You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@camel.apache.org by dvsridhar <da...@cgifederal.com> on 2012/10/15 22:38:37 UTC
Jetty proxy routes confused behavior.
Hi,
Our exchange layer contains several of public facing REST full proxy routes
for our actual rest service providers and we use Camel Jetty component to
define these http proxy routes.
However, the exchange layer also contains a GUI for user login and
enterprise user mapping functionality. We want to use the same application
context for our Jetty URL's as well.
For example we use http://0.0.0.0:6080/fdx-web-1.0 to log into the
application and the following are some of the jetty routes that I am
experimenting with.
*Spring Http Configuration*
<http auto-config='true' use-expressions="true"
access-denied-page="/login.jsp">
<intercept-url pattern="/fdx-web-1.0/**" access="hasRole('ROLE_USER')"
/>
<intercept-url pattern="/oauth/**" access="hasRole('ROLE_USER')" />
<intercept-url pattern="/request_token_authorized.jsp"
access="hasRole('ROLE_USER')" />
<form-login authentication-failure-url="/login.jsp"
default-target-url="/index.jsp" login-page="/login.jsp"
login-processing-url="/login.do"/>
<logout logout-success-url="/index.jsp" logout-url="/logout.do"/>
</http>
*Jetty Route Config:*
from("jetty:http://0.0.0.0:6080/fdx-web-1.0/Mom/Vendor/?matchOnUriPrefix=true&disableStreamCache=true&traceEnabled=true")
.process(new UserPwdAuthProcessor())
.policy("admin")
.to("jetty:http://myhost:7001/FDX/Momentum/Vendor/?bridgeEndpoint=true&throwExceptionOnFailure=false");
The issue i am having with this kind of configuration is ..when i try to
access the jetty route i am get the following ..
*The requested resource (/fdx-web-1.0/Momentum/Vendor/query) is not
available.*
However, my webapp (http://localh:6080/fdx-web-1.0/index.jsp) works.
*Note: *Some times with the same configuration we also noticed... webapp
works but not the rest proxy URL. We are totally confused with this
behavior.
*Alternatively...*
*So just to test, we tried different configuration....and introduced DX url
pattern for our jetty URL's...*
<http auto-config='true' use-expressions="true"
access-denied-page="/login.jsp">
<intercept-url pattern="/fdx-web-1.0/**" access="hasRole('ROLE_USER')"
/>
<intercept-url pattern="/DX/**" access="hasRole('ROLE_USER')" />
<intercept-url pattern="/oauth/**" access="hasRole('ROLE_USER')" />
<intercept-url pattern="/request_token_authorized.jsp"
access="hasRole('ROLE_USER')" />
<form-login authentication-failure-url="/login.jsp"
default-target-url="/index.jsp" login-page="/login.jsp"
login-processing-url="/login.do"/>
<logout logout-success-url="/index.jsp" logout-url="/logout.do"/>
</http>
*/with this change, when the application starts only the DX based Jetty
routes works but not the actual web application./*
FYI, I have also attached web.xml web.xml
<http://camel.465427.n5.nabble.com/file/n5721076/web.xml> and application
.xml application.xml
<http://camel.465427.n5.nabble.com/file/n5721076/application.xml>
*Note:* We are also trying integrate spring security Oauth provider .. into
our exchange app and also to our camel jetty routes, we haven't had much
success with that.. but we are trying. You will see references of that in
the example configuration.
Any help highly appreciated.
--
View this message in context: http://camel.465427.n5.nabble.com/Jetty-proxy-routes-confused-behavior-tp5721076.html
Sent from the Camel - Users mailing list archive at Nabble.com.
Re: Jetty proxy routes confused behavior.
Posted by Willem jiang <wi...@gmail.com>.
As the servlet is called from the web container which should take care of the transport security issue.
It makes sense that you can do the security setup through the WebContainer like Jetty or Tomcat.
--
Willem Jiang
Red Hat, Inc.
FuseSource is now part of Red Hat
Web: http://www.fusesource.com | http://www.redhat.com
Blog: http://willemjiang.blogspot.com (http://willemjiang.blogspot.com/) (English)
http://jnn.javaeye.com (http://jnn.javaeye.com/) (Chinese)
Twitter: willemjiang
Weibo: willemjiang
On Wednesday, November 7, 2012 at 3:07 AM, dvsridhar wrote:
> William,
> With your suggestion I was able to stood up the spring-security oauth for
> http proxy routes. However, I just learnt that camel-servlet component
> doesn't have support Camel JSSE Utility
> (http://camel.apache.org/camel-configuration-utilities.html). *We have a
> requirement to support FIPS140 and NIST compliance for SSL transport layer
> and we use RSA JsafeJCE crypto jars for strong encryption. For this
> compliance to work, I need to override the default cipher suites and supply
> the following cipher suites SSL_RSA_WITH_AES_128_CBC_SHA and
> SSL_RSA_WITH_AES_256_CBC_SHA.*(http://publib.boulder.ibm.com/infocenter/wmqv7/v7r0/index.jsp?topic=%2Fcom.ibm.mq.csqzaw.doc%2Fja34740_.htm)
>
>
> *I really don't know what to do here.
> camel-jetty doesn't work with spring security, but it supports JSSE.
> camel-http4 only produce to http endpoints.
> camel-servlet can consume http content but doesn't work with JSSE.
> *
> Looks like I have to change my direction completely and only use CXF for
> security (oauth) and FIPS compliance. But the part I hate the most with this
> approach is for a simple REST URL http redirect use case I have to stand up
> dummy RestImplmentation which makes a no sense for a proxy layer.
>
> *For example:*
>
> <camel:camelContext>
> <camel:route>
> <camel:from uri="cxfrs://bean://vendorConsumer"/>
>
> <camel:removeHeader headerName="Content-Length" />
> <camel:to uri="cxfrs://bean://vendorProducer"/>
> </camel:route>
> </camel:camelContext>
>
> <cxf:rsServer id="vendorConsumer" address="/Vendor"
> <b> serviceClass="com.xyz.rest.resource.impl.VendorRSImpl" *
> loggingFeatureEnabled="true">
> <cxf:extensionMappings>
> <entry key="json" value="application/json"/>
> <entry key="xml" value="application/xml"/>
> </cxf:extensionMappings>
> </cxf:rsServer>
>
> <cxf:rsClient id="vendorProducer" address="http://myhost:7001/FDX/Vendor"
> serviceClass="com.xyz.rest.resource.api.VendorRS" inheritHeaders="true"
> loggingFeatureEnabled="true" >
> </cxf:rsClient>
>
> To make this route work I have to stand this dummy implementation
> "com.xyz.rest.resource.impl.VendorRSImpl", where as my actual service
> provider is present at a different URL("http://myhost:7001/FDX/Vendor").
>
> /In the above configuration "com.ams.momapi.rest.resource.api.VendorRS" is a
> JAX_RS based REST interface and com.xyz.rest.resource.impl.VendorRSImpl is
> the dummy implementation./
>
> What would be recommendation for this. Any help appreciated.
>
> Thanks,
> Sridhar
>
>
>
> --
> View this message in context: http://camel.465427.n5.nabble.com/Jetty-proxy-routes-confused-behavior-tp5721076p5722250.html
> Sent from the Camel - Users mailing list archive at Nabble.com (http://Nabble.com).
Re: Jetty proxy routes confused behavior.
Posted by dvsridhar <da...@cgifederal.com>.
William,
With your suggestion I was able to stood up the spring-security oauth for
http proxy routes. However, I just learnt that camel-servlet component
doesn't have support Camel JSSE Utility
(http://camel.apache.org/camel-configuration-utilities.html). *We have a
requirement to support FIPS140 and NIST compliance for SSL transport layer
and we use RSA JsafeJCE crypto jars for strong encryption. For this
compliance to work, I need to override the default cipher suites and supply
the following cipher suites SSL_RSA_WITH_AES_128_CBC_SHA and
SSL_RSA_WITH_AES_256_CBC_SHA.*(http://publib.boulder.ibm.com/infocenter/wmqv7/v7r0/index.jsp?topic=%2Fcom.ibm.mq.csqzaw.doc%2Fja34740_.htm)
*I really don't know what to do here.
camel-jetty doesn't work with spring security, but it supports JSSE.
camel-http4 only produce to http endpoints.
camel-servlet can consume http content but doesn't work with JSSE.
*
Looks like I have to change my direction completely and only use CXF for
security (oauth) and FIPS compliance. But the part I hate the most with this
approach is for a simple REST URL http redirect use case I have to stand up
dummy RestImplmentation which makes a no sense for a proxy layer.
*For example:*
<camel:camelContext>
<camel:route>
<camel:from uri="cxfrs://bean://vendorConsumer"/>
<camel:removeHeader headerName="Content-Length" />
<camel:to uri="cxfrs://bean://vendorProducer"/>
</camel:route>
</camel:camelContext>
<cxf:rsServer id="vendorConsumer" address="/Vendor"
<b> serviceClass="com.xyz.rest.resource.impl.VendorRSImpl" *
loggingFeatureEnabled="true">
<cxf:extensionMappings>
<entry key="json" value="application/json"/>
<entry key="xml" value="application/xml"/>
</cxf:extensionMappings>
</cxf:rsServer>
<cxf:rsClient id="vendorProducer" address="http://myhost:7001/FDX/Vendor"
serviceClass="com.xyz.rest.resource.api.VendorRS" inheritHeaders="true"
loggingFeatureEnabled="true" >
</cxf:rsClient>
To make this route work I have to stand this dummy implementation
"com.xyz.rest.resource.impl.VendorRSImpl", where as my actual service
provider is present at a different URL("http://myhost:7001/FDX/Vendor").
/In the above configuration "com.ams.momapi.rest.resource.api.VendorRS" is a
JAX_RS based REST interface and com.xyz.rest.resource.impl.VendorRSImpl is
the dummy implementation./
What would be recommendation for this. Any help appreciated.
Thanks,
Sridhar
--
View this message in context: http://camel.465427.n5.nabble.com/Jetty-proxy-routes-confused-behavior-tp5721076p5722250.html
Sent from the Camel - Users mailing list archive at Nabble.com.
Re: Jetty proxy routes confused behavior.
Posted by Willem jiang <wi...@gmail.com>.
Hi,
I don't think camel-jetty can leverage the spring-security out of box, as the security filter doesn't load by it.
If you have a chance to check out the camel spring security example[1], you can find you can use camel-servlet to do kind of work.
[1]http://camel.apache.org/spring-security-example.html
--
Willem Jiang
Red Hat, Inc.
FuseSource is now part of Red Hat
Web: http://www.fusesource.com | http://www.redhat.com
Blog: http://willemjiang.blogspot.com (http://willemjiang.blogspot.com/) (English)
http://jnn.javaeye.com (http://jnn.javaeye.com/) (Chinese)
Twitter: willemjiang
Weibo: willemjiang
On Tuesday, October 16, 2012 at 4:38 AM, dvsridhar wrote:
> Hi,
>
> Our exchange layer contains several of public facing REST full proxy routes
> for our actual rest service providers and we use Camel Jetty component to
> define these http proxy routes.
>
> However, the exchange layer also contains a GUI for user login and
> enterprise user mapping functionality. We want to use the same application
> context for our Jetty URL's as well.
>
> For example we use http://0.0.0.0:6080/fdx-web-1.0 to log into the
> application and the following are some of the jetty routes that I am
> experimenting with.
>
> *Spring Http Configuration*
> <http auto-config='true' use-expressions="true"
> access-denied-page="/login.jsp">
> <intercept-url pattern="/fdx-web-1.0/**" access="hasRole('ROLE_USER')"
> />
> <intercept-url pattern="/oauth/**" access="hasRole('ROLE_USER')" />
> <intercept-url pattern="/request_token_authorized.jsp"
> access="hasRole('ROLE_USER')" />
> <form-login authentication-failure-url="/login.jsp"
> default-target-url="/index.jsp" login-page="/login.jsp"
> login-processing-url="/login.do"/>
> <logout logout-success-url="/index.jsp" logout-url="/logout.do"/>
> </http>
>
>
> *Jetty Route Config:*
>
> from("jetty:http://0.0.0.0:6080/fdx-web-1.0/Mom/Vendor/?matchOnUriPrefix=true&disableStreamCache=true&traceEnabled=true")
> .process(new UserPwdAuthProcessor())
> .policy("admin")
>
> .to("jetty:http://myhost:7001/FDX/Momentum/Vendor/?bridgeEndpoint=true&throwExceptionOnFailure=false");
>
> The issue i am having with this kind of configuration is ..when i try to
> access the jetty route i am get the following ..
> *The requested resource (/fdx-web-1.0/Momentum/Vendor/query) is not
> available.*
>
> However, my webapp (http://localh:6080/fdx-web-1.0/index.jsp) works.
>
> *Note: *Some times with the same configuration we also noticed... webapp
> works but not the rest proxy URL. We are totally confused with this
> behavior.
>
> *Alternatively...*
> *So just to test, we tried different configuration....and introduced DX url
> pattern for our jetty URL's...*
>
> <http auto-config='true' use-expressions="true"
> access-denied-page="/login.jsp">
> <intercept-url pattern="/fdx-web-1.0/**" access="hasRole('ROLE_USER')"
> />
> <intercept-url pattern="/DX/**" access="hasRole('ROLE_USER')" />
> <intercept-url pattern="/oauth/**" access="hasRole('ROLE_USER')" />
> <intercept-url pattern="/request_token_authorized.jsp"
> access="hasRole('ROLE_USER')" />
>
> <form-login authentication-failure-url="/login.jsp"
> default-target-url="/index.jsp" login-page="/login.jsp"
> login-processing-url="/login.do"/>
> <logout logout-success-url="/index.jsp" logout-url="/logout.do"/>
> </http>
>
> */with this change, when the application starts only the DX based Jetty
> routes works but not the actual web application./*
>
> FYI, I have also attached web.xml (http://web.xml) web.xml (http://web.xml)
> <http://camel.465427.n5.nabble.com/file/n5721076/web.xml> and application
> .xml application.xml
> <http://camel.465427.n5.nabble.com/file/n5721076/application.xml>
>
> *Note:* We are also trying integrate spring security Oauth provider .. into
> our exchange app and also to our camel jetty routes, we haven't had much
> success with that.. but we are trying. You will see references of that in
> the example configuration.
>
> Any help highly appreciated.
>
>
>
> --
> View this message in context: http://camel.465427.n5.nabble.com/Jetty-proxy-routes-confused-behavior-tp5721076.html
> Sent from the Camel - Users mailing list archive at Nabble.com (http://Nabble.com).
Re: Jetty proxy routes confused behavior.
Posted by dvsridhar <da...@cgifederal.com>.
Thanks for your reply Charles. I will explore that option. Do you still think
I can use Jetty component to proxy some of my Rest provider URLS?
--
View this message in context: http://camel.465427.n5.nabble.com/Jetty-proxy-routes-confused-behavior-tp5721076p5721129.html
Sent from the Camel - Users mailing list archive at Nabble.com.
Re: Jetty proxy routes confused behavior.
Posted by Charles Moulliard <ch...@gmail.com>.
As camel uses the Apache CXF project for the component camel-cxf, have you
had a look about their documentation :
http://cxf.apache.org/docs/jax-rs-oauth.html
http://cxf.apache.org/docs/jax-rs-oauth2.html
http://cxf.apache.org/docs/cxf-oauth-10.html
On Tue, Oct 16, 2012 at 5:53 PM, dvsridhar <
dabbeeru.venkata.sridhar@cgifederal.com> wrote:
> Let me know if i confused you with my explanation. I really struck here.. I
> have to think on a plan B approach.. if this doesn't work.. at the same
> time
> i don't want to use camel-cxf (cxfrs) .. i think it is kind of over kill
> for
> proxy routes..
>
> Being an exchange layer.. we act as provider.. and i didn't find any
> examples in the combination of camel and oauth provider.. that's what lead
> me try the route of integrating spring oauth provider..
>
> I am trying to go through camel source test cases.. to see if i am
> fundamentally doing anything wrong...
>
>
>
> --
> View this message in context:
> http://camel.465427.n5.nabble.com/Jetty-proxy-routes-confused-behavior-tp5721076p5721126.html
> Sent from the Camel - Users mailing list archive at Nabble.com.
>
--
Charles Moulliard
Apache Committer / Sr. Enterprise Architect (RedHat)
Twitter : @cmoulliard | Blog : http://cmoulliard.blogspot.com
Re: Jetty proxy routes confused behavior.
Posted by dvsridhar <da...@cgifederal.com>.
Let me know if i confused you with my explanation. I really struck here.. I
have to think on a plan B approach.. if this doesn't work.. at the same time
i don't want to use camel-cxf (cxfrs) .. i think it is kind of over kill for
proxy routes..
Being an exchange layer.. we act as provider.. and i didn't find any
examples in the combination of camel and oauth provider.. that's what lead
me try the route of integrating spring oauth provider..
I am trying to go through camel source test cases.. to see if i am
fundamentally doing anything wrong...
--
View this message in context: http://camel.465427.n5.nabble.com/Jetty-proxy-routes-confused-behavior-tp5721076p5721126.html
Sent from the Camel - Users mailing list archive at Nabble.com.