Sending binary data through web service and using WS-Security

views:

968

answers:

Sending binary data through web service and using WS-Security

Hi,

We have to transfer binary data using web service stack and in the process we have to sign web service requests/responses.

The main question is: what is the prefered way to do this?

Should we use MTOM and WS-Security? From ISSUE CXF-1904 I have concluded that there are issues when one uses MTOM and WS-Security. CXF and axis2 use WSS4J and it seems that WSS4J does not work well with digitally signed messages when you use MTOM.

What about other web service stacks?

+1 A:

Simply send the data as a byte[]. If there is a large amount of data, then WCF does support MTOM.

Under no circumstances should you use WSE. WSE is based on top of ASMX web services. Microsoft has stated that ASMX technology is "legacy", and that they will not be fixing bugs in it. Even worse, WSE is quite obsolete, and has been replaced by WCF.

John Saunders 2009-08-12 09:23:44

Yes, I'm aware of WCF and WSE. I'm asking for advices on web service design: what standards should be picked, and do they really work.To give a perspective: I work for an IBM Java shop, so MS .NET is considered for interoperability, not for implementation.The problem is more related to serialization of binary data and digital signature:MTOM is preffered way to serialize binary data. And WS-Security specifies how to sign SOAP messages. But there are more questions:Does MTOM work with digital signature? Is it really standardized? Are there examples?

ILX 2009-08-12 10:42:40

Thanks for clarifying. You should edit your question to include this information.

John Saunders 2009-08-12 10:44:15

Also, you may not have noticed, but there was an earlier answer that suggested you use WSE. That's why I mentioned that you should not, ever. Also, BTW, I would not consider WSE in interoperability testing.

John Saunders 2009-08-12 10:45:21

Thanks for the answer! It may help somebody from .NET world. You're right: I haven't noticed earlier answer.

ILX 2009-08-12 10:50:33

No problem. The earlier answer was deleted by the answerer.

John Saunders 2009-08-12 11:41:38

I would recommend the use of Spring-WS over the Apache CXF API, it's considerably lighter, better-documented and easier to use. However, Spring-WS is not JAX-WS compliant (this is no bad thing, in my opinion, but you may think different).

Spring-WS is just a light, Spring-friendly wrapper around an underlying SOAP implementation, and should work on top of Sun JAX-WS or Apache CXF, although I'd recommend using Sun's implementation. It also has full MTOM and WS-Security support (via Apache WSS4J).

skaffman 2009-08-12 11:06:56

Hi!Do you know if spring-WS can send digitally sing message and send parts of the signed message body as attachments?

ILX 2009-08-12 12:29:53

If WSS4J can do it, then yes, since that's what Spring-WS uses.

skaffman 2009-08-12 12:56:19

CXF can do WS-Security related things along with MTOM, but the attachments do not end up signed or encrypted. The SOAP message itself is signed/encrypted, but the attachments are not due to restrictions in WSS4J. (If SpringWS uses WSS4J, it would have the same restrictions)

Be default for security reasons when using the WSS4JOutInterceptor with CXF, we turn off MTOM to make sure they get inlined and then signed/encrypted. That's a security choice. The WSS4JOutInterceptor DOES have a flag (out.setAllowMTOM(true)) which would allow the MTOM to remain as attachments, but keep in mind, those attachments would not be "secured".

Daniel Kulp 2009-08-12 13:52:49

Thank you for your answer.

ILX 2009-08-13 21:06:45

ansaurus

tags:

views:

answers:

Sending binary data through web service and using WS-Security

related questions