Securing Web Services Using the SAML or UserNameToken Profiles

This tutorial illustrates how you can enable SAML-based and UserNameToken-based authentication between a web service client and a web service provider using the bundled Access Manager along with the integrated support for the WS-Security standard in Application Server's web services client and server-side containers.

Contents

To follow this tutorial, you need the following software and resources.

The Java EE and Tools distribution of the Java Application Server SDK includes NetBeans IDE.

Installing the Sun Java System Access Manager

If you have already installed and configured the Access Manager in the past, please check your userdir and if it exists, delete the file

[Your_Userdir]/AccessManager/AMConfig_opt_SUNWappserver_domains)domain1_applications_j2ee-modules_amserver_

before you begin a fresh installation.

To install the Sun Java System Access Manager, you must first esnure that you have installed the full NetBeans IDE. Next,

Verifying the Configuration of the Access Manager Installation

You need to configure the Access Manager to run properly. It is configured by default when you first start the Glassfish Server you obtained from the SDK, but you can reconfigure it later, if needed. For further information, check the [your_SDKGlassfish_location]/addons/README.html file.

Configuring the Tutorial Environment

Creating the Tutorial Projects

The two tutorial projects are StockQuoteService and StockQuoteClient.

To create the StockQuoteService project:

To create the StockQuoteClient project:

If you have installed NetBeans IDE with the bundled GlassFish v2 server, it is now selected as the default server for both sample projects. You need to select the Java EE SDK Glassfish instead.

To change the project servers to Java EE SDK Glassfish:

Securing Web Services: Using the SAML-HolderOfKey Security Mechanism

In this scenario, we are using the SAML-HolderOfKey security profile without the response being signed but using the default key store. To do this, we will first edit the token profile for the Access Manager and then configure the web service provider and client.

To edit the SAML-HolderOfKey profile:

In the Runtime window, expand the Sun Java System Access Managers node, then expand the Profiles nodes. Select the SAML-HolderOfKey node Right-click and choose Edit. The Edit SAML-HolderOfKey Profile dialog box opens.
Clear the Sign Response checkbox. Locate Existing Certificate Settings, and confirm the Use Default Key Store checkbox selected. Click OK.

To configure the web service provider:

In the Projects window,expand the StockQuoteService project node and the Web Services node. Within the Web Services, right-click the StockService node and select Edit Web Service Attributes from the pop-up menu. The StockService window opens with the AM Security tab selected.
Select the Enable Message Level Security checkbox. From the Request drop-down list, select the SAML-HolderOfKey security mechanism. Click OK.

To configure the web service client:

In the Projects window, expand the StockQuoteClient node and the Web Service References node. Locate the Web Service References node, right-click the StockService node and choose Edit Web Service Attributes from the pop-up menu.
The Web Service Client Security Configuration dialog box opens.
Select the Enable Message Level Security checkbox. From the Request drop-down list, select the SAML-HolderOfKey mechanism. Locate Existing Certificate Settings. Confirm that the Use Default Key Store checkbox is selected. Click OK.

If error icons appear in the Web Services References fo StockQuoteClient, deploy the StockQuoteService project (right-click the service project node and select Undeploy and Deploy) and refresh the client (right-click the web service reference node and select Refresh Client).

You can now proceed to deploying and running the sample by following the instructions in Deploying and Running the Project.

Securing Web Services: Using the UserNameToken Security Mechanism

In this scenario, you use the UserNameToken security profile with signed response and use the default key store. To do this, you first edit the token profile for the Access Manager and then configure the web service provider and client.

To edit the UserNameToken profile:

In the Runtime window, expand the Sun Java System Access Managers node, then expand the Profiles nodes. Select the UserNameToken node, then right-click and choose Edit. The Edit UserNameToken Profile dialog box opens.
Select Use Default Key Store. Locate Username Token Profile Info. Click the Add button to add a UserNameToken record for the web service client.
The Add User dialog box opens. In the Username field, type sherry. In the Password field, type mypw, and click OK. Click OK to close the Edit UserNameToken Profile dialog box.

To configure the web service provider:

In the Projects window, expand the StockQuoteService node and the Web Services node. Within the Web Services, right-click the StockService node and select Edit Web Service Attributes from the pop-up menu. The StockService window opens with the AM Security tab selected.
Select the Enable Message Level Security checkbox. From the Request drop-down list, select the UserNameToken security mechanism.
Click OK.

To configure the web service client:

In the Projects window, expand the StockClient node. Within the StockClient project, expand the Web Service References node. Right-click the StockService node and choose Edit Web Service Attributes from the pop-up menu. The Web Service Client Security Configuration dialog box opens.
Select the Enable Message Level Security checkbox. From the Request drop-down list, select the UserNameToken security mechanism. In the Username field, type sherry and in the Password field, type mypw. Select Use Default Key Store. Click OK.

You can now proceed to deploying and running the sample by following the instructions in Deploying and Running the Project.

Deploying and Running the Project

In the Projects window, right-click the StockQuoteService project node and choose Undeploy and Deploy Project.
The IDE does the following:

Starts the application server if it is not already started. Builds the StockQuoteService project. You can see the build results in the Output window. Deploys server.war to the Application Server.

In the Projects window, right-click the StockQuoteClient project node and choose Run Project.
The IDE does the following:

Builds the StockQuoteClient project. You can see the build results in the Output window. Deploys client.war to the Application Server. Opens the application in the browser

Confirm that the URL field displays http://localhost:8080/stockquoteclient/

Click Submit.

You can click on the "View SOAP Messages" part of the display to see SOAP messages associated with this request.

Exploring the Log Files

The instructions in this section are optional. Use these instructions to view the changes in the log files.

Additional Configuration Tasks

This section provides information about additional configuration tasks that you might want to perform.

 

Configuration Information for Application Server Not Installed on Port 8080

If the installation of the Sun Java System Application Server was performed on a port other than 8080, you must perform the additional configuration steps, as follows:

In the Projects window, expand StockQuoteClient > Web Pages > WEB-INF and wsdl, and open the stock.wsdl file in the editor. Click the Source button to switch to the Source view of the file. Scroll to the bottom of the file and locate the following line:
<soap:address location="http://localhost:8080/stockservice/stockservice" xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/"/> Replace the 8080 value with the port number where the Application Server is installed. Save your changes and close the file.

Changing the Security Level on the Application Server

In the Runtime window, right-click the Java EE SDK GlassFish node and choose View Admin Console. Type admin for the username and adminadmin for the password. In the left navigation frame, click the Application Server link. In the right frame, click the Logging tab and then click the Log Levels tab.
Scroll to the bottom of the page and set the Security to FINEST.
Click the Save button and log out.

References

Summary

In this tutorial, we have learned how to enable SAML-based and UserNameToken-based authentication between a web service client and a web service provider. To do this, we have

Next Steps