WebService Authentication under JBoss

In my business project there is a need to check declarative security within EJB3 Session beans exposed as WebServices. The project is deployed under JBoss AS 4.0.5.GA with JBossWS 1.2.0.SP1. After brief investigation, a quick solution was found.

HTTP BASIC Auhtentication with EJB3 Endpoints

Axis client provides HTTP BASIC authentication when invoking web services (see previous article). So, it should be some way to enable it on server side.

For EJB web service endpoints, JBossWS generates and deploys web application, so Session Beans are mapped to Servlets.

Let's look at the example of SLSB exposed as WebService (class HelloIntf, containing missing here @WebService annotations, is generated from WSDL and not listed here):

@javax.ejb.Local(HelloIntf.class)
@javax.ejb.Stateless(name = "HelloPort")
@javax.jws.WebService(endpointInterface = "HelloIntf")
@TransactionManagement
@DeclareRoles({"foo","bar"})
// jboss specific
@org.jboss.ws.annotation.WebContext(
    contextRoot = "/services", 
    urlPattern = "/hello", 
    authMethod = "BASIC")
public class HelloBean implements HelloIntf {

    @javax.annotation.Resource
    private SessionContext ctx;

    @javax.annotation.security.RolesAllowed({"foo","bar"})
    public String sayHello() {
        return "Hello, " + ctx.getCallerPrincipal();
    }

}

Defined bean will be deployed as http://localhost:8080/services/hello.
Actually, JBossWS generates web.xml by processing annotations. In web.xml following code will be added:

<security-constraint>
 <web-resource-collection>
 <web-resource-name>HelloPort</web-resource-name>
 <url-pattern>/hello</url-pattern>
 <http-method>GET</http-method>
 <http-method>POST</http-method>
 </web-resource-collection>
 <auth-constraint>
 <role-name>*</role-name>
 </auth-constraint>
 </security-constraint>
 <login-config>
 <auth-method>BASIC</auth-method>
 <realm-name>EJBServiceEndpointServlet Realm</realm-name>
 </login-config>

Unfortunately, the realn name is predefined (hardcoded in JBossWS code) and can not be changed (in JBossWS 1.2.0.SP1), so, we may configure default application-policy called "other" in login-config.xml to meet our needs or to add new application-policy element with name="EJBServiceEndpointServlet Realm" (but the second solution does not works by unknown reason).

Configuring WS-Security for Axis 1.4 client

I was looking how to enable WS-Security features in the Axis client to my web service application. The article I found describes how to do this.

I have tested it with Axis 1.4 client.

The things you need to configure axis client are:

1. Copy wss4j.jar (rev. 1.5.1), opensaml-1.1.jar and xmlsec-20050514.jar (from the openSAML distribution) to classpath (WEB-INF/lib)
2. Add handler to client.wsdd:
   
<!-- Using the WSDoAllSender security handler in request flow -->
<deployment xmlns="http://xml.apache.org/axis/wsdd/" java="http://xml.apache.org/axis/wsdd/providers/java">
<transport name="http" pivot="java:org.apache.axis.transport.http.HTTPSender">
<globalconfiguration>
<requestflow>
<handler type="java:org.apache.ws.axis.security.WSDoAllSender">
<parameter name="action" value="UsernameToken">
<parameter name="passwordType" value="PasswordDigest">
<parameter name="mustUnderstand" value="false">
</handler>
</requestflow>
</globalconfiguration>
</transport>
</deployment>


You dont need to hardcode username and password as a handler parameters as described in the article. Just call setUsername(...) and setPassword(...) methods of your Stub.

JBoss Web Services 1.2.0 has been released

There are a lot of issues were closed, but there are still ones that annoys.
For example, abstract complexTypes are not supported: JBWS-1554.

Important note: when using wstools for wsdl2java generation, don't forget to change "file" attribute to "location" in wstools-config.xml. In other case, you'll see NPE while instatiating java.io.File