Use of Spring Security with Sun's XWSS implementation

[Farrukh Najmi]

Hello,

I would like to use Spring Security with my server that was generated
WSDL-first using the metro stack's JAX-WS and JAXB RIs.
I notice that XWSS supports certain types of Authentication Tokens. I
would like to use XWSS with the tokens defined by Spring Security.

I know it is possible to do this because Spring WS uses Sun's XWSS for
WSS support using Spring Security.

Can any one tell me how this is done?

Thanks.

--
Regards,
Farrukh Najmi

Web: http://www.wellfleetsoftware.com



---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Glen Mazza]

Farrukh Najmi wrote:

I know it is possible to do this because Spring WS uses Sun's XWSS for
WSS support using Spring Security.

Have you looked at the Spring WS source code for your answer?

[Fabian Ritzmann-3]

On 22. Sep 2008, at 23:38, Farrukh Najmi wrote:

> I would like to use Spring Security with my server that was  
> generated WSDL-first using the metro stack's JAX-WS and JAXB RIs.
> I notice that XWSS supports certain types of Authentication Tokens.  
> I would like to use XWSS with the tokens defined by Spring Security.
>
> I know it is possible to do this because Spring WS uses Sun's XWSS  
> for WSS support using Spring Security.
>
> Can any one tell me how this is done?

For future reference, this should have most of the answers:
https://metro.dev.java.net/guide/Using_WSIT_Functionality_With_Spring.html

Fabian

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Farrukh Najmi]

<background>
Recall I wanted to know how to use XWSS with spring security. With much
help from Fabian Ritzmann I was able to successfully develop a prototype
with WSIT that Spring Security and XWSS. WSIT looks great and it handles
the securing of SOAP communication between my client and web service
using WS-Policy esxtension elements added to the WSDL.

Lessons learned...

Policy authoring is complex and NetBeans has nice wizards to do that as
decribed in the excellent WSIT tutorial:

https://metro.dev.java.net/guide/index.html#wsit_tutorial

Problem is that NetBeans wizards are only accessible if one uses ant
based projects templates to start with. It does not work with maven :-(
which is what we use (and more and more projects do as well now).

<aside>
This is a serious issue for die-hard NetBeans fans like me. NB team
please do something soon to fix this.
</aside?

So we created a prototype project using NetBeans and generated our
policy extensions to WSDL.

We would now like to apply WSIT policy based XWSS support to our actual
maven and Tomcat 6 based project and that is what the main topic of this
post is after this background

</background>

WSIT tutorial instructs us to use packages jars for WSIT and provides
ant script to copy them to Tomcat 6. These jars bundle together all
apis, impls and dependencies etc. (JAX-WS, JAXB, SAAJ, ....) into a few
jars.

We cannot use that as in maven all jars dependencies need to be
fine-grained (no bundling of multiple projects) and explicitly declared
(with specific versions) in the pom.

What I am looking for is if someone has done this and has the list of
pom dependencies that I can use in my maven project for WSIT support.
Note I already depend on latest released JAX-WS, JAXB, SAAJ and their
dependencies.

Thanks again to Fabian for his help. TIA for helping me through this
next hurdle.

Glen Mazza wrote:
> Farrukh Najmi wrote:
>  
>> I know it is possible to do this because Spring WS uses Sun's XWSS for
>> WSS support using Spring Security.
>>
>>    
>
> Have you looked at the Spring WS source code for your answer?
>  


--
Regards,
Farrukh Najmi

Web: http://www.wellfleetsoftware.com



---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Fabian Ritzmann-3]

On 26. Sep 2008, at 17:12, Farrukh Najmi wrote:

> WSIT tutorial instructs us to use packages jars for WSIT and  
> provides ant script to copy them to Tomcat 6. These jars bundle  
> together all apis, impls and dependencies etc. (JAX-WS, JAXB,  
> SAAJ, ....) into a few jars.
>
> We cannot use that as in maven all jars dependencies need to be fine-
> grained (no bundling of multiple projects) and explicitly declared  
> (with specific versions) in the pom.

This may not be quite what you are looking for but are you aware that  
Metro is (unofficially) available through the java.net Maven 2  
repository?

See here:

http://download.java.net/maven/2/com/sun/xml/ws/webservices-rt/
http://download.java.net/maven/2/com/sun/tools/ws/webservices-tools/

Fabian

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Farrukh Najmi]

Fabian Ritzmann wrote:

> On 26. Sep 2008, at 17:12, Farrukh Najmi wrote:
>
>> WSIT tutorial instructs us to use packages jars for WSIT and provides
>> ant script to copy them to Tomcat 6. These jars bundle together all
>> apis, impls and dependencies etc. (JAX-WS, JAXB, SAAJ, ....) into a
>> few jars.
>>
>> We cannot use that as in maven all jars dependencies need to be
>> fine-grained (no bundling of multiple projects) and explicitly
>> declared (with specific versions) in the pom.
>
> This may not be quite what you are looking for but are you aware that
> Metro is (unofficially) available through the java.net Maven 2
> repository?
>
> See here:
>
> http://download.java.net/maven/2/com/sun/xml/ws/webservices-rt/
> http://download.java.net/maven/2/com/sun/tools/ws/webservices-tools/

Actually what I am looking for the the precise set of jar dependencies
for WSIT where JAX-WS, JAXB, SAAJ api and ri all have separate jars
available via maven. Is this not possible? If possible where can I find
the list of dependencies? First step would be to identify precise
versions of what jars are direct dependencies for WSIT functionality?
Next step is to figure out what versions of each jar (latest released
versions that are compatible with each other). Can you help provide some
of these details?

--
Regards,
Farrukh Najmi

Web: http://www.wellfleetsoftware.com



---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Fabian Ritzmann-3]

On 29. Sep 2008, at 15:45, Farrukh Najmi wrote:

> Fabian Ritzmann wrote:
>> On 26. Sep 2008, at 17:12, Farrukh Najmi wrote:
>>
>>> WSIT tutorial instructs us to use packages jars for WSIT and  
>>> provides ant script to copy them to Tomcat 6. These jars bundle  
>>> together all apis, impls and dependencies etc. (JAX-WS, JAXB,  
>>> SAAJ, ....) into a few jars.
>>>
>>> We cannot use that as in maven all jars dependencies need to be  
>>> fine-grained (no bundling of multiple projects) and explicitly  
>>> declared (with specific versions) in the pom.
>>
>> This may not be quite what you are looking for but are you aware  
>> that Metro is (unofficially) available through the java.net Maven 2  
>> repository?
>>
>> See here:
>>
>> http://download.java.net/maven/2/com/sun/xml/ws/webservices-rt/
>> http://download.java.net/maven/2/com/sun/tools/ws/webservices-tools/
>
> Actually what I am looking for the the precise set of jar  
> dependencies for WSIT where JAX-WS, JAXB, SAAJ api and ri all have  
> separate jars available via maven. Is this not possible? If possible  
> where can I find the list of dependencies? First step would be to  
> identify precise versions of what jars are direct dependencies for  
> WSIT functionality?

I am assuming you are looking only for the runtime dependencies not  
compile time? The jars in wsit/lib/runtime go into webservices-rt.jar  
and some into webservices-api.jar, webservices-extra.jar and  
webservices-extra-api.jar. The jars in wsit/lib/tooltime go into  
webservices-tools.jar and some into webservices-api.jar. webservices-
extra.jar and webservices-extra-api.jar contain libraries that are  
already provided by GlassFish and partially by Tomcat.

> Next step is to figure out what versions of each jar (latest  
> released versions that are compatible with each other).

Most of the libraries have manifests with the version number. Note  
that not all libraries are available through Maven AFAICT.

Fabian

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Farrukh Najmi]

Fabian Ritzmann wrote:

> On 29. Sep 2008, at 15:45, Farrukh Najmi wrote:
>> Fabian Ritzmann wrote:
>>> On 26. Sep 2008, at 17:12, Farrukh Najmi wrote:
>>>
>>>> WSIT tutorial instructs us to use packages jars for WSIT and
>>>> provides ant script to copy them to Tomcat 6. These jars bundle
>>>> together all apis, impls and dependencies etc. (JAX-WS, JAXB, SAAJ,
>>>> ....) into a few jars.
>>>>
>>>> We cannot use that as in maven all jars dependencies need to be
>>>> fine-grained (no bundling of multiple projects) and explicitly
>>>> declared (with specific versions) in the pom.
>>>
>>> This may not be quite what you are looking for but are you aware
>>> that Metro is (unofficially) available through the java.net Maven 2
>>> repository?
>>>
>>> See here:
>>>
>>> http://download.java.net/maven/2/com/sun/xml/ws/webservices-rt/
>>> http://download.java.net/maven/2/com/sun/tools/ws/webservices-tools/
>>
>> Actually what I am looking for the the precise set of jar
>> dependencies for WSIT where JAX-WS, JAXB, SAAJ api and ri all have
>> separate jars available via maven. Is this not possible? If possible
>> where can I find the list of dependencies? First step would be to
>> identify precise versions of what jars are direct dependencies for
>> WSIT functionality?
>
> I am assuming you are looking only for the runtime dependencies not
> compile time? The jars in wsit/lib/runtime go into webservices-rt.jar
> and some into webservices-api.jar, webservices-extra.jar and
> webservices-extra-api.jar. The jars in wsit/lib/tooltime go into
> webservices-tools.jar and some into webservices-api.jar.
> webservices-extra.jar and webservices-extra-api.jar contain libraries
> that are already provided by GlassFish and partially by Tomcat.
>
>> Next step is to figure out what versions of each jar (latest released
>> versions that are compatible with each other).
>
> Most of the libraries have manifests with the version number. Note
> that not all libraries are available through Maven AFAICT.

Said another way. What I am looking for is the set of dependencies to
include in a maven pom file for my client and server maven modules.
Here is what I have right now for the module that generates JAX-WS/JAXB
bindings for my server:

        <dependencies>
          <dependency>
            <groupId>com.sun.xml.ws</groupId>
            <artifactId>jaxws-tools</artifactId>
            <version>2.1.4</version>
          </dependency>
          <dependency>
            <groupId>com.sun.xml.ws</groupId>
            <artifactId>jaxws-rt</artifactId>
            <version>2.1.4</version>
          </dependency>
          <dependency>
            <groupId>com.sun.xml.bind</groupId>
            <artifactId>jaxb-xjc</artifactId>
            <version>2.1.7</version>
          </dependency>
          <dependency>
            <groupId>com.sun.xml.bind</groupId>
            <artifactId>jaxb-impl</artifactId>
            <version>2.1.7</version>
          </dependency>
        </dependencies>


I need to know what other jars I need to include similarly for WSIT
functionality. If some jars are not available via maven then can I
request that they be made available via maven. Which jars are they?
Based on past experience with similar requests I suspect it is not too
much effort to meet that request and make the maven folks very happy.

I would like to avoid the mega jars such as webservices-rt.jar,
webservices-api.jar, webservices-extra.jar and webservices-extra-api.jar
because they bundle classes from multiple distinct projects. Is this
possible?

TIA for your help.

--
Regards,
Farrukh Najmi

Web: http://www.wellfleetsoftware.com



---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Fabian Ritzmann-3]

On 29. Sep 2008, at 20:16, Farrukh Najmi wrote:

>
> Said another way. What I am looking for is the set of dependencies  
> to include in a maven pom file for my client and server maven modules.
> Here is what I have right now for the module that generates JAX-WS/
> JAXB bindings for my server:
>
>       <dependencies>
>         <dependency>
>           <groupId>com.sun.xml.ws</groupId>
>           <artifactId>jaxws-tools</artifactId>
>           <version>2.1.4</version>
>         </dependency>
>         <dependency>
>           <groupId>com.sun.xml.ws</groupId>
>           <artifactId>jaxws-rt</artifactId>
>           <version>2.1.4</version>
>         </dependency>
>         <dependency>
>           <groupId>com.sun.xml.bind</groupId>
>           <artifactId>jaxb-xjc</artifactId>
>           <version>2.1.7</version>
>         </dependency>
>         <dependency>
>           <groupId>com.sun.xml.bind</groupId>
>           <artifactId>jaxb-impl</artifactId>
>           <version>2.1.7</version>
>         </dependency>
>       </dependencies>
>
>
> I need to know what other jars I need to include similarly for WSIT  
> functionality. If some jars are not available via maven then can I  
> request that they be made available via maven. Which jars are they?

I don't know. FastInfoset is the one I am aware of because I  
explicitly checked it before I wrote the initial response. This looks  
like considerable work and somebody from the community would need to  
step up and do it.

> Based on past experience with similar requests I suspect it is not  
> too much effort to meet that request and make the maven folks very  
> happy.

I don't think we have such a list. What we do have you can find in  
wsit/etc/maven but that is not going to be much help. I'd be happy to  
put a POM into CVS if you come up with one.

> I would like to avoid the mega jars such as webservices-rt.jar,  
> webservices-api.jar, webservices-extra.jar and webservices-extra-
> api.jar because they bundle classes from multiple distinct projects.  
> Is this possible?

 From a Maven user's perspective, these large jars do not make much  
sense. From a non-Maven user's perspective, they are a relief because  
you don't have to manually juggle dozens of dependencies. It would be  
too much work for us if we had to maintain both.

Fabian

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Fabian Ritzmann-3]

Hi,

JAX-WS has a number of POMs that you might be able to use. WSIT  
doesn't really add that many dependencies. XWSS and FastInfoset are  
the ones I can think of from the top of my head. You can find the POMs  
in CVS:

CVSROOT    = :pserver:javanetuserid@...:/cvs
Repository = jax-ws-sources/repo

Fabian


On 30. Sep 2008, at 12:17, Fabian Ritzmann wrote:

> On 29. Sep 2008, at 20:16, Farrukh Najmi wrote:
>>
>> Said another way. What I am looking for is the set of dependencies  
>> to include in a maven pom file for my client and server maven  
>> modules.
>> Here is what I have right now for the module that generates JAX-WS/
>> JAXB bindings for my server:
>>
>>      <dependencies>
>>        <dependency>
>>          <groupId>com.sun.xml.ws</groupId>
>>          <artifactId>jaxws-tools</artifactId>
>>          <version>2.1.4</version>
>>        </dependency>
>>        <dependency>
>>          <groupId>com.sun.xml.ws</groupId>
>>          <artifactId>jaxws-rt</artifactId>
>>          <version>2.1.4</version>
>>        </dependency>
>>        <dependency>
>>          <groupId>com.sun.xml.bind</groupId>
>>          <artifactId>jaxb-xjc</artifactId>
>>          <version>2.1.7</version>
>>        </dependency>
>>        <dependency>
>>          <groupId>com.sun.xml.bind</groupId>
>>          <artifactId>jaxb-impl</artifactId>
>>          <version>2.1.7</version>
>>        </dependency>
>>      </dependencies>
>>
>>
>> I need to know what other jars I need to include similarly for WSIT  
>> functionality. If some jars are not available via maven then can I  
>> request that they be made available via maven. Which jars are they?
>
> I don't know. FastInfoset is the one I am aware of because I  
> explicitly checked it before I wrote the initial response. This  
> looks like considerable work and somebody from the community would  
> need to step up and do it.
>
>> Based on past experience with similar requests I suspect it is not  
>> too much effort to meet that request and make the maven folks very  
>> happy.
>
> I don't think we have such a list. What we do have you can find in  
> wsit/etc/maven but that is not going to be much help. I'd be happy  
> to put a POM into CVS if you come up with one.
>
>> I would like to avoid the mega jars such as webservices-rt.jar,  
>> webservices-api.jar, webservices-extra.jar and webservices-extra-
>> api.jar because they bundle classes from multiple distinct  
>> projects. Is this possible?
>
> From a Maven user's perspective, these large jars do not make much  
> sense. From a non-Maven user's perspective, they are a relief  
> because you don't have to manually juggle dozens of dependencies. It  
> would be too much work for us if we had to maintain both.
>
> Fabian

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Farrukh Najmi]

Hi Fabian,

I am now trying a different tactic. I am not including JAX-WS, JAXB jars
and their dependencies in my server module.
Instead I am relying on the wsit jars to be present on the Tomcat
server's /apache-tomcat-6.0.16/shared/lib directory.

I have a standalone Netbeans Web Service project where I have defined
security policies using WSIT tutorial.
I now need to know the process of how I can leverage my security
policies from the sample project into my actual
maven server project. Do I simply copy the WS-Policy XML into my source
WSDL or do I do something else.

Please advice steps on what I need to do to get my actual server and
client projects to leverage the policyes from my sample project and be
able to use WSS security.

Thank for you help.

Fabian Ritzmann wrote:

> Hi,
>
> JAX-WS has a number of POMs that you might be able to use. WSIT
> doesn't really add that many dependencies. XWSS and FastInfoset are
> the ones I can think of from the top of my head. You can find the POMs
> in CVS:
>
> CVSROOT    = :pserver:javanetuserid@...:/cvs
> Repository = jax-ws-sources/repo
>
> Fabian
>
>
> On 30. Sep 2008, at 12:17, Fabian Ritzmann wrote:
>
>> On 29. Sep 2008, at 20:16, Farrukh Najmi wrote:
>>>
>>> Said another way. What I am looking for is the set of dependencies
>>> to include in a maven pom file for my client and server maven modules.
>>> Here is what I have right now for the module that generates
>>> JAX-WS/JAXB bindings for my server:
>>>
>>>      <dependencies>
>>>        <dependency>
>>>          <groupId>com.sun.xml.ws</groupId>
>>>          <artifactId>jaxws-tools</artifactId>
>>>          <version>2.1.4</version>
>>>        </dependency>
>>>        <dependency>
>>>          <groupId>com.sun.xml.ws</groupId>
>>>          <artifactId>jaxws-rt</artifactId>
>>>          <version>2.1.4</version>
>>>        </dependency>
>>>        <dependency>
>>>          <groupId>com.sun.xml.bind</groupId>
>>>          <artifactId>jaxb-xjc</artifactId>
>>>          <version>2.1.7</version>
>>>        </dependency>
>>>        <dependency>
>>>          <groupId>com.sun.xml.bind</groupId>
>>>          <artifactId>jaxb-impl</artifactId>
>>>          <version>2.1.7</version>
>>>        </dependency>
>>>      </dependencies>
>>>
>>>
>>> I need to know what other jars I need to include similarly for WSIT
>>> functionality. If some jars are not available via maven then can I
>>> request that they be made available via maven. Which jars are they?
>>
>> I don't know. FastInfoset is the one I am aware of because I
>> explicitly checked it before I wrote the initial response. This looks
>> like considerable work and somebody from the community would need to
>> step up and do it.
>>
>>> Based on past experience with similar requests I suspect it is not
>>> too much effort to meet that request and make the maven folks very
>>> happy.
>>
>> I don't think we have such a list. What we do have you can find in
>> wsit/etc/maven but that is not going to be much help. I'd be happy to
>> put a POM into CVS if you come up with one.
>>
>>> I would like to avoid the mega jars such as webservices-rt.jar,
>>> webservices-api.jar, webservices-extra.jar and
>>> webservices-extra-api.jar because they bundle classes from multiple
>>> distinct projects. Is this possible?
>>
>> From a Maven user's perspective, these large jars do not make much
>> sense. From a non-Maven user's perspective, they are a relief because
>> you don't have to manually juggle dozens of dependencies. It would be
>> too much work for us if we had to maintain both.
>>
>> Fabian
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@...
> For additional commands, e-mail: users-help@...
>

--
Regards,
Farrukh Najmi

Web: http://www.wellfleetsoftware.com



---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Fabian Ritzmann-3]

On 30. Sep 2008, at 19:08, Farrukh Najmi wrote:

> I am now trying a different tactic. I am not including JAX-WS, JAXB  
> jars and their dependencies in my server module.
> Instead I am relying on the wsit jars to be present on the Tomcat  
> server's /apache-tomcat-6.0.16/shared/lib directory.

Smart choice. :-)

> I have a standalone Netbeans Web Service project where I have  
> defined security policies using WSIT tutorial.
> I now need to know the process of how I can leverage my security  
> policies from the sample project into my actual
> maven server project. Do I simply copy the WS-Policy XML into my  
> source WSDL or do I do something else.

That should be it if you bundle your WSDL with the service. Keep in  
mind that the clients might have to be configured as well if they need  
to authenticate with e.g. a password.

The WSIT tutorial starts from Java, right? You could also create a web  
service from WSDL in NetBeans and then apply the same security  
settings. NetBeans will write the security policies directly into your  
WSDL. Then you can copy the WSDL into your Maven project.

Fabian

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...