Re: AW: [WSS4J] Current state of callbacks question

--- Dittmann Werner <[email protected]>
wrote:
> Hi,
> 
> just to add my 2 (Euro) cents :-)

Here in brazil 2 euro cents == 6 centavos - the advice
is worth 3x as much ;-) 

> 
> Instead of subclassing Merlin and the WSDoAll*
> classes
> you may also implement you own Crypto implementation
> and register that Crypto implementation in the
> crypto
> property file. Pls refer to the package documention
> in org.apache.ws.axis.security.

That's a possibilty. I do like the example Jason wrote
though - thx. I'm in the design phase now, so I'll
weigh both options and see how it turns out. 

Thanks a lot - things are getting clearer. 

iksrazal

> 
> > -----Ursprüngliche Nachricht-----
> > Von: wss4j-devel-admin-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org 
> > [mailto:wss4j-devel-admin-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org]
> Im Auftrag 
> > von Jason Essington
> > Gesendet: Freitag, 13. Februar 2004 00:43
> > An: trebor iksrazal
> > Cc: [email protected]
> > Betreff: Re: [WSS4J] Current state of callbacks
> question
> > 
> > 
> > Basically the hooks to do what you are asking
> exist in wss4j.
> > 
> > see my comments below
> > 
> > On Feb 12, 2004, at 10:38 AM, trebor iksrazal
> wrote:
> > 
> > > I am about ready to start a second iteration of
> a Web
> > > Services Security project. The first used a pure
> > > apache xml security approach. I have seen lots
> of
> > > wss4j activity and have some questions.
> > >
> > > I have one web service and many clients. We
> would like
> > > to store a digital certificate in LDAP for each
> > > client.
> > > There is also a need for XML Encryption. We
> would like
> > > to store the info nessecary to decrypt in LDAP
> too.
> > >
> > > So the issue here is that the Web service itself
> -
> > > _not_ the web service client, needs to do a
> callback
> > > to  retrieve the digital certificate and private
> key
> > > password needed for decryption from LDAP.
> > >
> > > My questions are:
> > >
> > > 1) Does wss4j have a callback for server-side
> password
> > > retrieval from LDAP? Earlier versions only
> supported
> > > filesystem retrieval.
> > 
> > You will probably have to write a callback that
> knows how to get your 
> > passwords from LDAP. The filesystem type callbacks
> are just for 
> > demonstration and testing (usually).
> > 
> > > 2) We would like to store a serialized java
> object in
> > > LDAP, that contains all the info the web service
> needs
> > > - the certificate and the password - for
> decryption
> > > and certificate validation. Does that make
> sense?
> > 
> > I have a "SecurityDomain" stored in LDAP. That
> SecurityDomain can 
> > supply me with a keystore or truststore for use
> with wss4j, so yes it 
> > does make sense.
> > 
> > > 3) Could we implement a new call that replaces
> the
> > > Merlin class which implements the Crypto
> interface to
> > > accomplish this?. We would like to do all this
> in an
> > > axis handler or wss4j equivalent - intercepting
> all
> > > requests before the web service.
> > 
> > Sure, if you already have your keystore (maybe
> obtained from 
> > LDAP) you 
> > can have a Merlin subclass that looks something
> like
> > 
> > public class MyMerlin extends Merlin
> > 	public MyMerlin (KeyStore ks){
> > 		super(null);
> > 		setKeyStore(ks);
> > 	}
> > }
> > 
> > Then you can make use of this new Crypto
> implementation by 
> > subclassing 
> > the WSDoAllSender and WSSoAllReceiver and override
> the 
> > load...Crypto() 
> > hooks something like
> > 
> > public class MyReceiver extends WSDoAllReceiver
> > 	protected Crypto loadSignatureCrypto(){
> > 		return new MyMerlin(keystore);
> > 	}
> > 	protected Crypto loadDecryptionCrypto(){
> > 		return new MyMerlin(keystore);
> > 	}
> > }
> > 
> > Then just put the receiver handler in the request
> chain, and 
> > the sender 
> > handler in the response chain on the server and
> you are done
> > 
> > :-)
> > 
> > There will be an example of an implementation like
> this 
> > (using axis and 
> > wss4j) in JBoss 4.0 before too long.
> > 
> > > So the idea here is that the web service client
> calls
> > > call.setUsername("name"); to be uniquely
> identified by
> > > the web service. The digital certificate serial
> number
> > > is included in the invokation. The client
> receives the
> > > certficate from LDAP.
> > >
> > > The web service verifies the certificate and
> decrypts
> > > the message, via a serialized java object.
> > >
> > > Please help.
> > 
> > In the test/wssec/TestWSSecurityHooks test case
> there is a method 
> > called testRoundTripWithHooks that shows how to
> subclass 
> > Merlin and the 
> > DoAll handlers to do what you want. The test is
> obviously a 
> > very simple 
> > case, you'd have to figure out the details of
> getting the 
> > keystore and 
> > such out of LDAP.
> > 
> > HTH
> > 
> > -jason
> > 
> > 
> > 
> >
>
-------------------------------------------------------
> > SF.Net is sponsored by: Speed Start Your Linux
> Apps Now.
> > Build and deploy apps & Web services for Linux
> with
> > a free DVD software kit from IBM. Click Now!
> >
>
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
> > _______________________________________________
> > wss4j-devel mailing list
> > [email protected]
> >
>
https://lists.sourceforge.net/lists/listinfo/wss4j-devel
> > 
> 
> 
>
-------------------------------------------------------
> SF.Net is sponsored by: Speed Start Your Linux Apps
> Now.
> Build and deploy apps & Web services for Linux with
> a free DVD software kit from IBM. Click Now!
> http://ads.osdn.com/?ad_id56&alloc_id438&op=click
> _______________________________________________
> 
=== message truncated ===


__________________________________
Do you Yahoo!?
Yahoo! Finance: Get your refund fast by filing online.
http://taxes.yahoo.com/filing.html


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click