Search code examples
javaweb-servicescxfjax-ws

Implementing webservice provider + sts

I must integrate two systems:

  • application written in DELPHI. The application acts as webservice client (WSC)
  • second system acting as a webservice provider (WSP)

Whole communication must comply following ws-policy asserions:

<wsp:Policy wsu:Id="WSHttpBinding_policy">
    <wsp:ExactlyOne>
        <wsp:All>
                <sp:TransportBinding xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                        <wsp:Policy>
                                <sp:TransportToken>
                                        <wsp:Policy>
                                                <sp:HttpsToken RequireClientCertificate="false"/>
                                        </wsp:Policy>
                                </sp:TransportToken>
                                <sp:AlgorithmSuite>
                                        <wsp:Policy>
                                                <sp:Basic256/>
                                        </wsp:Policy>
                                </sp:AlgorithmSuite>
                                <sp:Layout>
                                        <wsp:Policy>
                                                <sp:Strict/>
                                        </wsp:Policy>
                                </sp:Layout>
                                <sp:IncludeTimestamp/>
                        </wsp:Policy>
                </sp:TransportBinding>
                <sp:EndorsingSupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                        <wsp:Policy>
                                <sp:SecureConversationToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
                                        <wsp:Policy>
                                                <sp:BootstrapPolicy>
                                                        <wsp:Policy>
                                                                <sp:SignedParts>
                                                                        <sp:Body/>
                                                                        <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
                                                                        <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
                                                                        <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
                                                                        <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
                                                                        <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
                                                                        <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
                                                                        <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
                                                                </sp:SignedParts>
                                                                <sp:EncryptedParts>
                                                                        <sp:Body/>
                                                                </sp:EncryptedParts>
                                                                <sp:TransportBinding>
                                                                        <wsp:Policy>
                                                                                <sp:TransportToken>
                                                                                        <wsp:Policy>
                                                                                                <sp:HttpsToken RequireClientCertificate="false"/>
                                                                                        </wsp:Policy>
                                                                                </sp:TransportToken>
                                                                                <sp:AlgorithmSuite>
                                                                                        <wsp:Policy>
                                                                                                <sp:Basic256/>
                                                                                        </wsp:Policy>
                                                                                </sp:AlgorithmSuite>
                                                                                <sp:Layout>
                                                                                        <wsp:Policy>
                                                                                                <sp:Strict/>
                                                                                        </wsp:Policy>
                                                                                </sp:Layout>
                                                                                <sp:IncludeTimestamp/>
                                                                        </wsp:Policy>
                                                                </sp:TransportBinding>
                                                                <sp:SignedSupportingTokens>
                                                                        <wsp:Policy>
                                                                                <sp:UsernameToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
                                                                                        <wsp:Policy>
                                                                                                <sp:WssUsernameToken10/>
                                                                                        </wsp:Policy>
                                                                                </sp:UsernameToken>
                                                                        </wsp:Policy>
                                                                </sp:SignedSupportingTokens>
                                                                <sp:Wss11>
                                                                        <wsp:Policy/>
                                                                </sp:Wss11>
                                                                <sp:Trust10>
                                                                        <wsp:Policy>
                                                                                <sp:MustSupportIssuedTokens/>
                                                                                <sp:RequireClientEntropy/>
                                                                                <sp:RequireServerEntropy/>
                                                                        </wsp:Policy>
                                                                </sp:Trust10>
                                                        </wsp:Policy>
                                                </sp:BootstrapPolicy>
                                        </wsp:Policy>
                                </sp:SecureConversationToken>
                        </wsp:Policy>
                </sp:EndorsingSupportingTokens>
                <sp:Wss11 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                        <wsp:Policy/>
                </sp:Wss11>
                <sp:Trust10 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                        <wsp:Policy>
                                <sp:MustSupportIssuedTokens/>
                                <sp:RequireClientEntropy/>
                                <sp:RequireServerEntropy/>
                        </wsp:Policy>
                </sp:Trust10>
                <wsaw:UsingAddressing/>
        </wsp:All>
    </wsp:ExactlyOne>
</wsp:Policy>

My task is to implement WSP in java (preferably in Apache CXF). Analyzing ws-policy:

  • communiaction should use secure connection (HttpsToken)
  • it is required to have kind of "token" (probably Secure Token Service (STS) token)

It seems that I need to use WS-TRUST specification, and that I need to create STS besides real WSP.

In DELPHI application I can specify only one URL for webservice. How to implement such webservice which:

  • produce STS token
  • run real WSP operation.
Solution

  • You don't actually need an STS for this web service - there is no IssuedToken policy in the WSDL. Just a UsernameToken for the Secure Conversation bootstrap. The error is similar to that if the message was received over plain http and not https. Try turning the logs to DEBUG/FINE and look for error messages there.