You are viewing a plain text version of this content. The canonical link for it is here.
Posted to wss4j-dev@ws.apache.org by Bauer Horscht <ba...@gmx.de> on 2009/04/20 23:36:56 UTC
How to secure specific operations of a Web Service only?
Hi,
I'm wondering, if it's possible to publish a Web Service that offers
some secured operations and also some free-to-all operations?
An example could be a Web Service that allows its readValue operation to
be called by everyone while its writeValue(String) operation requires
encryption and signature.
Can this be done with WSS4J?
Thanks
Bauerhorscht
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
Re: How to secure specific operations of a Web Service only?
Posted by Daniel Kulp <dk...@apache.org>.
In theory, yes in combination with WS-SecurityPolicy. Supposedly, you could
attach secure policy stuff to the Operation in the wsdl instead of the
porttype so those security policies would only be in effect for those
operations.
That said, I'm not sure how well supported that would be. Part of the issue
is that the runtime wouldn't know which operation it would be until after the
security is processed. Thus, I'm not sure how the policies around dealing
with the operation would work. Definitely falls into the "try it and see and
log any issues you find" type situation.
Dan
On Mon April 20 2009 5:36:56 pm Bauer Horscht wrote:
> Hi,
>
> I'm wondering, if it's possible to publish a Web Service that offers
> some secured operations and also some free-to-all operations?
> An example could be a Web Service that allows its readValue operation to
> be called by everyone while its writeValue(String) operation requires
> encryption and signature.
> Can this be done with WSS4J?
>
> Thanks
> Bauerhorscht
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
> For additional commands, e-mail: wss4j-dev-help@ws.apache.org
--
Daniel Kulp
dkulp@apache.org
http://www.dankulp.com/blog
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org