Paying back to internet

Hello everyone,

In my current project I have one non functional requisite quite challenging (at least for me, a dotnetboy playing around in the java world). As usual it came when the project was half made. It said… soap messages will be encrypted, ssl is not possible.

Well, so we have a few jax-ws services done, and ¡ups! jax-ws is incomplete (one friend told me it was like wcf, nothing further away from the truth, it leaks lots of ws-* features). The thing got harder because we have lots of differents app servers (tomcat, weblogic and jboss). I would be happy having the possibility of using Metro, but I need something independent.

So googling I found the first important thing: the jax-ws handlers. Basically it is a pre and post process of a message. We can modify the message just before is sent through the wire and before it get parsed by the service. How can we modify the service with a handler?

        2: @SOAPBinding

       3: @Stateless

       4: @HandlerChain(file = "../../../../../../handlers.xml")

       5: public class Service implements IService {

@HandlerChain points to the file which defines the classes which will be used as a handler.

       1: <?xml version="1.0" encoding="UTF-8"?>

       2: <jws:handler-chains xmlns:jws="http://java.sun.com/xml/ns/javaee">

       3:    <jws:handler-chain>

       4:       <jws:handler>

       5:       <jws:handler-class>

       6:             es.pablocastilla.WSSecurityHandler

       7:          </jws:handler-class>

       8:       </jws:handler>

       9:    </jws:handler-chain>

      10: </jws:handler-chains>

This classes should implement one special interface (as usual in this kind of things)

       1: public class WSSecurityHandler implements

       2:         SOAPHandler<SOAPMessageContext>

So know we have something in the service that will transform an encrypted message to a normal one.

And now, how do I code and decode the messages, well, all can be done with a few single classes:

       1: public class WSSecurityHandler implements

       2:         SOAPHandler<SOAPMessageContext>, CallbackHandler {

       3:  

       4:     Properties prop;

       5:  

       6:     /**

       7:      * Constructor initializes properties

       8:      * */

       9:     public WSSecurityHandler () throws Exception {

        prop = PropSingleton.getSingleton().GetProp();

    }

  

  

    /**

     * Returns special headers.

     */

    public Set<QName> getHeaders() {

        Set<QName> HEADERS = new HashSet<QName>();

  

        HEADERS.add(new QName(WSConstants.WSSE_NS, "Security"));

        HEADERS.add(new QName(WSConstants.WSSE11_NS, "Security"));

        HEADERS.add(new QName(WSConstants.ENC_NS, "EncryptedData"));

  

        return HEADERS;

    }

  

    /**

     * Handles the message, code and decode it depending if it is an outgoing or incoming one.

     */

    public boolean handleMessage(SOAPMessageContext messageContext) {

        try {

            // got the message from the context

            SOAPMessage msg = messageContext.getMessage();

  

            

            // is outgoing?

            Boolean isOutGoing = (Boolean) messageContext

                    .get(MessageContext.MESSAGE_OUTBOUND_PROPERTY);

  

           

            if (isOutGoing) {

                // if it is outgoing code and sign

                EncryptUtil.EncryptSOAPEnvelope(msg, prop);

                EncryptUtil.SignSOAPEnvelope(msg, prop);

            } else {

                // if it is incooming decode and check signature.

                EncryptUtil.CheckSignAndDecode(

                        msg, this, prop);

            }

  

        } catch (Exception ex) {

            ex.printStackTrace();

            throw new RuntimeException(ex.getMessage());

        }

  

        return true;

    }

  

    public boolean handleFault(SOAPMessageContext messageContext) {

        return true;

    }

  

    /**

     * Return the jks key, not necesary

     */

    @SuppressWarnings("deprecation")

    public void handle(Callback[] callbacks) throws IOException,

            UnsupportedCallbackException {

  

        String password;

  

        for (Callback cb : callbacks) {

            if (cb instanceof WSPasswordCallback) {

                WSPasswordCallback pc = (WSPasswordCallback) cb;

  

                try {

                    password = prop.getProperty("password");

                } catch (Exception e) {

                    throw new UnsupportedCallbackException(pc,

                            "fallo al recuperar la clave en el properties");

                }

  

                if (pc.getIdentifer() != null) {

                    pc.setPassword(password);

                }

            }

        }

    }

  

    public void close(MessageContext messageContext) {

    }

  

  

}

The class which uses Apache´s WSS4J for encrypting the messages:

       1: public class EncryptUtil{

       2:  

       3:     @SuppressWarnings( { "unchecked", "deprecation" })

       4:     static void CheckSignatureAndDecode(SOAPMessage msg,

       5:             CallbackHandler cb,Properties prop) throws WSSecurityException,

       6:             TransformerConfigurationException, TransformerException,

       7:             SOAPException, IOException, Exception {

       8:  

       9:         WSSecurityEngine secEngine = new WSSecurityEngine();

        WSSignEnvelope signer = new WSSignEnvelope();

  

        String alias = prop.getProperty("alias");// login of jks file

        String password = prop.getProperty("password");// password of jks file

  

        signer.setUserInfo(alias, password);

  

        Crypto crypto = CryptoFactory.getInstance(prop);

        org.w3c.dom.Document doc = toDocument(mensaje);

  

//after we set the encrypt stuff the processsecurity does all the work

        Vector v = secEngine.processSecurityHeader(doc, null, cb, crypto);

  

        if (v == null) {

  

            throw new Exception("Access not granted.");

  

        }

  

        //put the decoded message into the object

        updateSOAPMessage(doc, msg);

    }

  

    /**

     * Updates the message with the unencrypt form

     */

    private static SOAPMessage updateSOAPMessage(Document doc,

            SOAPMessage message) throws SOAPException {

        DOMSource domSource = new DOMSource(doc);

        message.getSOAPPart().setContent(domSource);

        return message;

    }

  

    /**

     * Changes the SOAPMessage to a dom.Document.

     */

    public static org.w3c.dom.Document toDocument(SOAPMessage soapMsg)

            throws SOAPException, TransformerException {

        Source src = soapMsg.getSOAPPart().getContent();

        TransformerFactory tf = TransformerFactory.newInstance();

        Transformer transformer = tf.newTransformer();

        DOMResult result = new DOMResult();

        transformer.transform(src, result);

  

        return (Document) result.getNode();

    }

  

    /**

     * Signs  a SOAPMessage

     * 

     * @param mensaje

     * @throws Exception

     */

    @SuppressWarnings("deprecation")

    static void SignSOAPEnvelope(SOAPMessage mensaje, Properties prop) throws Exception {

        // WSSignEnvelope signs a SOAP envelope according to the

        // WS Specification (X509 profile) and adds the signature data

        // to the envelope.

        WSSignEnvelope signer = new WSSignEnvelope();

  

        

  

        String alias = prop.getProperty("alias");// "autentiaserver";

        String password = prop.getProperty("password");// "changeit";

  

        signer.setUserInfo(alias, password);

  

        Crypto crypto = CryptoFactory.getInstance(prop);

  

        Document doc = toDocument(mensaje);

        signer.setMustUnderstand(false);

        Document signedDoc = signer.build(doc, crypto);

  

        DOMSource domSource = new DOMSource(signedDoc);

        mensaje.getSOAPPart().setContent(domSource);

  

    }

  

    /**

     * Codes a SOAPMessage.

     */

    @SuppressWarnings("deprecation")

    static void EncryptSOAPEnvelope(SOAPMessage mensaje,Properties prop) throws Exception {

        // WSSignEnvelope signs a SOAP envelope according to the

        // WS Specification (X509 profile) and adds the signature data

        // to the envelope.

        WSEncryptBody encriptador = new WSEncryptBody();

  

        String alias = prop.getProperty("alias");

        String password = prop.getProperty("password");

        encriptador.setUserInfo(alias, password);

  

        Crypto crypto = CryptoFactory.getInstance(prop);

  

        Document doc = toDocument(mensaje);

        encriptador.setMustUnderstand(false);

        Document signedDoc = encriptador.build(doc, crypto);

  

        DOMSource domSource = new DOMSource(signedDoc);

        mensaje.getSOAPPart().setContent(domSource);

  

    }

  

    

}

All this stuff needs a jdk and some configuration. It is the one which should be place with the properties object which is seen in the classes. Some are repeated, you can improve that code :P

       1: org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin

       2: org.apache.ws.security.crypto.merlin.keystore.type=jks

       3: org.apache.ws.security.crypto.merlin.keystore.password=password

       4: org.apache.ws.security.crypto.merlin.keystore.alias=login

       5: org.apache.ws.security.crypto.merlin.file=/home/webuser/certs/beaclient/keystore.jks

       6: alias=login

       7: password=password

So we have a jax-ws service using WSSecurity :).

libs needed can be found here:

http://ws.apache.org/wss4j/

Hope it can help you, any comment will be appreciated. I am sorry, but I have no time for developing a working example.

Regards.

Paying back to internet

martes 10 de noviembre de 2009

Silent pdf printing without applet

domingo 17 de mayo de 2009

WSSecurity with jax-ws and WSS4J

Why do I write this blog?

Pavo Real

Seguidores

Archivo del blog

Datos personales