How to configure WSS4JOutInterceptor encryptation for multiple clients

[Cleber Moura <cl...@gmail.com>]

Hi,

I have the fallowing scenario:

Server Side:
A webservice deployed on JBoss with CXF Stack for webservices. Using
ws-security for signing and encryptation of IN and OUT messages with X509
certificates.

Cliente Side:
Multiple clients also using ws-security for signing and encryptation of IN
and OUT messages.

The question is: How can the server encrypt the OUT message with the same
certificate of the IN message? The samples I've found only have the 1-to-1
scenario (one server to one client).

Thanks!

Cleber.

Re: How to configure WSS4JOutInterceptor encryptation for multiple clients

[Mayank Mishra <ma...@gmail.com>]

Werner Dittmann wrote:
> Can you have a look (google :-)  ) for the option "useReqSigCert"?
> At least in the WSS4J Axis handler this oprion triggers a specical
> action. This could be the option you a looking for. Ther sever
> uses the clients's certificate to encrypt the response, the client
> uses its certificate to sign its request, the clients must use
> "DirectReference" to submit its certificate in the request. This
> works for any number of clients.
>
> I don't know if this option is also available in CFX.
>
> Regards,
> Werner
>
>   
1. Yes, CXF was having a value "useReqSigCert" for "encryptionUser" 
property. You require to check it now.
2. The other way I know is to have signature from every client to server 
message with signature key identifier as Direct Reference. This will 
embed clients public key in the request message. You require to extract 
out the certificate from in WSHandler, put it into the context of 
message, so that the encryptionAction can then use the certificate to 
encrypt the response to client. But, the cost to this approach is a) 
Signature (any) is required in every incoming message b) you require to 
tweak the WSS4J WSHandler code.
3. The third way is to use WS-Trust and specify "public key" as proof key.

With Regards,
Mayank
> Cleber Moura schrieb:
>   
>> Hi,
>>
>> I have the fallowing scenario:
>>
>> Server Side:
>> A webservice deployed on JBoss with CXF Stack for webservices. Using
>> ws-security for signing and encryptation of IN and OUT messages with X509
>> certificates.
>>
>> Cliente Side:
>> Multiple clients also using ws-security for signing and encryptation of IN
>> and OUT messages.
>>
>> The question is: How can the server encrypt the OUT message with the same
>> certificate of the IN message? The samples I've found only have the 1-to-1
>> scenario (one server to one client).
>>
>> Thanks!
>>
>> Cleber.
>>
>>     
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
> For additional commands, e-mail: wss4j-dev-help@ws.apache.org
>
>
>   

Re: How to configure WSS4JOutInterceptor encryptation for multiple clients

[Werner Dittmann <We...@t-online.de>]

IMHO this message "No certificates..." shows up if the request does
not contain the certificate. The option works only if you use the
option "DirectReference" and the request contains the certificate as
base64 encoded data (true for Axis 1.x). If this does not work the
same way in Axis 2 then this should be check as a possible bug.

Regards,
Werner

Cleber Moura schrieb:
> I try to use this option already, but it doesn´t work. It raises an
> exception with the message: "No certificates for user useReqSigCert were
> found for encryption".
> 
> As a workaround I did override the method handleMessage from
> WSS4JOutInterceptor class to set the property "encriptionUser" with the same
> user from IN message.
> 
> Thanks.
> 
> 2009/6/6 Werner Dittmann <We...@t-online.de>
> 
>> Can you have a look (google :-)  ) for the option "useReqSigCert"?
>> At least in the WSS4J Axis handler this oprion triggers a specical
>> action. This could be the option you a looking for. Ther sever
>> uses the clients's certificate to encrypt the response, the client
>> uses its certificate to sign its request, the clients must use
>> "DirectReference" to submit its certificate in the request. This
>> works for any number of clients.
>>
>> I don't know if this option is also available in CFX.
>>
>> Regards,
>> Werner
>>
>> Cleber Moura schrieb:
>>> Hi,
>>>
>>> I have the fallowing scenario:
>>>
>>> Server Side:
>>> A webservice deployed on JBoss with CXF Stack for webservices. Using
>>> ws-security for signing and encryptation of IN and OUT messages with X509
>>> certificates.
>>>
>>> Cliente Side:
>>> Multiple clients also using ws-security for signing and encryptation of
>> IN
>>> and OUT messages.
>>>
>>> The question is: How can the server encrypt the OUT message with the same
>>> certificate of the IN message? The samples I've found only have the
>> 1-to-1
>>> scenario (one server to one client).
>>>
>>> Thanks!
>>>
>>> Cleber.
>>>
>>
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org

Re: How to configure WSS4JOutInterceptor encryptation for multiple clients

[Cleber Moura <cl...@gmail.com>]

I try to use this option already, but it doesn´t work. It raises an
exception with the message: "No certificates for user useReqSigCert were
found for encryption".

As a workaround I did override the method handleMessage from
WSS4JOutInterceptor class to set the property "encriptionUser" with the same
user from IN message.

Thanks.

2009/6/6 Werner Dittmann <We...@t-online.de>

> Can you have a look (google :-)  ) for the option "useReqSigCert"?
> At least in the WSS4J Axis handler this oprion triggers a specical
> action. This could be the option you a looking for. Ther sever
> uses the clients's certificate to encrypt the response, the client
> uses its certificate to sign its request, the clients must use
> "DirectReference" to submit its certificate in the request. This
> works for any number of clients.
>
> I don't know if this option is also available in CFX.
>
> Regards,
> Werner
>
> Cleber Moura schrieb:
> > Hi,
> >
> > I have the fallowing scenario:
> >
> > Server Side:
> > A webservice deployed on JBoss with CXF Stack for webservices. Using
> > ws-security for signing and encryptation of IN and OUT messages with X509
> > certificates.
> >
> > Cliente Side:
> > Multiple clients also using ws-security for signing and encryptation of
> IN
> > and OUT messages.
> >
> > The question is: How can the server encrypt the OUT message with the same
> > certificate of the IN message? The samples I've found only have the
> 1-to-1
> > scenario (one server to one client).
> >
> > Thanks!
> >
> > Cleber.
> >
>
>

Re: How to configure WSS4JOutInterceptor encryptation for multiple clients

[Werner Dittmann <We...@t-online.de>]

Can you have a look (google :-)  ) for the option "useReqSigCert"?
At least in the WSS4J Axis handler this oprion triggers a specical
action. This could be the option you a looking for. Ther sever
uses the clients's certificate to encrypt the response, the client
uses its certificate to sign its request, the clients must use
"DirectReference" to submit its certificate in the request. This
works for any number of clients.

I don't know if this option is also available in CFX.

Regards,
Werner

Cleber Moura schrieb:
> Hi,
> 
> I have the fallowing scenario:
> 
> Server Side:
> A webservice deployed on JBoss with CXF Stack for webservices. Using
> ws-security for signing and encryptation of IN and OUT messages with X509
> certificates.
> 
> Cliente Side:
> Multiple clients also using ws-security for signing and encryptation of IN
> and OUT messages.
> 
> The question is: How can the server encrypt the OUT message with the same
> certificate of the IN message? The samples I've found only have the 1-to-1
> scenario (one server to one client).
> 
> Thanks!
> 
> Cleber.
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org