AW: [WSS4J] Current state of callbacks question

Hi,

just to add my 2 (Euro) cents :-)

Instead of subclassing Merlin and the WSDoAll* classes
you may also implement you own Crypto implementation
and register that Crypto implementation in the crypto
property file. Pls refer to the package documention
in org.apache.ws.axis.security.

Regards,
Werner


> -----Urspr=FCngliche Nachricht-----
> Von: wss4j-devel-admin-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org=20
> [mailto:wss4j-devel-admin-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org] Im Auftrag=20
> von Jason Essington
> Gesendet: Freitag, 13. Februar 2004 00:43
> An: trebor iksrazal
> Cc: [email protected]
> Betreff: Re: [WSS4J] Current state of callbacks question
>=20
>=20
> Basically the hooks to do what you are asking exist in wss4j.
>=20
> see my comments below
>=20
> On Feb 12, 2004, at 10:38 AM, trebor iksrazal wrote:
>=20
> > I am about ready to start a second iteration of a Web
> > Services Security project. The first used a pure
> > apache xml security approach. I have seen lots of
> > wss4j activity and have some questions.
> >
> > I have one web service and many clients. We would like
> > to store a digital certificate in LDAP for each
> > client.
> > There is also a need for XML Encryption. We would like
> > to store the info nessecary to decrypt in LDAP too.
> >
> > So the issue here is that the Web service itself -
> > _not_ the web service client, needs to do a callback
> > to  retrieve the digital certificate and private key
> > password needed for decryption from LDAP.
> >
> > My questions are:
> >
> > 1) Does wss4j have a callback for server-side password
> > retrieval from LDAP? Earlier versions only supported
> > filesystem retrieval.
>=20
> You will probably have to write a callback that knows how to get your =

> passwords from LDAP. The filesystem type callbacks are just for=20
> demonstration and testing (usually).
>=20
> > 2) We would like to store a serialized java object in
> > LDAP, that contains all the info the web service needs
> > - the certificate and the password - for decryption
> > and certificate validation. Does that make sense?
>=20
> I have a "SecurityDomain" stored in LDAP. That SecurityDomain can=20
> supply me with a keystore or truststore for use with wss4j, so yes it =

> does make sense.
>=20
> > 3) Could we implement a new call that replaces the
> > Merlin class which implements the Crypto interface to
> > accomplish this?. We would like to do all this in an
> > axis handler or wss4j equivalent - intercepting all
> > requests before the web service.
>=20
> Sure, if you already have your keystore (maybe obtained from=20
> LDAP) you=20
> can have a Merlin subclass that looks something like
>=20
> public class MyMerlin extends Merlin
> 	public MyMerlin (KeyStore ks){
> 		super(null);
> 		setKeyStore(ks);
> 	}
> }
>=20
> Then you can make use of this new Crypto implementation by=20
> subclassing=20
> the WSDoAllSender and WSSoAllReceiver and override the=20
> load...Crypto()=20
> hooks something like
>=20
> public class MyReceiver extends WSDoAllReceiver
> 	protected Crypto loadSignatureCrypto(){
> 		return new MyMerlin(keystore);
> 	}
> 	protected Crypto loadDecryptionCrypto(){
> 		return new MyMerlin(keystore);
> 	}
> }
>=20
> Then just put the receiver handler in the request chain, and=20
> the sender=20
> handler in the response chain on the server and you are done
>=20
> :-)
>=20
> There will be an example of an implementation like this=20
> (using axis and=20
> wss4j) in JBoss 4.0 before too long.
>=20
> > So the idea here is that the web service client calls
> > call.setUsername("name"); to be uniquely identified by
> > the web service. The digital certificate serial number
> > is included in the invokation. The client receives the
> > certficate from LDAP.
> >
> > The web service verifies the certificate and decrypts
> > the message, via a serialized java object.
> >
> > Please help.
>=20
> In the test/wssec/TestWSSecurityHooks test case there is a method=20
> called testRoundTripWithHooks that shows how to subclass=20
> Merlin and the=20
> DoAll handlers to do what you want. The test is obviously a=20
> very simple=20
> case, you'd have to figure out the details of getting the=20
> keystore and=20
> such out of LDAP.
>=20
> HTH
>=20
> -jason
>=20
>=20
>=20
> -------------------------------------------------------
> SF.Net is sponsored by: Speed Start Your Linux Apps Now.
> Build and deploy apps & Web services for Linux with
> a free DVD software kit from IBM. Click Now!
> http://ads.osdn.com/?ad_id=3D1356&alloc_id=3D3438&op=3Dclick
> _______________________________________________
> wss4j-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/wss4j-devel
>=20


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click