Re: [WSS4J] Current state of callbacks question

Basically the hooks to do what you are asking exist in wss4j.

see my comments below

On Feb 12, 2004, at 10:38 AM, trebor iksrazal wrote:

> I am about ready to start a second iteration of a Web
> Services Security project. The first used a pure
> apache xml security approach. I have seen lots of
> wss4j activity and have some questions.
>
> I have one web service and many clients. We would like
> to store a digital certificate in LDAP for each
> client.
> There is also a need for XML Encryption. We would like
> to store the info nessecary to decrypt in LDAP too.
>
> So the issue here is that the Web service itself -
> _not_ the web service client, needs to do a callback
> to  retrieve the digital certificate and private key
> password needed for decryption from LDAP.
>
> My questions are:
>
> 1) Does wss4j have a callback for server-side password
> retrieval from LDAP? Earlier versions only supported
> filesystem retrieval.

You will probably have to write a callback that knows how to get your 
passwords from LDAP. The filesystem type callbacks are just for 
demonstration and testing (usually).

> 2) We would like to store a serialized java object in
> LDAP, that contains all the info the web service needs
> - the certificate and the password - for decryption
> and certificate validation. Does that make sense?

I have a "SecurityDomain" stored in LDAP. That SecurityDomain can 
supply me with a keystore or truststore for use with wss4j, so yes it 
does make sense.

> 3) Could we implement a new call that replaces the
> Merlin class which implements the Crypto interface to
> accomplish this?. We would like to do all this in an
> axis handler or wss4j equivalent - intercepting all
> requests before the web service.

Sure, if you already have your keystore (maybe obtained from LDAP) you 
can have a Merlin subclass that looks something like

public class MyMerlin extends Merlin
	public MyMerlin (KeyStore ks){
		super(null);
		setKeyStore(ks);
	}
}

Then you can make use of this new Crypto implementation by subclassing 
the WSDoAllSender and WSSoAllReceiver and override the load...Crypto() 
hooks something like

public class MyReceiver extends WSDoAllReceiver
	protected Crypto loadSignatureCrypto(){
		return new MyMerlin(keystore);
	}
	protected Crypto loadDecryptionCrypto(){
		return new MyMerlin(keystore);
	}
}

Then just put the receiver handler in the request chain, and the sender 
handler in the response chain on the server and you are done

:-)

There will be an example of an implementation like this (using axis and 
wss4j) in JBoss 4.0 before too long.

> So the idea here is that the web service client calls
> call.setUsername("name"); to be uniquely identified by
> the web service. The digital certificate serial number
> is included in the invokation. The client receives the
> certficate from LDAP.
>
> The web service verifies the certificate and decrypts
> the message, via a serialized java object.
>
> Please help.

In the test/wssec/TestWSSecurityHooks test case there is a method 
called testRoundTripWithHooks that shows how to subclass Merlin and the 
DoAll handlers to do what you want. The test is obviously a very simple 
case, you'd have to figure out the details of getting the keystore and 
such out of LDAP.

HTH

-jason



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click