webservice using security UserNameToken

Question

Hi guys,

I am trying to resolve a problem we have using glassfish V2 to publish a simple web service using a plain UserNameToken for security reasons. Since we were using Netbeans 6.5 to archive this we were looking into this tutorial: http://testwww.netbeans.org/kb/60/javaee/identity-amsecurity.html

enter code here

Therefore the following steps were done: In our dev environment we installed the Sun Java(TM) System Access Manager and can administer this through the admin console as well as through the Netbeans IDE. All good. The example from the tutorial worked perfect so we thought we are in a good position to move on.

After changing the security options for our web service we published this on our test environment without any Netbeans installed.

After that the following steps were done: 1. deploying the service 2. configure the realm in Access Manager for the IP address 3. setup the expected user to access the web service.

When our partner is now accessing the web service the actual web service code is not accessed and we always find in the server logging that the security header was not understood.

This is the message we receive at the server:

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;
<soapenv:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soapenv:mustUnderstand="1">
<wsu:Timestamp xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Timestamp-10034404">
<wsu:Created>2009-01-19T16:33:38.537Z</wsu:Created>
<wsu:Expires>2009-01-19T16:34:08.537Z</wsu:Expires></wsu:Timestamp><wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-10034094">
<wsse:Username>myUser</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;myPasswd&lt;/wsse:Password&gt;
</wsse:UsernameToken>
</wsse:Security>
<wsa:MessageID soapenv:mustUnderstand="0">uuid:ecc3b150-e646-11dd-96e5-9f80a576275b</wsa:MessageID>
<wsa:To soapenv:mustUnderstand="0">http://62.154.241.166:8080/HTNGService/WebServiceForTrustService&lt;/wsa:To&gt;
<wsa:Action soapenv:mustUnderstand="0">http://webservice.trustinternational.com/ws/services/Htng2ReservationService&lt;/wsa:Action&gt;
<wsa:From xmlns="http://schemas.xmlsoap.org/ws/2004/08/addressing" soapenv:mustUnderstand="0">
<wsa:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous&lt;/wsa:Address&gt;&lt;/wsa:From&gt;
</soapenv:Header>
<soapenv:Body>
...
</soapenv:Body></soapenv:Envelope>

our wsit.xml looks like that:

<?xml version="1.0" encoding="UTF-8"?>
<definitions
xmlns="http://schemas.xmlsoap.org/wsdl/"
xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" name="WebServiceForTrustService" targetNamespace="http://wstrust/" xmlns:tns="http://wstrust/" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp1="http://www.w3.org/ns/ws-policy" xmlns:fi="http://java.sun.com/xml/ns/wsit/2006/09/policy/fastinfoset/service" xmlns:tcp="http://java.sun.com/xml/ns/wsit/2006/09/policy/soaptcp/service"
>

<message name="otaHotelResNotif"/>
<message name="otaHotelResNotifResponse"/>
<portType name="WebServiceForTrust">
<operation name="otaHotelResNotif">
<input message="tns:otaHotelResNotif"/>
<output message="tns:otaHotelResNotifResponse"/>
</operation>
</portType>
<binding name="WebServiceForTrustPortBinding" type="tns:WebServiceForTrust">
<wsp:PolicyReference URI="#WebServiceForTrustPortBindingPolicy"/>
<operation name="otaHotelResNotif">
<input/>
<output/>
</operation>
</binding>
<service name="WebServiceForTrustService">
<port name="WebServiceForTrustPort" binding="tns:WebServiceForTrustPortBinding"/>
</service>
<wsp:Policy wsu:Id="WebServiceForTrustPortBindingPolicy">
<wsp:ExactlyOne>
<wsp:All/>
</wsp:ExactlyOne>
</wsp:Policy>
</definitions>

Does anyone has any idea what configuration might be missing here?

We also realised that in the IDE after turning the security (AM security) on there was a file created under configuration files/ amserver called amconfig.xml.

This file we can't find on the webserver after deploying the service nor in the *.war nor under addons/amserver or so.

The file internally looks like:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ns2:AMConfig xmlns:ns2="http://identity.netbeans.org/access_manager_config_1_0"&gt;
<ProviderConfig type="WSP" name="WebServiceForTrustService">
<SecurityMechanism uri="urn:sun:wss:security:null:UserNameToken-Plain"/>
</ProviderConfig>
</ns2:AMConfig>

since the information is already in sun-web.xml which is published on the server I think that should not be the problem but might be helpful for you.

Any help appreciated. Thanks!

Answer 1

Guys,

since we worked further on the above here a few new things even if it isn't solved.

The example tutorial was rebuild and deployed on the test-server. Client and Server Test app. Both are working fine when started locally on the test-server.

If we configure how ever a client from remote to use the same web-service with the same security information, we find the same error like with our other application.

Therefore I assume it has something to do with the configurations o Access Manager, but no idea which one.

I hope that helps anyone to help me. Thanks!