Showing posts with label WSAS. Show all posts
Showing posts with label WSAS. Show all posts
Security Policy with WSO2 WSAS - UsernameToken
From version 3.0 onwards, WSO2 WSAS is powered by Carbon.
This post takes you through all the steps required in setting up UsernameToken security policy with WSAS to secure a given service.
First you need to download WSAS 3.0 from here.
Log into WSO2 WSAS administration console with admin/admin
1. Go to Service --> List --> Select "HelloService" service --> Security --> setup security scenario "UsernameToken" on it.
2. Select 'admin' as the user group who has access to the service.
3. To view the applied policy, go to Service --> List --> Select "HelloService" service --> Policy
4. Select 'Edit Policy' against 'Binding HelloServiceSOAP11Binding'. You can modify the applied policy here.
5. Now - let's see how we can try this service having secured with UsernameToken.
6. Go to Service --> List and select 'Try this service' against 'HelloService'. Provide a username/password of a user belongs to the 'admin' role and try the service.
Secure Token Service with WSO2 WSAS 3.0
From version 3.0 onwards, WSO2 WSAS is powered by Carbon.
This post takes you through all the steps required in setting up the STS ships with WSAS to secure a given service.
First you need to download WSAS 3.0 from here.
WSAS distribution comes with an STS sample - and let's see how to set it up.
Go to [WSAS_HOME]/samples/sts-sample and type ant
Start WSO2 WSAS (If you haven't already started it)
Log into WSO2 WSAS administration console with admin/admin
Go to Service --> List --> Select "wso2carbon-sts" service --> Security --> setup security scenario "Sign and encrypt - X509 Authentication" on it.
Make sure wso2carbon.jks keystore (WSO2WSAS keystore) is used.
Go to Service --> List --> Select "HelloService" service and copy the http service address.
Once again select "wso2carbon-sts" service and navigate to "Configure STS". Paste/type the http endpoint address of "HelloService" service in "Add new trusted service"->"Endpoint Address". Select the WSO2WSAS private key's certificate alias (wso2carbon)
Go back to "HelloService" service and setup security scenario "SecureConversation - Sign and Encrypt - Service as STS - Bootstrap policy - Sign and Encrypt , X509 Authentication" on it.Makesure wso2carbon.jks keystore (WSO2WSAS keystore) is used.
Go to Key Stores --> Import Cert -- > Import [WSAS_HOME]/samples/sts-sample/conf/client.cert into the wso2carbon keystore.
Go to [WSAS_HOME]/samples/sts-sample and run the client.
run-client.bat <wso2carbon-sts-http-address> <hello-service-http-address>
Example :
run-client.bat http://10.100.1.97:9763/services/wso2carbon-sts http://10.100.1.97:9763/services/HelloService
Notes:
1. You need to download Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 5.0 from here and copy the two jar files from the extracted jce directory (local_policy.jar and US_export_policy.jar)to $JAVA_HOME/jre/lib/security.
2. Make sure
Enabling JMS transport for Axis2 services
WSO2 WSAS is an enterprise ready Web services engine powered by Apache Axis2.
It is a lightweight, high performing platform for Service Oriented Architectures, enabling business logic and applications. Bringing together a number of Apache Web services projects, WSO2 WSAS provides a secure, transactional and reliable runtime for deploying and managing Web services
Once you start WSAS with [WSAS_HOME]\bin\startup.bat and hit the url https://localhost:9443 you can login with admin/admin.
Click the menu item 'services' and you'll find the set of available services.
Click on the 'echo' service and then the 'Manage Transports' - you can find that only http and https transports are available.
Let's see how we can configure JMS for the 'echo' service.
You can find axis2.xml inside [WSAS_HOME]\conf - edit it to uncomment the following.
The above configuration defines three connection factories.
<transportReceiver name="jms" class="org.apache.axis2.transport.jms.JMSListener">
<parameter name="myTopicConnectionFactory">
<parameter name="java.naming.factory.initial">
org.apache.activemq.jndi.ActiveMQInitialContextFactory</parameter>
<parameter name="java.naming.provider.url">
tcp://localhost:61616</parameter>
<parameter name="transport.jms.ConnectionFactoryJNDIName">
TopicConnectionFactory</parameter>
</parameter>
<parameter name="myQueueConnectionFactory">
<parameter name="java.naming.factory.initial">
org.apache.activemq.jndi.ActiveMQInitialContextFactory</parameter>
<parameter name="java.naming.provider.url">
tcp://localhost:61616</parameter>
<parameter name="transport.jms.ConnectionFactoryJNDIName">
QueueConnectionFactory</parameter>
</parameter>
<parameter name="default">
<parameter name="java.naming.factory.initial">
org.apache.activemq.jndi.ActiveMQInitialContextFactory</parameter>
<parameter name="java.naming.provider.url">
tcp://localhost:61616</parameter>
<parameter name="transport.jms.ConnectionFactoryJNDIName">
QueueConnectionFactory</parameter>
</parameter>
</transportReceiver>
<transportSender name="jms"
class="org.apache.axis2.transport.jms.JMSSender"/>
The JMS transport receiver configuration allows you to define the default connection factory (named as "default") for use by Axis2 services using the JMS transport. This connection factory would be used by any service which does not explicitly specify a connection factory name in its services.xml.
In case your service needs a different connection factory,other than the 'default' one - that needs to be mentioned in the services.xml.
Now you need to run a message broker. You can download ActiveMQ 5.2 from here.
<parameter name="transport.jms.ConnectionFactory" locked="true">myTopicConnectionFactory</parameter>
Copy the file activemq-all-5.2.0.jar from [ACTIVEMQ_HOME] to [WSAS_HOME]\lib.
All set - now restart the WSAS.
If you view transports available for 'echo' service through WSAS admin console [as you did previously], you'll find JMS is now available.
Also in the 'echo' service page you may notice that there are three endpoints available under 'Endpoint References' - what we'll be using for the 'echo' service client is the 'jms' endpoint.
One thing to notice here is a service on an Axis2 instance is deployed on all started transports by default, unless a list of transports are specified in its services.xml.
In case your service only to be deployed on JMS, you should specify it in the services.xml
All set - let's move to the client.
<transports>
<transport>jms</transport>
</transports>
Make sure you have the actievemq-all-5.2.0.jar in the client classpath and jms transport being enabled in client.axis2.xml.
package org.apache.ws.axis2;
import javax.xml.namespace.QName;
import org.apache.axiom.om.OMAbstractFactory;
import org.apache.axiom.om.OMElement;
import org.apache.axiom.om.OMFactory;
import org.apache.axiom.om.OMNamespace;
import org.apache.axis2.AxisFault;
import org.apache.axis2.addressing.EndpointReference;
import org.apache.axis2.client.Options;
import org.apache.axis2.client.ServiceClient;
import org.apache.axis2.context.ConfigurationContext;
import org.apache.axis2.context.ConfigurationContextFactory;
public class Client {
/**
* @param args
* @throws AxisFault
*/
public static void main(String[] args) throws AxisFault {
ConfigurationContext context = null;
ServiceClient client = null;
Options options = null;
OMElement response = null;
context = ConfigurationContextFactory.createConfigurationContextFromFileSystem("repo",
"repo/conf/client.axis2.xml");
client = new ServiceClient(context, null);
options = new Options();
options.setAction("urn:echoString");
options
.setTo(new EndpointReference(
"jms:/echo?transport.jms.ConnectionFactoryJNDIName=QueueConnectionFactory"
+ "&java.naming.factory.initial=org.apache.activemq.jndi.ActiveMQInitialContextFactory"
+ "&java.naming.provider.url=tcp://localhost:61616"));
client.setOptions(options);
response = client.sendReceive(getPayload("hi"));
System.out.println(response.getFirstChildWithName(new QName("return")).getText());
}
private static OMElement getPayload(String value) {
OMFactory factory = null;
OMNamespace ns = null;
OMElement elem = null;
OMElement childElem = null;
factory = OMAbstractFactory.getOMFactory();
ns = factory.createOMNamespace("http://echo.services.wsas.wso2.org", "ns1");
elem = factory.createOMElement("echoString", ns);
childElem = factory.createOMElement("param0", null);
childElem.setText(value);
elem.addChild(childElem);
return elem;
}
}
AXIS2 session management - Transport Session
It is highly recommended that you go through this article on Axis2 Session Management written by Deepal.
Here I will take a practical scenario used by WSAS - in it's admin services.
WSO2 WSAS is an enterprise ready Web services engine powered by Apache Axis2. It is a lightweight, high performing platform for Service Oriented Architectures, enabling business logic and applications. Bringing together a number of Apache Web services projects, WSO2 WSAS provides a secure, transactional and reliable runtime for deploying and managing Web services.
You can learn more about WSAS admin services from my previous post.
This post uses following two admin services as illustrated by the diagram.
Let me briefly show how IS_AUTHENTICATED property being set in the ServiceGroupContext, which can be accessed by all the services belong to the same service group.
ServiceGroupContext groupCtx = MessageContext.getCurrentMessageContext().getServiceGroupContext(); groupCtx.setProperty(IS_AUTHENTICATED,true);Let's move to the client code - you need to login first and then access ServerAdmin.
final static String ADMIN_SERVICE = "https://localhost:9443/services/ServerAdmin";
final static String GLOBAL_SERVICE = "https://localhost:9443/services/GlobalAdmin";
public static void main(String[] args) throws Exception {
ConfigurationContext context = null;
OMElement response = null;
ServiceClient client = null;
boolean isLoggedIn = false;
String path = null;
path = System.getProperty("user.dir");
// You can copy wso2wsas.jks from [WSAS_HOME]\conf
System.setProperty("javax.net.ssl.trustStore", path + "/src/wso2wsas.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "wso2wsas");
// You can copy axis2.xml from [AXIS2_HOME]\conf
context = ConfigurationContextFactory.createConfigurationContextFromFileSystem("repo","repo/conf/axis2.xml");
client = new ServiceClient(context, null);
client.setOptions(getOptions("urn:login", GLOBAL_SERVICE));
response = client.sendReceive(getPayload("admin", "admin"));
isLoggedIn = Boolean.parseBoolean(response.getFirstChildWithName(new QName("return")).getText());
if (isLoggedIn) {
client.setOptions(getOptions("urn:getServerVersion", ADMIN_SERVICE));
response = client.sendReceive(getPayload());
System.out.println("Server version: " + response.getFirstChildWithName(new QName("return")).getText());
}
}
private static Options getOptions(String operation, String epr) {
Options options = null;
options = new Options();
options.setAction(operation);
options.setManageSession(true);
options.setTo(new EndpointReference(epr));
return options;
}
private static OMElement getPayload(String userName, String password) throws Exception {
String bodyXML = "<ns1:login xmlns:ns1=\"http://org.apache.axis2/xsd\">\n" + "<arg0>"
+ userName + "</arg0>\n" + "<arg1>" + password + "</arg1>\n"
+ "</ns1:login>\n";
return AXIOMUtil.stringToOM(bodyXML);
}
private static OMElement getPayload() throws Exception {
String bodyXML = "<ns1:getServerVersion xmlns:ns1=\"http://org.apache.axis2/xsd\"></ns1:getServerVersion>";
return AXIOMUtil.stringToOM(bodyXML);
}
You can find more details on Transport session handling from here.
WSAS hidden SERVICES
WSAS comes with a set of admin services which are hidden from the user - since they are used internally for WSAS administration.
This post takes you through WSAS admin services - if you are to interact with WSAS at an API level its better you understand those.
Following extracts show each service with it's correspondig functionality - later we'll see how we could invoke GlobalAdmin service.
<!-- https://localhost:9443/services/ServerAdmin?wsdl --> <wsdl:operation name="getServerStatus"> <wsdl:operation name="getServerVersion"> <wsdl:operation name="endMaintenance"> <wsdl:operation name="shutdownGracefully"> <wsdl:operation name="getServerData"> <wsdl:operation name="restart"> <wsdl:operation name="getServerDataAsString"> <wsdl:operation name="isAlive"> <wsdl:operation name="getStatus"> <wsdl:operation name="shutdown"> <wsdl:operation name="restartGracefully"> <wsdl:operation name="startMaintenance">
<!-- https://localhost:9443/services/LogViewAdmin?wsdl --> <wsdl:operation name="clearLogs"> <wsdl:operation name="getLogs"> <wsdl:operation name="searchLog"> <wsdl:operation name="getLogsForSingleLogLevel">
<!-- https://localhost:9443/services/LoggingAdmin?wsdl --> <wsdl:operation name="getAllLoggerData"> <wsdl:operation name="updateAllAppenderData"> <wsdl:operation name="updateSystemLog"> <wsdl:operation name="getAppenderData"> <wsdl:operation name="updateLoggerData"> <wsdl:operation name="restoreDefaults"> <wsdl:operation name="getLoggerData"> <wsdl:operation name="getSystemLog"> <wsdl:operation name="getStatus">
<!-- https://localhost:9443/services/UserAdmin?wsdl --> <wsdl:operation name="removeUser"> <wsdl:operation name="editUserPassword"> <wsdl:operation name="assignRoleToUser"> <wsdl:operation name="getRoleNamesAndDescriptions"> <wsdl:operation name="getRoleNames"> <wsdl:operation name="editUserRole"> <wsdl:operation name="getUsers"> <wsdl:operation name="deleteUser"> <wsdl:operation name="addAdmin"> <wsdl:operation name="editAdmin"> <wsdl:operation name="deleteRoleFromUser"> <wsdl:operation name="getUserRoles"> <wsdl:operation name="deleteRoleCompletely"> <wsdl:operation name="addUser"> <wsdl:operation name="addRole"> <wsdl:operation name="getUserNames"> <wsdl:operation name="changeUserPassword">
<!-- https://localhost:9443/services/GlobalAdmin?wsdl --> <wsdl:operation name="logout"> <wsdl:operation name="deployService"> <wsdl:operation name="isServerRegistered"> <wsdl:operation name="serverRegistered"> <wsdl:operation name="setPolicy"> <wsdl:operation name="deployModule"> <wsdl:operation name="ping"> <wsdl:operation name="login"> <wsdl:operation name="restoreDefaults"> <wsdl:operation name="listGlobalPhases"> <wsdl:operation name="listGlobalPhaseHandlers"> <wsdl:operation name="getDeclaredSystemParameters"> <wsdl:operation name="getPolicy"> <wsdl:operation name="setSystemParameter">
<!-- https://localhost:9443/services/ServiceGroupAdmin?wsdl --> <wsdl:operation name="setServiceGroupParameter"> <wsdl:operation name="dumpAAR"> <wsdl:operation name="setPolicy"> <wsdl:operation name="listServiceGroup"> <wsdl:operation name="deleteServiceGroup"> <wsdl:operation name="setServiceGroupParameters"> <wsdl:operation name="getDeclaredServiceGroupParameters"> <wsdl:operation name="removeServiceGroupParameter"> <wsdl:operation name="getServiceGroupParameters"> <wsdl:operation name="configureMTOM"> <wsdl:operation name="removeServiceGroup"> <wsdl:operation name="getPolicy"> <wsdl:operation name="listServiceGroups">
<!-- https://localhost:9443/services/ServiceAdmin?wsdl --> <wsdl:operation name="getNumberOfInactiveServices"> <wsdl:operation name="creatService"> <wsdl:operation name="getServiceInfo"> <wsdl:operation name="getDeclaredServiceParameters"> <wsdl:operation name="createAndDeploySpringBean"> <wsdl:operation name="removeSoap12BindingPolicy"> <wsdl:operation name="getServiceStatus"> <wsdl:operation name="removeServiceSpecificParameter"> <wsdl:operation name="createAndDeployEJBService"> <wsdl:operation name="setServiceParameter2"> <wsdl:operation name="getNumberOfActiveServices"> <wsdl:operation name="setSoap12BindingPolicy"> <wsdl:operation name="setHttpBindingPolicy"> <wsdl:operation name="setPolicy"> <wsdl:operation name="addTransportBinding"> <wsdl:operation name="listMethodsForClass"> <wsdl:operation name="setSoap11BindingPolicy"> <wsdl:operation name="exposeServiceOnlyViaTransports"> <wsdl:operation name="setServiceParameter3"> <wsdl:operation name="setServiceParameter"> <wsdl:operation name="getSchema"> <wsdl:operation name="getPolicies"> <wsdl:operation name="setServiceParameters"> <wsdl:operation name="getServiceUsers"> <wsdl:operation name="getServiceParameters"> <wsdl:operation name="getNumberOfFaultyServices"> <wsdl:operation name="getClassNames"> <wsdl:operation name="deleteFaultyServiceArchive"> <wsdl:operation name="getServiceUsersWithDescription"> <wsdl:operation name="getFaultyServiceArchives"> <wsdl:operation name="configureMTOM"> <wsdl:operation name="removeHttpBindingPolicy"> <wsdl:operation name="getSpringBeanNames"> <wsdl:operation name="getExposedTransports"> <wsdl:operation name="removeTransportBinding"> <wsdl:operation name="removePolicy"> <wsdl:operation name="getServiceRolesWithDescription"> <wsdl:operation name="stopService"> <wsdl:operation name="startService"> <wsdl:operation name="listServices"> <wsdl:operation name="removeSoap11BindingPolicy"> <wsdl:operation name="getServiceData"> <wsdl:operation name="removeServiceParameter"> <wsdl:operation name="getWSDL"> <wsdl:operation name="getPolicy"> <wsdl:operation name="createAndDeployService">You can find rest of the services from following available end points.
https://localhost:9443/services/GeneralServices?wsdl https://localhost:9443/services/STSAdmin?wsdl https://localhost:9443/services/Sandesha2Admin?wsdl https://localhost:9443/services/EJBProviderAdmin?wsdl https://localhost:9443/services/DataServiceAdmin?wsdl https://localhost:9443/services/SecurityScenarioConfigAdmin?wsdl https://localhost:9443/services/AxisConfigAdmin?wsdl https://localhost:9443/services/CryptoAdmin?wsdl https://localhost:9443/services/TransportAdmin?wsdl https://localhost:9443/services/LoggingService?wsdl https://localhost:9443/services/ModuleAdmin?wsdl https://localhost:9443/services/OperationAdmin?wsdlNow lets try to login to WSAS through GlobalAdmin service.
final static String GLOBAL_SERVICE = "https://localhost:9443/services/GlobalAdmin";
GlobalAdminStub globalAdmin = null;
String path = null;
Options options = null;
try {
path = System.getProperty("user.dir");
// You can copy wso2wsas.jks from [WSAS_HOME]\conf
System.setProperty("javax.net.ssl.trustStore", path + "/src/wso2wsas.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "wso2wsas");
globalAdmin = new GlobalAdminStub(GLOBAL_SERVICE);
options = globalAdmin._getServiceClient().getOptions();
options.setManageSession(true);
// Login first
if (globalAdmin.login("admin", "admin")) {
globalAdmin.isServerRegistered();
}
} catch (Exception e) {
e.printStackTrace();
}
Exporting keystore private key with WSAS
Following is an alternative way you can do it with WSAS.
First download WSAS from here.
Now, we need to create a keystore.
keytool -genkey -alias rpcert -keyalg RSA -keysize 1024 -dname "CN=identity-rp,L=SL,S=WS,C=LK" -keypass wso2key -keystore rpkeystore.jks -storepass wso2key
The above will create a keystore with the name rpkeystore.jks having wso2key as the keystore password and wso2key as the private key password.
Now, lets see how we can export our private key from the keystore just created, with WSAS.
1. Start WSAS and type https://localhost:9443 on your brower and sigin with admin/admin [user/password].
[WSAS_HOME]\bin\wso2wsas.bat
2. View available keystores
3. Upload your keystore [just created] - keystore password : wso2key
4. Private key password: wso2key
5. Click to finish
6. Click on the keystore rpkeystore.jks
7. Copy and paste your private key to a new file called server.key and that is your exported private key from the keystore.
Subscribe to:
Posts (Atom)