Webservices und Web Service Security

1. Webservices und Web Service Security PEA01 Alexander Kuzmierz 19.12.2003

2. Verwendung des AxisBasicHandler ausorg.apache.axis.handlers.BasicHandler + Getrennte Handler für Request und Response auf Client- und Serverseite

3. Die Einbettung der client- und serverseitigen Handler ... in der client-config.wsdd <requestFlow> <handler type="java:pea01_security.ClientSecurityHandler"> <parameter name="keystore" value="/usr/local/jboss/data/pea01/keystore_client"/> </handler> </requestFlow> <responseFlow> <handler type="java:pea01_security.ClientResSecurityHandler"> <parameter name="keystore" value="/usr/local/jboss/data/pea01/keystore_client"/> </handler> </responseFlow> ... in der web-services.xml <requestFlow> <handler name="ServerSecurityHandler“ type="java:ejb_access.ServerSecurityHandler"> <parameter name="keystore" value="/usr/local/jboss/data/pea01/keystore_server" /> </handler> </requestFlow> <responseFlow> <handler name="ServerResSecurityHandler" type="java:ejb_access.ServerResSecurityHandler"> <parameter name="keystore" value="/usr/local/jboss/data/pea01/keystore_server" /> </handler> </responseFlow>

4. Aufruf des Axis Basic Handlers Axis ruft in der Handler-Klasse zwei Methoden auf: -init() -invoke(MessageContext msgCtx) invoke(MessageContext msgCtx)public void invoke(MessageContext msgCtx) throws AxisFault { if (keyStore == null) throw new AxisFault("ServerSecurityHandler: key store not initialized"); try { Message msg = msgCtx.getRequestMessage(); Document doc = msg.getSOAPEnvelope().getAsDocument();verifyAndDecrypt(doc); StreamSource s = new StreamSource(new StringReader(XMLUtils.DocumentToString(doc))); msg.getSOAPPart().setContent(s); SOAPHeaderElement secHeader = msg.getSOAPEnvelope().getHeaderByName(WSSE_URI, SECURITY); secHeader.setProcessed(true); } catch (Exception e) { throw new AxisFault("Exception in ServerSecurityHandler: " + e.getMessage()); } }