side as well (if they have any experience with it).
>
> Thanks.
>
> =>RY
>
> P.S.
> :< Unfortunately, I'm unable to be at my work station right now until about
> 12 to 12 and a half hours from now. Thus I can't really apply any
> suggestions at the moment, but I would still like to gain as much knowledge
> as possible. That way I'll have a lot to think about in case people aren't
> around the mailing list when I'm at my work station.
>
>
>
RE: Newbie Basics: Policy Sample 01
Posted by Roxanne Yee <ry...@akimeka.com>.
Actually, I think that Rampart 1.3 and Rampart 1.4 classes were conflicting. Because after I removed the Rampart 1.3 jar files, I didn't receive that error. However, I have a new problem in which, the service is deployed smoothly but I get an "Internal Server Error" when I try to access the WSDL file from http://localhost:8080/axis2/.
-----Original Message-----
From: Dimuthu Leelarathne [mailto:dimuthul@wso2.com]
Sent: Mon 7/14/2008 6:09 PM
To: rampart-dev@ws.apache.org
Subject: RE: Newbie Basics: Policy Sample 01
Hi,
You have to add rampart .jar files into classpath.
So copy the *.jar files inside rampart distribution lib into
webapps/axis2/WEB-INF/lib
Copy the *.mar files inside rampart distribution modules into
webapps/axis2/WEB-INF/modules
There is sample inside samples/policy/sample-tomcat.
Thank you,
Dimuthu
On Mon, 2008-07-14 at 11:39 -1000, Roxanne Yee wrote:
> All I've done is built it with ant and place the .aar file into the tomcat/webapps/axis2/WEB-INF/services directory.
> It is when I try to access the wsdl file from the axis2 server that I get the error.
>
> Thanks.
>
> =>RY
>
> -----Original Message-----
> From: Roxanne Yee [mailto:ryee@akimeka.com]
> Sent: Mon 7/14/2008 11:21 AM
> To: rampart-dev@ws.apache.org
> Subject: RE: Newbie Basics: Policy Sample 01
>
> Sorry, I'm having trouble executing policy/sample01 and receive the following error.
> Has anyone else had this problem?
>
> Error: java.lang.NoSuchMethodError: org.apache.ws.secpolicy.model.TransportBinding.(I)V at org.apache.ws.secpolicy11.builders.TransportBindingBuilder.build(TransportBindingBuilder.java:40) at org.apache.neethi.AssertionBuilderFactory.build(AssertionBuilderFactory.java:99) at org.apache.neethi.PolicyEngine.processOperationElement(PolicyEngine.java:225) at org.apache.neethi.PolicyEngine.getAllOperator(PolicyEngine.java:162) at org.apache.neethi.PolicyEngine.processOperationElement(PolicyEngine.java:216) at org.apache.neethi.PolicyEngine.getExactlyOneOperator(PolicyEngine.java:158) at org.apache.neethi.PolicyEngine.processOperationElement(PolicyEngine.java:211) at org.apache.neethi.PolicyEngine.getPolicyOperator(PolicyEngine.java:154) at org.apache.neethi.PolicyEngine.getPolicy(PolicyEngine.java:126) at org.apache.axis2.deployment.DescriptionBuilder.processPolicyElements(DescriptionBuilder.java:638) at org.apache.axis2.deployment.ServiceBuilder.populateService(ServiceBuilder.java:304) at org.apache.axis2.deployment.repository.util.ArchiveReader.buildServiceGroup(ArchiveReader.java:102) at org.apache.axis2.deployment.repository.util.ArchiveReader.processServiceGroup(ArchiveReader.java:144) at org.apache.axis2.deployment.ServiceDeployer.deploy(ServiceDeployer.java:81) at org.apache.axis2.deployment.repository.util.DeploymentFileData.deploy(DeploymentFileData.java:136) at org.apache.axis2.deployment.DeploymentEngine.doDeploy(DeploymentEngine.java:597) at org.apache.axis2.deployment.repository.util.WSInfoList.update(WSInfoList.java:144) at org.apache.axis2.deployment.RepositoryListener.update(RepositoryListener.java:330) at org.apache.axis2.deployment.RepositoryListener.checkServices(RepositoryListener.java:227) at org.apache.axis2.deployment.DeploymentEngine.loadServices(DeploymentEngine.java:131) at org.apache.axis2.deployment.WarBasedAxisConfigurator.loadServices(WarBasedAxisConfigurator.java:284) at org.apache.axis2.context.ConfigurationContextFactory.createConfigurationContext(ConfigurationContextFactory.java:82) at org.apache.axis2.transport.http.AxisServlet.initConfigContext(AxisServlet.java:511) at org.apache.axis2.transport.http.AxisServlet.init(AxisServlet.java:431) at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1161) at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:981) at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4058) at org.apache.catalina.core.StandardContext.start(StandardContext.java:4364) at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:525) at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:829) at org.apache.catalina.startup.HostConfig.deployWARs(HostConfig.java:718) at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:490) at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1147) at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311) at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117) at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053) at org.apache.catalina.core.StandardHost.start(StandardHost.java:719) at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045) at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443) at org.apache.catalina.core.StandardService.start(StandardService.java:516) at org.apache.catalina.core.StandardServer.start(StandardServer.java:710) at org.apache.catalina.startup.Catalina.start(Catalina.java:578) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
>
> Thanks.
>
> =>RY
>
RE: Newbie Basics: Specfic Project
Posted by Roxanne Yee <ry...@akimeka.com>.
I know this seems kind of silly, but is it possible to ask if someone's already written the policy file for these situations?
Also, how difficult would it be to implement these standards over SSL?
Thanks again!
=>RY
-----Original Message-----
From: Roxanne Yee [mailto:ryee@akimeka.com]
Sent: Tue 7/15/2008 6:07 PM
To: rampart-dev@ws.apache.org
Subject: Newbie Basics: Specfic Project
Hey everyone,
I'm working on a project that needs to be finished in the next day or two (For where I'm located, that's around July 16, 2008).^^'Sorry everyone for such a late notice! If anyone could help with the following issues, it would me MOST APPRECIATED!
Server: Axis2 1.4 inside of Tomcat 6.0.16 using the Rampart 1.4 module to implement WSS Security
Client: soapUI 2.0.2? plugin for Eclipse
Simple WSS Configurations I would like to apply as separate configurations(e.x. Timestamp Only or in combination if there is time):
- User Name Token w/ username and password
- Timestamp
- Signatures
- Encryption
It would be even better if someone could explain what is needed on the soapUI side as well (if they have any experience with it).
Thanks.
=>RY
P.S.
:< Unfortunately, I'm unable to be at my work station right now until about 12 to 12 and a half hours from now. Thus I can't really apply any suggestions at the moment, but I would still like to gain as much knowledge as possible. That way I'll have a lot to think about in case people aren't around the mailing list when I'm at my work station.
Newbie Basics: Specfic Project
Posted by Roxanne Yee <ry...@akimeka.com>.
Hey everyone,
I'm working on a project that needs to be finished in the next day or two (For where I'm located, that's around July 16, 2008).^^'Sorry everyone for such a late notice! If anyone could help with the following issues, it would me MOST APPRECIATED!
Server: Axis2 1.4 inside of Tomcat 6.0.16 using the Rampart 1.4 module to implement WSS Security
Client: soapUI 2.0.2? plugin for Eclipse
Simple WSS Configurations I would like to apply as separate configurations(e.x. Timestamp Only or in combination if there is time):
- User Name Token w/ username and password
- Timestamp
- Signatures
- Encryption
It would be even better if someone could explain what is needed on the soapUI side as well (if they have any experience with it).
Thanks.
=>RY
P.S.
:< Unfortunately, I'm unable to be at my work station right now until about 12 to 12 and a half hours from now. Thus I can't really apply any suggestions at the moment, but I would still like to gain as much knowledge as possible. That way I'll have a lot to think about in case people aren't around the mailing list when I'm at my work station.
RE: Newbie Basics: Policy Sample 01
Posted by Dimuthu Leelarathne <di...@wso2.com>.
Hi,
You have to add rampart .jar files into classpath.
So copy the *.jar files inside rampart distribution lib into
webapps/axis2/WEB-INF/lib
Copy the *.mar files inside rampart distribution modules into
webapps/axis2/WEB-INF/modules
There is sample inside samples/policy/sample-tomcat.
Thank you,
Dimuthu
On Mon, 2008-07-14 at 11:39 -1000, Roxanne Yee wrote:
> All I've done is built it with ant and place the .aar file into the tomcat/webapps/axis2/WEB-INF/services directory.
> It is when I try to access the wsdl file from the axis2 server that I get the error.
>
> Thanks.
>
> =>RY
>
> -----Original Message-----
> From: Roxanne Yee [mailto:ryee@akimeka.com]
> Sent: Mon 7/14/2008 11:21 AM
> To: rampart-dev@ws.apache.org
> Subject: RE: Newbie Basics: Policy Sample 01
>
> Sorry, I'm having trouble executing policy/sample01 and receive the following error.
> Has anyone else had this problem?
>
> Error: java.lang.NoSuchMethodError: org.apache.ws.secpolicy.model.TransportBinding.(I)V at org.apache.ws.secpolicy11.builders.TransportBindingBuilder.build(TransportBindingBuilder.java:40) at org.apache.neethi.AssertionBuilderFactory.build(AssertionBuilderFactory.java:99) at org.apache.neethi.PolicyEngine.processOperationElement(PolicyEngine.java:225) at org.apache.neethi.PolicyEngine.getAllOperator(PolicyEngine.java:162) at org.apache.neethi.PolicyEngine.processOperationElement(PolicyEngine.java:216) at org.apache.neethi.PolicyEngine.getExactlyOneOperator(PolicyEngine.java:158) at org.apache.neethi.PolicyEngine.processOperationElement(PolicyEngine.java:211) at org.apache.neethi.PolicyEngine.getPolicyOperator(PolicyEngine.java:154) at org.apache.neethi.PolicyEngine.getPolicy(PolicyEngine.java:126) at org.apache.axis2.deployment.DescriptionBuilder.processPolicyElements(DescriptionBuilder.java:638) at org.apache.axis2.deployment.ServiceBuilder.populateService(ServiceBuilder.java:304) at org.apache.axis2.deployment.repository.util.ArchiveReader.buildServiceGroup(ArchiveReader.java:102) at org.apache.axis2.deployment.repository.util.ArchiveReader.processServiceGroup(ArchiveReader.java:144) at org.apache.axis2.deployment.ServiceDeployer.deploy(ServiceDeployer.java:81) at org.apache.axis2.deployment.repository.util.DeploymentFileData.deploy(DeploymentFileData.java:136) at org.apache.axis2.deployment.DeploymentEngine.doDeploy(DeploymentEngine.java:597) at org.apache.axis2.deployment.repository.util.WSInfoList.update(WSInfoList.java:144) at org.apache.axis2.deployment.RepositoryListener.update(RepositoryListener.java:330) at org.apache.axis2.deployment.RepositoryListener.checkServices(RepositoryListener.java:227) at org.apache.axis2.deployment.DeploymentEngine.loadServices(DeploymentEngine.java:131) at org.apache.axis2.deployment.WarBasedAxisConfigurator.loadServices(WarBasedAxisConfigurator.java:284) at org.apache.axis2.context.ConfigurationContextFactory.createConfigurationContext(ConfigurationContextFactory.java:82) at org.apache.axis2.transport.http.AxisServlet.initConfigContext(AxisServlet.java:511) at org.apache.axis2.transport.http.AxisServlet.init(AxisServlet.java:431) at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1161) at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:981) at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4058) at org.apache.catalina.core.StandardContext.start(StandardContext.java:4364) at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:525) at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:829) at org.apache.catalina.startup.HostConfig.deployWARs(HostConfig.java:718) at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:490) at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1147) at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311) at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117) at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053) at org.apache.catalina.core.StandardHost.start(StandardHost.java:719) at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045) at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443) at org.apache.catalina.core.StandardService.start(StandardService.java:516) at org.apache.catalina.core.StandardServer.start(StandardServer.java:710) at org.apache.catalina.startup.Catalina.start(Catalina.java:578) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
>
> Thanks.
>
> =>RY
>
RE: Newbie Basics: Policy Sample 01
Posted by Roxanne Yee <ry...@akimeka.com>.
All I've done is built it with ant and place the .aar file into the tomcat/webapps/axis2/WEB-INF/services directory.
It is when I try to access the wsdl file from the axis2 server that I get the error.
Thanks.
=>RY
-----Original Message-----
From: Roxanne Yee [mailto:ryee@akimeka.com]
Sent: Mon 7/14/2008 11:21 AM
To: rampart-dev@ws.apache.org
Subject: RE: Newbie Basics: Policy Sample 01
Sorry, I'm having trouble executing policy/sample01 and receive the following error.
Has anyone else had this problem?
Error: java.lang.NoSuchMethodError: org.apache.ws.secpolicy.model.TransportBinding.(I)V at org.apache.ws.secpolicy11.builders.TransportBindingBuilder.build(TransportBindingBuilder.java:40) at org.apache.neethi.AssertionBuilderFactory.build(AssertionBuilderFactory.java:99) at org.apache.neethi.PolicyEngine.processOperationElement(PolicyEngine.java:225) at org.apache.neethi.PolicyEngine.getAllOperator(PolicyEngine.java:162) at org.apache.neethi.PolicyEngine.processOperationElement(PolicyEngine.java:216) at org.apache.neethi.PolicyEngine.getExactlyOneOperator(PolicyEngine.java:158) at org.apache.neethi.PolicyEngine.processOperationElement(PolicyEngine.java:211) at org.apache.neethi.PolicyEngine.getPolicyOperator(PolicyEngine.java:154) at org.apache.neethi.PolicyEngine.getPolicy(PolicyEngine.java:126) at org.apache.axis2.deployment.DescriptionBuilder.processPolicyElements(DescriptionBuilder.java:638) at org.apache.axis2.deployment.ServiceBuilder.populateService(ServiceBuilder.java:304) at org.apache.axis2.deployment.repository.util.ArchiveReader.buildServiceGroup(ArchiveReader.java:102) at org.apache.axis2.deployment.repository.util.ArchiveReader.processServiceGroup(ArchiveReader.java:144) at org.apache.axis2.deployment.ServiceDeployer.deploy(ServiceDeployer.java:81) at org.apache.axis2.deployment.repository.util.DeploymentFileData.deploy(DeploymentFileData.java:136) at org.apache.axis2.deployment.DeploymentEngine.doDeploy(DeploymentEngine.java:597) at org.apache.axis2.deployment.repository.util.WSInfoList.update(WSInfoList.java:144) at org.apache.axis2.deployment.RepositoryListener.update(RepositoryListener.java:330) at org.apache.axis2.deployment.RepositoryListener.checkServices(RepositoryListener.java:227) at org.apache.axis2.deployment.DeploymentEngine.loadServices(DeploymentEngine.java:131) at org.apache.axis2.deployment.WarBasedAxisConfigurator.loadServices(WarBasedAxisConfigurator.java:284) at org.apache.axis2.context.ConfigurationContextFactory.createConfigurationContext(ConfigurationContextFactory.java:82) at org.apache.axis2.transport.http.AxisServlet.initConfigContext(AxisServlet.java:511) at org.apache.axis2.transport.http.AxisServlet.init(AxisServlet.java:431) at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1161) at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:981) at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4058) at org.apache.catalina.core.StandardContext.start(StandardContext.java:4364) at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:525) at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:829) at org.apache.catalina.startup.HostConfig.deployWARs(HostConfig.java:718) at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:490) at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1147) at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311) at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117) at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053) at org.apache.catalina.core.StandardHost.start(StandardHost.java:719) at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045) at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443) at org.apache.catalina.core.StandardService.start(StandardService.java:516) at org.apache.catalina.core.StandardServer.start(StandardServer.java:710) at org.apache.catalina.startup.Catalina.start(Catalina.java:578) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
Thanks.
=>RY
RE: Newbie Basics: Policy Sample 01
Posted by Roxanne Yee <ry...@akimeka.com>.
Sorry, I'm having trouble executing policy/sample01 and receive the following error.
Has anyone else had this problem?
Error: java.lang.NoSuchMethodError: org.apache.ws.secpolicy.model.TransportBinding.(I)V at org.apache.ws.secpolicy11.builders.TransportBindingBuilder.build(TransportBindingBuilder.java:40) at org.apache.neethi.AssertionBuilderFactory.build(AssertionBuilderFactory.java:99) at org.apache.neethi.PolicyEngine.processOperationElement(PolicyEngine.java:225) at org.apache.neethi.PolicyEngine.getAllOperator(PolicyEngine.java:162) at org.apache.neethi.PolicyEngine.processOperationElement(PolicyEngine.java:216) at org.apache.neethi.PolicyEngine.getExactlyOneOperator(PolicyEngine.java:158) at org.apache.neethi.PolicyEngine.processOperationElement(PolicyEngine.java:211) at org.apache.neethi.PolicyEngine.getPolicyOperator(PolicyEngine.java:154) at org.apache.neethi.PolicyEngine.getPolicy(PolicyEngine.java:126) at org.apache.axis2.deployment.DescriptionBuilder.processPolicyElements(DescriptionBuilder.java:638) at org.apache.axis2.deployment.ServiceBuilder.populateService(ServiceBuilder.java:304) at org.apache.axis2.deployment.repository.util.ArchiveReader.buildServiceGroup(ArchiveReader.java:102) at org.apache.axis2.deployment.repository.util.ArchiveReader.processServiceGroup(ArchiveReader.java:144) at org.apache.axis2.deployment.ServiceDeployer.deploy(ServiceDeployer.java:81) at org.apache.axis2.deployment.repository.util.DeploymentFileData.deploy(DeploymentFileData.java:136) at org.apache.axis2.deployment.DeploymentEngine.doDeploy(DeploymentEngine.java:597) at org.apache.axis2.deployment.repository.util.WSInfoList.update(WSInfoList.java:144) at org.apache.axis2.deployment.RepositoryListener.update(RepositoryListener.java:330) at org.apache.axis2.deployment.RepositoryListener.checkServices(RepositoryListener.java:227) at org.apache.axis2.deployment.DeploymentEngine.loadServices(DeploymentEngine.java:131) at org.apache.axis2.deployment.WarBasedAxisConfigurator.loadServices(WarBasedAxisConfigurator.java:284) at org.apache.axis2.context.ConfigurationContextFactory.createConfigurationContext(ConfigurationContextFactory.java:82) at org.apache.axis2.transport.http.AxisServlet.initConfigContext(AxisServlet.java:511) at org.apache.axis2.transport.http.AxisServlet.init(AxisServlet.java:431) at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1161) at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:981) at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4058) at org.apache.catalina.core.StandardContext.start(StandardContext.java:4364) at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:525) at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:829) at org.apache.catalina.startup.HostConfig.deployWARs(HostConfig.java:718) at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:490) at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1147) at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311) at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117) at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053) at org.apache.catalina.core.StandardHost.start(StandardHost.java:719) at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045) at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443) at org.apache.catalina.core.StandardService.start(StandardService.java:516) at org.apache.catalina.core.StandardServer.start(StandardServer.java:710) at org.apache.catalina.startup.Catalina.start(Catalina.java:578) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
Thanks.
=>RY
Newbie Basics: Jar Files
Posted by Roxanne Yee <ry...@akimeka.com>.
What .jar files are needed to be added to the src library for Rampart 1.4?
Thanks.
=>RY
RE: Newbie Basics: passwordCallbackHandler
Posted by Roxanne Yee <ry...@akimeka.com>.
Another question: Is the passwordCallbackClass provided in the Rampart samples for the server or the client? If it is for both, the what would be the difference? I've read http://wso2.org/node/240/print/ and am still confused.
-----Original Message-----
From: Roxanne Yee [mailto:ryee@akimeka.com]
Sent: Mon 7/14/2008 8:55 AM
To: rampart-dev@ws.apache.org
Subject: Newbie Basics: passwordCallbackHandler
Does anyone know if there are any thorough tutorials on how to write a passwordCallbackHander explaining how the code works?
Thanks.
=>RY
Newbie Basics: passwordCallbackHandler
Posted by Roxanne Yee <ry...@akimeka.com>.
Does anyone know if there are any thorough tutorials on how to write a passwordCallbackHander explaining how the code works?
Thanks.
=>RY
RE: FW: Newbie Basics: Security Policy
Posted by Roxanne Yee <ry...@akimeka.com>.
Thanks nandana! I believed that fixed it XD! The world makes sense now!
=>RY
________________________________
From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
Sent: Tue 7/15/2008 5:07 PM
To: axis-user@ws.apache.org
Subject: Re: FW: Newbie Basics: Security Policy
Could it been that the wss4j jars are conflicting? Because the axis2 library contains both the 1.5.3 version and the 1.5.4 version?
Yes, you must only have the WSS4J jar relevant to Rampart version you are using. As I said earlier, if you have a fresh Axis2 distribution , what you need to to is , copy the dependencies jars in relevant the Rampart distribution to your Axis2 library.
CALLBACK HANDLER:
Password callback looks oky.
SERVICES.XML:
<ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy">
<!-- Does the following user have to be the same as the username
for the token? Is that alice in this case? -->
<ramp:user>username</ramp:user>
Nope, this used as the private key alias of the service when encryption or signatures are involved.
regards,
nandana
-----Original Message-----
From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
Sent: Tue 7/15/2008 4:39 PM
To: axis-user@ws.apache.org; rampart-dev@ws.apache.org
Subject: Re: FW: Newbie Basics: Security Policy
What is the version of the WSS4J jar you are using ? It seems you are using
a older on than 1.5.4. <http://1.5.4./> You can find all the dependencies needed for Rampart
1.4 in the Rampart 1.4 binary distribution under "/rampart-1.4/lib/" which
can downloaded form here [1]. Adding the wss4j 1.5.4 jar to your Axis2 lib
will solve this problem. You can also post your password callback handler
class for the server side and the services.xml, so we can verify whether
they are correct.
thanks,
nandana
[1] - http://ws.apache.org/rampart/download/1.4/download.cgi
Just to verify how this policy would work...
> So if I use this policy, I can just tell soapUI to add a User Name Token
> with username "alice" and password "bobPW", and I should receive an echo
> back (using the service in the samples) in the response? However, when I do
> this, for some reason I receive and error. The RAW messages are reprinted
> below:
>
>
> REQUEST:
> Host: 192.168.1.247:8080 <http://192.168.1.247:8080/>
> Content-Length: 803
> User-Agent: Jakarta Commons-HttpClient/3.0.1
> Content-Type: application/soap+xml;charset=UTF-8;action="urn:echo"
>
> <soap:Envelope xmlns:sam="
> http://sample01.policy.samples.rampart.apache.org <http://sample01.policy.samples.rampart.apache.org/> " xmlns:soap="
> http://www.w3.org/2003/05/soap-envelope">
> <soap:Header>
> <wsse:Security soap:mustUnderstand="true" xmlns:wsse="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
> ">
> <wsse:UsernameToken wsu:Id="UsernameToken-10518016" xmlns:wsu="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> ">
> <wsse:Username>alice</wsse:Username>
> <wsse:Password Type="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText
> ">bobPW</wsse:Password>
> </wsse:UsernameToken>
> </wsse:Security>
> </soap:Header>
> <soap:Body>
> <sam:echo>
> <!--Optional:-->
> <sam:param0>?</sam:param0>
> </sam:echo>
> </soap:Body>
> </soap:Envelope>
>
>
> RESPONSE:
> HTTP/1.1 500 Internal Server Error
> Date: Tue, 15 Jul 2008 18:05:24 GMT
> Transfer-Encoding: chunked
> Connection: close
> Content-Type: application/soap+xml; action="
> http://www.w3.org/2005/08/addressing/soap/fault";charset=UTF-8
> Server: Apache-Coyote/1.1
>
> <?xml version='1.0' encoding='UTF-8'?>
> <soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope
> ">
> <soapenv:Body>
> <soapenv:Fault>
> <soapenv:Code>
> <soapenv:Value>soapenv:Receiver</soapenv:Value>
> </soapenv:Code>
> <soapenv:Reason>
> <soapenv:Text xml:lang="en-US">java.lang.NoSuchMethodError:
> org.apache.ws.security.message.WSSecHeader.isEmpty(Lorg/w3c/dom/Document;)Z</soapenv:Text>
> </soapenv:Reason>
> <soapenv:Detail />
> </soapenv:Fault>
> </soapenv:Body>
> </soapenv:Envelope>
>
>
> Thanks.
>
> =>RY
>
> -----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Mon 7/14/2008 8:01 AM
> To: rampart-dev@ws.apache.org
> Subject: Re: Newbie Basics: Security Policy
>
> Hi Roxane,
>
> This is the policy to be used. Hope you know how to attach this policy to
> services.xml and to a client. Please go through the Rampart policy samples
> and you will be able to see how that is done. If you have further
> questions,
> please feel free to throw them in.
>
> regards,
> nandana
>
> <wsp:Policy wsu:Id="UT" xmlns:wsu="
>
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> "
> xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
> <wsp:ExactlyOne>
> <wsp:All>
> <sp:SupportingTokens xmlns:sp="
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
> <wsp:Policy>
> <sp:UsernameToken sp:IncludeToken="
>
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient
> "
> />
> </wsp:Policy>
> </sp:SupportingTokens>
>
> <ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy
> ">
>
> <ramp:user>username</ramp:user>
>
>
> <ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
> </ramp:RampartConfig>
>
> </wsp:All>
> </wsp:ExactlyOne>
> </wsp:Policy>
>
> On Mon, Jul 14, 2008 at 11:53 PM, Roxanne Yee <ry...@akimeka.com> wrote:
>
> > If I simply wanted to implement a web service that used a User Name Token
> > authentication system with a Username and Password in Plaintext (no SSL
> for
> > now, cause I'm a little sketchy on how to actually set that up), what
> would
> > I need to do if using the Policy handler configuration?
> >
> > Thanks.
> >
> > => RY
> >
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
> For additional commands, e-mail: axis-user-help@ws.apache.org
>
>
--
Nandana Mihindukulasooriya
WSO2 inc.
http://nandana83.blogspot.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org
--
Nandana Mihindukulasooriya
WSO2 inc.
http://nandana83.blogspot.com/
Re: FW: Newbie Basics: Security Policy
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
> Could it been that the wss4j jars are conflicting? Because the axis2
> library contains both the 1.5.3 version and the 1.5.4 version?
>
Yes, you must only have the WSS4J jar relevant to Rampart version you are
using. As I said earlier, if you have a fresh Axis2 distribution , what you
need to to is , copy the dependencies jars in relevant the Rampart
distribution to your Axis2 library.
> CALLBACK HANDLER:
>
Password callback looks oky.
SERVICES.XML:
>
> <ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy
> ">
>
> <!-- Does the following user have to be the same
> as the username
> for the token? Is that alice in this case? -->
> <ramp:user>username</ramp:user>
>
Nope, this used as the private key alias of the service when encryption or
signatures are involved.
regards,
nandana
> -----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Tue 7/15/2008 4:39 PM
> To: axis-user@ws.apache.org; rampart-dev@ws.apache.org
> Subject: Re: FW: Newbie Basics: Security Policy
>
> What is the version of the WSS4J jar you are using ? It seems you are using
> a older on than 1.5.4. You can find all the dependencies needed for
> Rampart
> 1.4 in the Rampart 1.4 binary distribution under "/rampart-1.4/lib/" which
> can downloaded form here [1]. Adding the wss4j 1.5.4 jar to your Axis2 lib
> will solve this problem. You can also post your password callback handler
> class for the server side and the services.xml, so we can verify whether
> they are correct.
>
> thanks,
> nandana
>
> [1] - http://ws.apache.org/rampart/download/1.4/download.cgi
>
> Just to verify how this policy would work...
> > So if I use this policy, I can just tell soapUI to add a User Name Token
> > with username "alice" and password "bobPW", and I should receive an echo
> > back (using the service in the samples) in the response? However, when I
> do
> > this, for some reason I receive and error. The RAW messages are reprinted
> > below:
> >
> >
> > REQUEST:
> > Host: 192.168.1.247:8080
> > Content-Length: 803
> > User-Agent: Jakarta Commons-HttpClient/3.0.1
> > Content-Type: application/soap+xml;charset=UTF-8;action="urn:echo"
> >
> > <soap:Envelope xmlns:sam="
> > http://sample01.policy.samples.rampart.apache.org" xmlns:soap="
> > http://www.w3.org/2003/05/soap-envelope">
> > <soap:Header>
> > <wsse:Security soap:mustUnderstand="true" xmlns:wsse="
> >
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
> > ">
> > <wsse:UsernameToken wsu:Id="UsernameToken-10518016" xmlns:wsu="
> >
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> > ">
> > <wsse:Username>alice</wsse:Username>
> > <wsse:Password Type="
> >
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText
> > ">bobPW</wsse:Password>
> > </wsse:UsernameToken>
> > </wsse:Security>
> > </soap:Header>
> > <soap:Body>
> > <sam:echo>
> > <!--Optional:-->
> > <sam:param0>?</sam:param0>
> > </sam:echo>
> > </soap:Body>
> > </soap:Envelope>
> >
> >
> > RESPONSE:
> > HTTP/1.1 500 Internal Server Error
> > Date: Tue, 15 Jul 2008 18:05:24 GMT
> > Transfer-Encoding: chunked
> > Connection: close
> > Content-Type: application/soap+xml; action="
> > http://www.w3.org/2005/08/addressing/soap/fault";charset=UTF-8
> > Server: Apache-Coyote/1.1
> >
> > <?xml version='1.0' encoding='UTF-8'?>
> > <soapenv:Envelope xmlns:soapenv="
> http://www.w3.org/2003/05/soap-envelope
> > ">
> > <soapenv:Body>
> > <soapenv:Fault>
> > <soapenv:Code>
> > <soapenv:Value>soapenv:Receiver</soapenv:Value>
> > </soapenv:Code>
> > <soapenv:Reason>
> > <soapenv:Text xml:lang="en-US">java.lang.NoSuchMethodError:
> >
> org.apache.ws.security.message.WSSecHeader.isEmpty(Lorg/w3c/dom/Document;)Z</soapenv:Text>
> > </soapenv:Reason>
> > <soapenv:Detail />
> > </soapenv:Fault>
> > </soapenv:Body>
> > </soapenv:Envelope>
> >
> >
> > Thanks.
> >
> > =>RY
> >
> > -----Original Message-----
> > From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> > Sent: Mon 7/14/2008 8:01 AM
> > To: rampart-dev@ws.apache.org
> > Subject: Re: Newbie Basics: Security Policy
> >
> > Hi Roxane,
> >
> > This is the policy to be used. Hope you know how to attach this policy to
> > services.xml and to a client. Please go through the Rampart policy
> samples
> > and you will be able to see how that is done. If you have further
> > questions,
> > please feel free to throw them in.
> >
> > regards,
> > nandana
> >
> > <wsp:Policy wsu:Id="UT" xmlns:wsu="
> >
> >
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> > "
> > xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
> > <wsp:ExactlyOne>
> > <wsp:All>
> > <sp:SupportingTokens xmlns:sp="
> > http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
> > <wsp:Policy>
> > <sp:UsernameToken sp:IncludeToken="
> >
> >
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient
> > "
> > />
> > </wsp:Policy>
> > </sp:SupportingTokens>
> >
> > <ramp:RampartConfig xmlns:ramp="
> http://ws.apache.org/rampart/policy
> > ">
> >
> > <ramp:user>username</ramp:user>
> >
> >
> >
> <ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
> > </ramp:RampartConfig>
> >
> > </wsp:All>
> > </wsp:ExactlyOne>
> > </wsp:Policy>
> >
> > On Mon, Jul 14, 2008 at 11:53 PM, Roxanne Yee <ry...@akimeka.com> wrote:
> >
> > > If I simply wanted to implement a web service that used a User Name
> Token
> > > authentication system with a Username and Password in Plaintext (no SSL
> > for
> > > now, cause I'm a little sketchy on how to actually set that up), what
> > would
> > > I need to do if using the Policy handler configuration?
> > >
> > > Thanks.
> > >
> > > => RY
> > >
> >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
> > For additional commands, e-mail: axis-user-help@ws.apache.org
> >
> >
>
>
> --
> Nandana Mihindukulasooriya
> WSO2 inc.
>
> http://nandana83.blogspot.com/
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
> For additional commands, e-mail: axis-user-help@ws.apache.org
>
--
Nandana Mihindukulasooriya
WSO2 inc.
http://nandana83.blogspot.com/
Re: Newbie Basics: Security Policy
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
> A quick question: What is the policy.xml file for if you already have the
> policy within the services.xml file?
>
In the examples, clients loads policies from those policy.xml files. If you
go through the source code of the clients you will be able to notice this.
thanks,
nandana
-----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Mon 7/14/2008 8:22 AM
> To: rampart-dev@ws.apache.org
> Subject: Re: Newbie Basics: Security Policy
>
> >
> > Also, in addition to my last question, for clarity, is the Security
> Policy
> > really just understanding and using the syntax from the OASIS WS-Security
> > Policy documentation and only the
> > <ramp:RampartConfig>...</ramp:RampartConfig> parts actually what is used
> to
> > incorporate Rampart?
> >
>
> Yes, exactly.
>
> -----Original Message-----
> > From: Roxanne Yee [mailto:ryee@akimeka.com]
> > Sent: Mon 7/14/2008 8:17 AM
> > To: rampart-dev@ws.apache.org
> > Subject: RE: Newbie Basics: Security Policy
> >
> > Actually, I'm using soapUI as the client, so it is possible to ignore all
> > files with the word "client" in them?
> >
> >
> > -----Original Message-----
> > From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> > Sent: Mon 7/14/2008 8:01 AM
> > To: rampart-dev@ws.apache.org
> > Subject: Re: Newbie Basics: Security Policy
> >
> > Hi Roxane,
> >
> > This is the policy to be used. Hope you know how to attach this policy to
> > services.xml and to a client. Please go through the Rampart policy
> samples
> > and you will be able to see how that is done. If you have further
> > questions,
> > please feel free to throw them in.
> >
> > regards,
> > nandana
> >
> > <wsp:Policy wsu:Id="UT" xmlns:wsu="
> >
> >
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> > "
> > xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
> > <wsp:ExactlyOne>
> > <wsp:All>
> > <sp:SupportingTokens xmlns:sp="
> > http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
> > <wsp:Policy>
> > <sp:UsernameToken sp:IncludeToken="
> >
> >
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient
> > "
> > />
> > </wsp:Policy>
> > </sp:SupportingTokens>
> >
> > <ramp:RampartConfig xmlns:ramp="
> http://ws.apache.org/rampart/policy
> > ">
> >
> > <ramp:user>username</ramp:user>
> >
> >
> >
> <ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
> > </ramp:RampartConfig>
> >
> > </wsp:All>
> > </wsp:ExactlyOne>
> > </wsp:Policy>
> >
> > On Mon, Jul 14, 2008 at 11:53 PM, Roxanne Yee <ry...@akimeka.com> wrote:
> >
> > > If I simply wanted to implement a web service that used a User Name
> Token
> > > authentication system with a Username and Password in Plaintext (no SSL
> > for
> > > now, cause I'm a little sketchy on how to actually set that up), what
> > would
> > > I need to do if using the Policy handler configuration?
> > >
> > > Thanks.
> > >
> > > => RY
> > >
> >
> >
> >
>
>
RE: Newbie Basics: Security Policy
Posted by Roxanne Yee <ry...@akimeka.com>.
A quick question: What is the policy.xml file for if you already have the policy within the services.xml file?
Thanks.
=>RY
-----Original Message-----
From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
Sent: Mon 7/14/2008 8:22 AM
To: rampart-dev@ws.apache.org
Subject: Re: Newbie Basics: Security Policy
>
> Also, in addition to my last question, for clarity, is the Security Policy
> really just understanding and using the syntax from the OASIS WS-Security
> Policy documentation and only the
> <ramp:RampartConfig>...</ramp:RampartConfig> parts actually what is used to
> incorporate Rampart?
>
Yes, exactly.
-----Original Message-----
> From: Roxanne Yee [mailto:ryee@akimeka.com]
> Sent: Mon 7/14/2008 8:17 AM
> To: rampart-dev@ws.apache.org
> Subject: RE: Newbie Basics: Security Policy
>
> Actually, I'm using soapUI as the client, so it is possible to ignore all
> files with the word "client" in them?
>
>
> -----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Mon 7/14/2008 8:01 AM
> To: rampart-dev@ws.apache.org
> Subject: Re: Newbie Basics: Security Policy
>
> Hi Roxane,
>
> This is the policy to be used. Hope you know how to attach this policy to
> services.xml and to a client. Please go through the Rampart policy samples
> and you will be able to see how that is done. If you have further
> questions,
> please feel free to throw them in.
>
> regards,
> nandana
>
> <wsp:Policy wsu:Id="UT" xmlns:wsu="
>
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> "
> xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
> <wsp:ExactlyOne>
> <wsp:All>
> <sp:SupportingTokens xmlns:sp="
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
> <wsp:Policy>
> <sp:UsernameToken sp:IncludeToken="
>
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient
> "
> />
> </wsp:Policy>
> </sp:SupportingTokens>
>
> <ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy
> ">
>
> <ramp:user>username</ramp:user>
>
>
> <ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
> </ramp:RampartConfig>
>
> </wsp:All>
> </wsp:ExactlyOne>
> </wsp:Policy>
>
> On Mon, Jul 14, 2008 at 11:53 PM, Roxanne Yee <ry...@akimeka.com> wrote:
>
> > If I simply wanted to implement a web service that used a User Name Token
> > authentication system with a Username and Password in Plaintext (no SSL
> for
> > now, cause I'm a little sketchy on how to actually set that up), what
> would
> > I need to do if using the Policy handler configuration?
> >
> > Thanks.
> >
> > => RY
> >
>
>
>
Re: Newbie Basics: Security Policy
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
>
> Also, in addition to my last question, for clarity, is the Security Policy
> really just understanding and using the syntax from the OASIS WS-Security
> Policy documentation and only the
> <ramp:RampartConfig>...</ramp:RampartConfig> parts actually what is used to
> incorporate Rampart?
>
Yes, exactly.
-----Original Message-----
> From: Roxanne Yee [mailto:ryee@akimeka.com]
> Sent: Mon 7/14/2008 8:17 AM
> To: rampart-dev@ws.apache.org
> Subject: RE: Newbie Basics: Security Policy
>
> Actually, I'm using soapUI as the client, so it is possible to ignore all
> files with the word "client" in them?
>
>
> -----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Mon 7/14/2008 8:01 AM
> To: rampart-dev@ws.apache.org
> Subject: Re: Newbie Basics: Security Policy
>
> Hi Roxane,
>
> This is the policy to be used. Hope you know how to attach this policy to
> services.xml and to a client. Please go through the Rampart policy samples
> and you will be able to see how that is done. If you have further
> questions,
> please feel free to throw them in.
>
> regards,
> nandana
>
> <wsp:Policy wsu:Id="UT" xmlns:wsu="
>
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> "
> xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
> <wsp:ExactlyOne>
> <wsp:All>
> <sp:SupportingTokens xmlns:sp="
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
> <wsp:Policy>
> <sp:UsernameToken sp:IncludeToken="
>
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient
> "
> />
> </wsp:Policy>
> </sp:SupportingTokens>
>
> <ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy
> ">
>
> <ramp:user>username</ramp:user>
>
>
> <ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
> </ramp:RampartConfig>
>
> </wsp:All>
> </wsp:ExactlyOne>
> </wsp:Policy>
>
> On Mon, Jul 14, 2008 at 11:53 PM, Roxanne Yee <ry...@akimeka.com> wrote:
>
> > If I simply wanted to implement a web service that used a User Name Token
> > authentication system with a Username and Password in Plaintext (no SSL
> for
> > now, cause I'm a little sketchy on how to actually set that up), what
> would
> > I need to do if using the Policy handler configuration?
> >
> > Thanks.
> >
> > => RY
> >
>
>
>
Re: Newbie Basics: Security Policy
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
> Actually, I'm using soapUI as the client, so it is possible to ignore all
> files with the word "client" in them?
>
Then you just need to add this policy to the services.xml and engage
Rampart. Remember you need to have the password callback handler in the
service's archive.
thanks,
nandana
-----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Mon 7/14/2008 8:01 AM
> To: rampart-dev@ws.apache.org
> Subject: Re: Newbie Basics: Security Policy
>
> Hi Roxane,
>
> This is the policy to be used. Hope you know how to attach this policy to
> services.xml and to a client. Please go through the Rampart policy samples
> and you will be able to see how that is done. If you have further
> questions,
> please feel free to throw them in.
>
> regards,
> nandana
>
> <wsp:Policy wsu:Id="UT" xmlns:wsu="
>
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> "
> xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
> <wsp:ExactlyOne>
> <wsp:All>
> <sp:SupportingTokens xmlns:sp="
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
> <wsp:Policy>
> <sp:UsernameToken sp:IncludeToken="
>
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient
> "
> />
> </wsp:Policy>
> </sp:SupportingTokens>
>
> <ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy
> ">
>
> <ramp:user>username</ramp:user>
>
>
> <ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
> </ramp:RampartConfig>
>
> </wsp:All>
> </wsp:ExactlyOne>
> </wsp:Policy>
>
> On Mon, Jul 14, 2008 at 11:53 PM, Roxanne Yee <ry...@akimeka.com> wrote:
>
> > If I simply wanted to implement a web service that used a User Name Token
> > authentication system with a Username and Password in Plaintext (no SSL
> for
> > now, cause I'm a little sketchy on how to actually set that up), what
> would
> > I need to do if using the Policy handler configuration?
> >
> > Thanks.
> >
> > => RY
> >
>
>
RE: Newbie Basics: Security Policy
Posted by Roxanne Yee <ry...@akimeka.com>.
Also, in addition to my last question, for clarity, is the Security Policy really just understanding and using the syntax from the OASIS WS-Security Policy documentation and only the <ramp:RampartConfig>...</ramp:RampartConfig> parts actually what is used to incorporate Rampart?
Thanks.
=>RY
-----Original Message-----
From: Roxanne Yee [mailto:ryee@akimeka.com]
Sent: Mon 7/14/2008 8:17 AM
To: rampart-dev@ws.apache.org
Subject: RE: Newbie Basics: Security Policy
Actually, I'm using soapUI as the client, so it is possible to ignore all files with the word "client" in them?
-----Original Message-----
From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
Sent: Mon 7/14/2008 8:01 AM
To: rampart-dev@ws.apache.org
Subject: Re: Newbie Basics: Security Policy
Hi Roxane,
This is the policy to be used. Hope you know how to attach this policy to
services.xml and to a client. Please go through the Rampart policy samples
and you will be able to see how that is done. If you have further questions,
please feel free to throw them in.
regards,
nandana
<wsp:Policy wsu:Id="UT" xmlns:wsu="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
<wsp:ExactlyOne>
<wsp:All>
<sp:SupportingTokens xmlns:sp="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:UsernameToken sp:IncludeToken="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient"
/>
</wsp:Policy>
</sp:SupportingTokens>
<ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy">
<ramp:user>username</ramp:user>
<ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
</ramp:RampartConfig>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
On Mon, Jul 14, 2008 at 11:53 PM, Roxanne Yee <ry...@akimeka.com> wrote:
> If I simply wanted to implement a web service that used a User Name Token
> authentication system with a Username and Password in Plaintext (no SSL for
> now, cause I'm a little sketchy on how to actually set that up), what would
> I need to do if using the Policy handler configuration?
>
> Thanks.
>
> => RY
>
RE: Newbie Basics: Security Policy
Posted by Roxanne Yee <ry...@akimeka.com>.
Actually, I'm using soapUI as the client, so it is possible to ignore all files with the word "client" in them?
-----Original Message-----
From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
Sent: Mon 7/14/2008 8:01 AM
To: rampart-dev@ws.apache.org
Subject: Re: Newbie Basics: Security Policy
Hi Roxane,
This is the policy to be used. Hope you know how to attach this policy to
services.xml and to a client. Please go through the Rampart policy samples
and you will be able to see how that is done. If you have further questions,
please feel free to throw them in.
regards,
nandana
<wsp:Policy wsu:Id="UT" xmlns:wsu="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
<wsp:ExactlyOne>
<wsp:All>
<sp:SupportingTokens xmlns:sp="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:UsernameToken sp:IncludeToken="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient"
/>
</wsp:Policy>
</sp:SupportingTokens>
<ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy">
<ramp:user>username</ramp:user>
<ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
</ramp:RampartConfig>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
On Mon, Jul 14, 2008 at 11:53 PM, Roxanne Yee <ry...@akimeka.com> wrote:
> If I simply wanted to implement a web service that used a User Name Token
> authentication system with a Username and Password in Plaintext (no SSL for
> now, cause I'm a little sketchy on how to actually set that up), what would
> I need to do if using the Policy handler configuration?
>
> Thanks.
>
> => RY
>
RE: FW: Newbie Basics: Security Policy
Posted by Roxanne Yee <ry...@akimeka.com>.
Could it been that the wss4j jars are conflicting? Because the axis2 library contains both the 1.5.3 version and the 1.5.4 version?
However, I'll post my callback handler and services.xml as well.
CALLBACK HANDLER:
package org.apache.rampart.samples.policy.sample01;
import org.apache.ws.security.WSPasswordCallback;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
import java.io.IOException;
public class PWCBHandler implements CallbackHandler {
public void handle(Callback[] callbacks) throws IOException,
UnsupportedCallbackException {
for (int i = 0; i < callbacks.length; i++) {
//When the server side need to authenticate the user
WSPasswordCallback pwcb = (WSPasswordCallback)callbacks[i];
if (pwcb.getUsage() == WSPasswordCallback.USERNAME_TOKEN_UNKNOWN) {
if(pwcb.getIdentifer().equals("alice") && pwcb.getPassword().equals("bobPW")) {
return;
} else {
throw new UnsupportedCallbackException(callbacks[i], "check failed");
}
}
//When the client requests for the password to be added in to the
//UT element
pwcb.setPassword("bobPW");
}
}
}
Thank you!
=>RY
SERVICES.XML:
<?xml version="1.0" encoding="UTF-8"?>
<service>
<operation name="echo">
<messageReceiver class="org.apache.axis2.rpc.receivers.RPCMessageReceiver"/>
</operation>
<parameter name="ServiceClass" locked="false">org.apache.rampart.samples.policy.sample01.SimpleService</parameter>
<module ref="rampart" />
<module ref="addressing" />
<wsp:Policy wsu:Id="UT" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
<wsp:ExactlyOne>
<wsp:All>
<sp:SupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:UsernameToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient"/>
</wsp:Policy>
</sp:SupportingTokens>
<ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy">
<!-- Does the following user have to be the same as the username
for the token? Is that alice in this case? -->
<ramp:user>username</ramp:user>
<ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
</ramp:RampartConfig>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
</service>
-----Original Message-----
From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
Sent: Tue 7/15/2008 4:39 PM
To: axis-user@ws.apache.org; rampart-dev@ws.apache.org
Subject: Re: FW: Newbie Basics: Security Policy
What is the version of the WSS4J jar you are using ? It seems you are using
a older on than 1.5.4. You can find all the dependencies needed for Rampart
1.4 in the Rampart 1.4 binary distribution under "/rampart-1.4/lib/" which
can downloaded form here [1]. Adding the wss4j 1.5.4 jar to your Axis2 lib
will solve this problem. You can also post your password callback handler
class for the server side and the services.xml, so we can verify whether
they are correct.
thanks,
nandana
[1] - http://ws.apache.org/rampart/download/1.4/download.cgi
Just to verify how this policy would work...
> So if I use this policy, I can just tell soapUI to add a User Name Token
> with username "alice" and password "bobPW", and I should receive an echo
> back (using the service in the samples) in the response? However, when I do
> this, for some reason I receive and error. The RAW messages are reprinted
> below:
>
>
> REQUEST:
> Host: 192.168.1.247:8080
> Content-Length: 803
> User-Agent: Jakarta Commons-HttpClient/3.0.1
> Content-Type: application/soap+xml;charset=UTF-8;action="urn:echo"
>
> <soap:Envelope xmlns:sam="
> http://sample01.policy.samples.rampart.apache.org" xmlns:soap="
> http://www.w3.org/2003/05/soap-envelope">
> <soap:Header>
> <wsse:Security soap:mustUnderstand="true" xmlns:wsse="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
> ">
> <wsse:UsernameToken wsu:Id="UsernameToken-10518016" xmlns:wsu="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> ">
> <wsse:Username>alice</wsse:Username>
> <wsse:Password Type="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText
> ">bobPW</wsse:Password>
> </wsse:UsernameToken>
> </wsse:Security>
> </soap:Header>
> <soap:Body>
> <sam:echo>
> <!--Optional:-->
> <sam:param0>?</sam:param0>
> </sam:echo>
> </soap:Body>
> </soap:Envelope>
>
>
> RESPONSE:
> HTTP/1.1 500 Internal Server Error
> Date: Tue, 15 Jul 2008 18:05:24 GMT
> Transfer-Encoding: chunked
> Connection: close
> Content-Type: application/soap+xml; action="
> http://www.w3.org/2005/08/addressing/soap/fault";charset=UTF-8
> Server: Apache-Coyote/1.1
>
> <?xml version='1.0' encoding='UTF-8'?>
> <soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope
> ">
> <soapenv:Body>
> <soapenv:Fault>
> <soapenv:Code>
> <soapenv:Value>soapenv:Receiver</soapenv:Value>
> </soapenv:Code>
> <soapenv:Reason>
> <soapenv:Text xml:lang="en-US">java.lang.NoSuchMethodError:
> org.apache.ws.security.message.WSSecHeader.isEmpty(Lorg/w3c/dom/Document;)Z</soapenv:Text>
> </soapenv:Reason>
> <soapenv:Detail />
> </soapenv:Fault>
> </soapenv:Body>
> </soapenv:Envelope>
>
>
> Thanks.
>
> =>RY
>
> -----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Mon 7/14/2008 8:01 AM
> To: rampart-dev@ws.apache.org
> Subject: Re: Newbie Basics: Security Policy
>
> Hi Roxane,
>
> This is the policy to be used. Hope you know how to attach this policy to
> services.xml and to a client. Please go through the Rampart policy samples
> and you will be able to see how that is done. If you have further
> questions,
> please feel free to throw them in.
>
> regards,
> nandana
>
> <wsp:Policy wsu:Id="UT" xmlns:wsu="
>
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> "
> xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
> <wsp:ExactlyOne>
> <wsp:All>
> <sp:SupportingTokens xmlns:sp="
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
> <wsp:Policy>
> <sp:UsernameToken sp:IncludeToken="
>
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient
> "
> />
> </wsp:Policy>
> </sp:SupportingTokens>
>
> <ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy
> ">
>
> <ramp:user>username</ramp:user>
>
>
> <ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
> </ramp:RampartConfig>
>
> </wsp:All>
> </wsp:ExactlyOne>
> </wsp:Policy>
>
> On Mon, Jul 14, 2008 at 11:53 PM, Roxanne Yee <ry...@akimeka.com> wrote:
>
> > If I simply wanted to implement a web service that used a User Name Token
> > authentication system with a Username and Password in Plaintext (no SSL
> for
> > now, cause I'm a little sketchy on how to actually set that up), what
> would
> > I need to do if using the Policy handler configuration?
> >
> > Thanks.
> >
> > => RY
> >
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
> For additional commands, e-mail: axis-user-help@ws.apache.org
>
>
--
Nandana Mihindukulasooriya
WSO2 inc.
http://nandana83.blogspot.com/
Re: FW: Newbie Basics: Security Policy
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
What is the version of the WSS4J jar you are using ? It seems you are using
a older on than 1.5.4. You can find all the dependencies needed for Rampart
1.4 in the Rampart 1.4 binary distribution under "/rampart-1.4/lib/" which
can downloaded form here [1]. Adding the wss4j 1.5.4 jar to your Axis2 lib
will solve this problem. You can also post your password callback handler
class for the server side and the services.xml, so we can verify whether
they are correct.
thanks,
nandana
[1] - http://ws.apache.org/rampart/download/1.4/download.cgi
Just to verify how this policy would work...
> So if I use this policy, I can just tell soapUI to add a User Name Token
> with username "alice" and password "bobPW", and I should receive an echo
> back (using the service in the samples) in the response? However, when I do
> this, for some reason I receive and error. The RAW messages are reprinted
> below:
>
>
> REQUEST:
> Host: 192.168.1.247:8080
> Content-Length: 803
> User-Agent: Jakarta Commons-HttpClient/3.0.1
> Content-Type: application/soap+xml;charset=UTF-8;action="urn:echo"
>
> <soap:Envelope xmlns:sam="
> http://sample01.policy.samples.rampart.apache.org" xmlns:soap="
> http://www.w3.org/2003/05/soap-envelope">
> <soap:Header>
> <wsse:Security soap:mustUnderstand="true" xmlns:wsse="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
> ">
> <wsse:UsernameToken wsu:Id="UsernameToken-10518016" xmlns:wsu="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> ">
> <wsse:Username>alice</wsse:Username>
> <wsse:Password Type="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText
> ">bobPW</wsse:Password>
> </wsse:UsernameToken>
> </wsse:Security>
> </soap:Header>
> <soap:Body>
> <sam:echo>
> <!--Optional:-->
> <sam:param0>?</sam:param0>
> </sam:echo>
> </soap:Body>
> </soap:Envelope>
>
>
> RESPONSE:
> HTTP/1.1 500 Internal Server Error
> Date: Tue, 15 Jul 2008 18:05:24 GMT
> Transfer-Encoding: chunked
> Connection: close
> Content-Type: application/soap+xml; action="
> http://www.w3.org/2005/08/addressing/soap/fault";charset=UTF-8
> Server: Apache-Coyote/1.1
>
> <?xml version='1.0' encoding='UTF-8'?>
> <soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope
> ">
> <soapenv:Body>
> <soapenv:Fault>
> <soapenv:Code>
> <soapenv:Value>soapenv:Receiver</soapenv:Value>
> </soapenv:Code>
> <soapenv:Reason>
> <soapenv:Text xml:lang="en-US">java.lang.NoSuchMethodError:
> org.apache.ws.security.message.WSSecHeader.isEmpty(Lorg/w3c/dom/Document;)Z</soapenv:Text>
> </soapenv:Reason>
> <soapenv:Detail />
> </soapenv:Fault>
> </soapenv:Body>
> </soapenv:Envelope>
>
>
> Thanks.
>
> =>RY
>
> -----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Mon 7/14/2008 8:01 AM
> To: rampart-dev@ws.apache.org
> Subject: Re: Newbie Basics: Security Policy
>
> Hi Roxane,
>
> This is the policy to be used. Hope you know how to attach this policy to
> services.xml and to a client. Please go through the Rampart policy samples
> and you will be able to see how that is done. If you have further
> questions,
> please feel free to throw them in.
>
> regards,
> nandana
>
> <wsp:Policy wsu:Id="UT" xmlns:wsu="
>
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> "
> xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
> <wsp:ExactlyOne>
> <wsp:All>
> <sp:SupportingTokens xmlns:sp="
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
> <wsp:Policy>
> <sp:UsernameToken sp:IncludeToken="
>
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient
> "
> />
> </wsp:Policy>
> </sp:SupportingTokens>
>
> <ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy
> ">
>
> <ramp:user>username</ramp:user>
>
>
> <ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
> </ramp:RampartConfig>
>
> </wsp:All>
> </wsp:ExactlyOne>
> </wsp:Policy>
>
> On Mon, Jul 14, 2008 at 11:53 PM, Roxanne Yee <ry...@akimeka.com> wrote:
>
> > If I simply wanted to implement a web service that used a User Name Token
> > authentication system with a Username and Password in Plaintext (no SSL
> for
> > now, cause I'm a little sketchy on how to actually set that up), what
> would
> > I need to do if using the Policy handler configuration?
> >
> > Thanks.
> >
> > => RY
> >
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
> For additional commands, e-mail: axis-user-help@ws.apache.org
>
>
--
Nandana Mihindukulasooriya
WSO2 inc.
http://nandana83.blogspot.com/
Re: FW: Newbie Basics: Security Policy
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
What is the version of the WSS4J jar you are using ? It seems you are using
a older on than 1.5.4. You can find all the dependencies needed for Rampart
1.4 in the Rampart 1.4 binary distribution under "/rampart-1.4/lib/" which
can downloaded form here [1]. Adding the wss4j 1.5.4 jar to your Axis2 lib
will solve this problem. You can also post your password callback handler
class for the server side and the services.xml, so we can verify whether
they are correct.
thanks,
nandana
[1] - http://ws.apache.org/rampart/download/1.4/download.cgi
Just to verify how this policy would work...
> So if I use this policy, I can just tell soapUI to add a User Name Token
> with username "alice" and password "bobPW", and I should receive an echo
> back (using the service in the samples) in the response? However, when I do
> this, for some reason I receive and error. The RAW messages are reprinted
> below:
>
>
> REQUEST:
> Host: 192.168.1.247:8080
> Content-Length: 803
> User-Agent: Jakarta Commons-HttpClient/3.0.1
> Content-Type: application/soap+xml;charset=UTF-8;action="urn:echo"
>
> <soap:Envelope xmlns:sam="
> http://sample01.policy.samples.rampart.apache.org" xmlns:soap="
> http://www.w3.org/2003/05/soap-envelope">
> <soap:Header>
> <wsse:Security soap:mustUnderstand="true" xmlns:wsse="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
> ">
> <wsse:UsernameToken wsu:Id="UsernameToken-10518016" xmlns:wsu="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> ">
> <wsse:Username>alice</wsse:Username>
> <wsse:Password Type="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText
> ">bobPW</wsse:Password>
> </wsse:UsernameToken>
> </wsse:Security>
> </soap:Header>
> <soap:Body>
> <sam:echo>
> <!--Optional:-->
> <sam:param0>?</sam:param0>
> </sam:echo>
> </soap:Body>
> </soap:Envelope>
>
>
> RESPONSE:
> HTTP/1.1 500 Internal Server Error
> Date: Tue, 15 Jul 2008 18:05:24 GMT
> Transfer-Encoding: chunked
> Connection: close
> Content-Type: application/soap+xml; action="
> http://www.w3.org/2005/08/addressing/soap/fault";charset=UTF-8
> Server: Apache-Coyote/1.1
>
> <?xml version='1.0' encoding='UTF-8'?>
> <soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope
> ">
> <soapenv:Body>
> <soapenv:Fault>
> <soapenv:Code>
> <soapenv:Value>soapenv:Receiver</soapenv:Value>
> </soapenv:Code>
> <soapenv:Reason>
> <soapenv:Text xml:lang="en-US">java.lang.NoSuchMethodError:
> org.apache.ws.security.message.WSSecHeader.isEmpty(Lorg/w3c/dom/Document;)Z</soapenv:Text>
> </soapenv:Reason>
> <soapenv:Detail />
> </soapenv:Fault>
> </soapenv:Body>
> </soapenv:Envelope>
>
>
> Thanks.
>
> =>RY
>
> -----Original Message-----
> From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
> Sent: Mon 7/14/2008 8:01 AM
> To: rampart-dev@ws.apache.org
> Subject: Re: Newbie Basics: Security Policy
>
> Hi Roxane,
>
> This is the policy to be used. Hope you know how to attach this policy to
> services.xml and to a client. Please go through the Rampart policy samples
> and you will be able to see how that is done. If you have further
> questions,
> please feel free to throw them in.
>
> regards,
> nandana
>
> <wsp:Policy wsu:Id="UT" xmlns:wsu="
>
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> "
> xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
> <wsp:ExactlyOne>
> <wsp:All>
> <sp:SupportingTokens xmlns:sp="
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
> <wsp:Policy>
> <sp:UsernameToken sp:IncludeToken="
>
> http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient
> "
> />
> </wsp:Policy>
> </sp:SupportingTokens>
>
> <ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy
> ">
>
> <ramp:user>username</ramp:user>
>
>
> <ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
> </ramp:RampartConfig>
>
> </wsp:All>
> </wsp:ExactlyOne>
> </wsp:Policy>
>
> On Mon, Jul 14, 2008 at 11:53 PM, Roxanne Yee <ry...@akimeka.com> wrote:
>
> > If I simply wanted to implement a web service that used a User Name Token
> > authentication system with a Username and Password in Plaintext (no SSL
> for
> > now, cause I'm a little sketchy on how to actually set that up), what
> would
> > I need to do if using the Policy handler configuration?
> >
> > Thanks.
> >
> > => RY
> >
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
> For additional commands, e-mail: axis-user-help@ws.apache.org
>
>
--
Nandana Mihindukulasooriya
WSO2 inc.
http://nandana83.blogspot.com/
FW: Newbie Basics: Security Policy
Posted by Roxanne Yee <ry...@akimeka.com>.
-----Original Message-----
From: Roxanne Yee [mailto:ryee@akimeka.com]
Sent: Tue 7/15/2008 8:11 AM
To: rampart-dev@ws.apache.org
Subject: RE: Newbie Basics: Security Policy
Just to verify how this policy would work...
So if I use this policy, I can just tell soapUI to add a User Name Token with username "alice" and password "bobPW", and I should receive an echo back (using the service in the samples) in the response? However, when I do this, for some reason I receive and error. The RAW messages are reprinted below:
REQUEST:
Host: 192.168.1.247:8080
Content-Length: 803
User-Agent: Jakarta Commons-HttpClient/3.0.1
Content-Type: application/soap+xml;charset=UTF-8;action="urn:echo"
<soap:Envelope xmlns:sam="http://sample01.policy.samples.rampart.apache.org" xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
<soap:Header>
<wsse:Security soap:mustUnderstand="true" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken wsu:Id="UsernameToken-10518016" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:Username>alice</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">bobPW</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</soap:Header>
<soap:Body>
<sam:echo>
<!--Optional:-->
<sam:param0>?</sam:param0>
</sam:echo>
</soap:Body>
</soap:Envelope>
RESPONSE:
HTTP/1.1 500 Internal Server Error
Date: Tue, 15 Jul 2008 18:05:24 GMT
Transfer-Encoding: chunked
Connection: close
Content-Type: application/soap+xml; action="http://www.w3.org/2005/08/addressing/soap/fault";charset=UTF-8
Server: Apache-Coyote/1.1
<?xml version='1.0' encoding='UTF-8'?>
<soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope">
<soapenv:Body>
<soapenv:Fault>
<soapenv:Code>
<soapenv:Value>soapenv:Receiver</soapenv:Value>
</soapenv:Code>
<soapenv:Reason>
<soapenv:Text xml:lang="en-US">java.lang.NoSuchMethodError: org.apache.ws.security.message.WSSecHeader.isEmpty(Lorg/w3c/dom/Document;)Z</soapenv:Text>
</soapenv:Reason>
<soapenv:Detail />
</soapenv:Fault>
</soapenv:Body>
</soapenv:Envelope>
Thanks.
=>RY
-----Original Message-----
From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
Sent: Mon 7/14/2008 8:01 AM
To: rampart-dev@ws.apache.org
Subject: Re: Newbie Basics: Security Policy
Hi Roxane,
This is the policy to be used. Hope you know how to attach this policy to
services.xml and to a client. Please go through the Rampart policy samples
and you will be able to see how that is done. If you have further questions,
please feel free to throw them in.
regards,
nandana
<wsp:Policy wsu:Id="UT" xmlns:wsu="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
<wsp:ExactlyOne>
<wsp:All>
<sp:SupportingTokens xmlns:sp="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:UsernameToken sp:IncludeToken="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient"
/>
</wsp:Policy>
</sp:SupportingTokens>
<ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy">
<ramp:user>username</ramp:user>
<ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
</ramp:RampartConfig>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
On Mon, Jul 14, 2008 at 11:53 PM, Roxanne Yee <ry...@akimeka.com> wrote:
> If I simply wanted to implement a web service that used a User Name Token
> authentication system with a Username and Password in Plaintext (no SSL for
> now, cause I'm a little sketchy on how to actually set that up), what would
> I need to do if using the Policy handler configuration?
>
> Thanks.
>
> => RY
>
---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org
RE: Newbie Basics: Security Policy
Posted by Roxanne Yee <ry...@akimeka.com>.
Just to verify how this policy would work...
So if I use this policy, I can just tell soapUI to add a User Name Token with username "alice" and password "bobPW", and I should receive an echo back (using the service in the samples) in the response? However, when I do this, for some reason I receive and error. The RAW messages are reprinted below:
REQUEST:
Host: 192.168.1.247:8080
Content-Length: 803
User-Agent: Jakarta Commons-HttpClient/3.0.1
Content-Type: application/soap+xml;charset=UTF-8;action="urn:echo"
<soap:Envelope xmlns:sam="http://sample01.policy.samples.rampart.apache.org" xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
<soap:Header>
<wsse:Security soap:mustUnderstand="true" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken wsu:Id="UsernameToken-10518016" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:Username>alice</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">bobPW</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</soap:Header>
<soap:Body>
<sam:echo>
<!--Optional:-->
<sam:param0>?</sam:param0>
</sam:echo>
</soap:Body>
</soap:Envelope>
RESPONSE:
HTTP/1.1 500 Internal Server Error
Date: Tue, 15 Jul 2008 18:05:24 GMT
Transfer-Encoding: chunked
Connection: close
Content-Type: application/soap+xml; action="http://www.w3.org/2005/08/addressing/soap/fault";charset=UTF-8
Server: Apache-Coyote/1.1
<?xml version='1.0' encoding='UTF-8'?>
<soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope">
<soapenv:Body>
<soapenv:Fault>
<soapenv:Code>
<soapenv:Value>soapenv:Receiver</soapenv:Value>
</soapenv:Code>
<soapenv:Reason>
<soapenv:Text xml:lang="en-US">java.lang.NoSuchMethodError: org.apache.ws.security.message.WSSecHeader.isEmpty(Lorg/w3c/dom/Document;)Z</soapenv:Text>
</soapenv:Reason>
<soapenv:Detail />
</soapenv:Fault>
</soapenv:Body>
</soapenv:Envelope>
Thanks.
=>RY
-----Original Message-----
From: Nandana Mihindukulasooriya [mailto:nandana.cse@gmail.com]
Sent: Mon 7/14/2008 8:01 AM
To: rampart-dev@ws.apache.org
Subject: Re: Newbie Basics: Security Policy
Hi Roxane,
This is the policy to be used. Hope you know how to attach this policy to
services.xml and to a client. Please go through the Rampart policy samples
and you will be able to see how that is done. If you have further questions,
please feel free to throw them in.
regards,
nandana
<wsp:Policy wsu:Id="UT" xmlns:wsu="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
<wsp:ExactlyOne>
<wsp:All>
<sp:SupportingTokens xmlns:sp="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:UsernameToken sp:IncludeToken="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient"
/>
</wsp:Policy>
</sp:SupportingTokens>
<ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy">
<ramp:user>username</ramp:user>
<ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
</ramp:RampartConfig>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
On Mon, Jul 14, 2008 at 11:53 PM, Roxanne Yee <ry...@akimeka.com> wrote:
> If I simply wanted to implement a web service that used a User Name Token
> authentication system with a Username and Password in Plaintext (no SSL for
> now, cause I'm a little sketchy on how to actually set that up), what would
> I need to do if using the Policy handler configuration?
>
> Thanks.
>
> => RY
>
Re: Newbie Basics: Security Policy
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
Hi Roxane,
This is the policy to be used. Hope you know how to attach this policy to
services.xml and to a client. Please go through the Rampart policy samples
and you will be able to see how that is done. If you have further questions,
please feel free to throw them in.
regards,
nandana
<wsp:Policy wsu:Id="UT" xmlns:wsu="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
<wsp:ExactlyOne>
<wsp:All>
<sp:SupportingTokens xmlns:sp="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:UsernameToken sp:IncludeToken="
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient"
/>
</wsp:Policy>
</sp:SupportingTokens>
<ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy">
<ramp:user>username</ramp:user>
<ramp:passwordCallbackClass>org.apache.rampart.samples.policy.sample01.PWCBHandler</ramp:passwordCallbackClass>
</ramp:RampartConfig>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
On Mon, Jul 14, 2008 at 11:53 PM, Roxanne Yee <ry...@akimeka.com> wrote:
> If I simply wanted to implement a web service that used a User Name Token
> authentication system with a Username and Password in Plaintext (no SSL for
> now, cause I'm a little sketchy on how to actually set that up), what would
> I need to do if using the Policy handler configuration?
>
> Thanks.
>
> => RY
>