Two Way SSL on Weblogic Server

This Post describes the steps and concepts required to Configure and use Two Way SSL with the Weblogic Server.

Admin Server Console is used as a Testing Application to verify the Configuration is working or not.

Issues while creating weblogic Custom Security Provider

One of the most important and common errors that generally comes while creating the Custom Security Providers is :

om.bea.common.engine.SecurityServiceRuntimeException: [Security:097533]SecurityProvider service class name for XXXXXX is not specified.

The above error comes due to incorrect usage of the Weblogic Mbean maker.

We should always use the below directory structure for creating the Custom Security Provider for Weblogic Server:

How to resolve : Authentication denied: Boot identity not valid

<11-May-2010 20:00:57 o'clock CEST> <Critical> <Security> <BEA-090402> <Authentication denied: Boot identity not valid; The user name and/or password from the boot identity file (boot.properties) is not valid. The boot identity may have been changed since the boot identity file was created. Please edit and update the boot identity file with the proper values of username and password. The first time the updated boot identity file is used to start the server, these new values are encrypted.>

The above mentioned error occurs generally during server startups:

How to debug SSL issues with weblogic server

First of all I would suggest using the following debug flag in case of any kind of SSL issue on Weblogic server:

-Dweblogic.StdoutDebugEnabled=true

-Dssl.debug=true

 

If you need to debug any SSL issue with the standalone JAVA class then you can use the following debug flag:

-Djavax.net.debug=all :                                This is for turning all debugging.

-Djavax.net.debug=ssl :                This is for turning SSL debugging.

Then In case if you are getting the following exception in the debug trace:

How to Develop Weblogic Custom Audit Provider

Through this post I will be providing the steps to develop a sample custom Weblogic Audit Provider.

Following files are required for this sample tutorial:

SimpleSampleAuditProviderImpl : This is a sample runtime class implementing the AuditProvider and AuditChannel.

SimpleSampleAuditorImpl : This is a sample class that extends the ContextHandlerImpl class to get the supported ActiveContextHandlerEntries

SimpleSampleAuditor : This is a sample Audit configuration Mbean Configuration file used to instantiate the Custome Audit Provider Mbean Type.

We will be following the link give below:

http://download.oracle.com/docs/cd/E12840_01/wls/docs103/dvspisec/aud.html

Example of WS-Trust web service security using Weblogic server

This article describes how to secure a Web Service using a central Token Server.

The standards WS-Trust, WS-Policy, WS-SecurityPolicy and Web Services Security, formerly known WS-Security, are used.

A simple scenario with a consumer, a web service and a Security Token Service (in short STS) would serve as an example.

What is WS-Trust?

-----------------------

This specification defines a standard where in a web- service requiring some sets of authentication and message level security can trust a third party web-service( called as Security Token Service-STS)  which is going to authenticate the actual request and will issue a token that can be accepted by the web –service.

The web-service should rely and trust the STS so that is can give response to the request authenticated by STS.

The Below Diagram shows the Flow of the Request between the components involved in a simple set-up showing WS-TRUST mechanism:

1: Web-Service Provider (WSP)

2: Web-Service Consumer (WSC)

3: Secure Token Service (STS)

How to invoke a JAX-WS web service secured with username/password with another JAX-WS web

Here it is assumed that you already have a JAX-WS web service deployed which requires username/password to get invoked.

If not then please follow the below link:

http://weblogictips.wordpress.com/2010/03/25/how-secure-a-jax-ws-web-service-on-weblogic/

Let us assume that the web service WSDL is located at URL:

http://137.72.242.156:7001/Hello/HelloService?WSDL

Now In order to invoke this web service we will be creating another JAX-WS web service as mentioned below:

Here

---------------------------------JaxWSClient.java--------------------------------------------------------------

package sandeep;

import javax.jws.WebService;

import javax.jws.WebMethod;

import weblogic.xml.crypto.wss.provider.CredentialProvider;

import weblogic.wsee.security.unt.ClientUNTCredentialProvider;

import weblogic.xml.crypto.wss.WSSecurityContext;

import javax.xml.ws.BindingProvider;

import java.util.List;

import java.util.ArrayList;

import java.util.Map;

// Import the JAX-WS Stubs for invoking the Hello Web Service.

// Stubs generated by clientgen

import demo.HelloService;

import demo.Hello;

@WebService

public class JaxWSClient {

@WebMethod()

public String callJAXWS()

{

HelloService myService = new HelloService();

Hello myServicePort = myService.getHelloPort();

List<CredentialProvider> credProviders = new ArrayList<CredentialProvider>();

String username = "weblogic";

String password = "weblogic";

CredentialProvider cp = new ClientUNTCredentialProvider(username.getBytes(),password.getBytes());

credProviders.add(cp);

Map<String,Object> rc = ((BindingProvider)myServicePort).getRequestContext();

rc.put(WSSecurityContext.CREDENTIAL_PROVIDER_LIST, credProviders);

System.out.println("calling the web service");

String result = myServicePort.sayHello("sandeep");

System.out.println("called " + result);

return result;

}

}

-------------------------------------------------------------------------------------------------------------------------------------

First let us look at the imports statements used in the above java class:

Below  imports are required to use the Weblogic specific annotations to make this class as a web service class and to create the username token provider(weblogic.wsee.security.unt.ClientUNTCredentialProvider) to be added to the generated port.

import javax.jws.WebService;

import javax.jws.WebMethod;

import weblogic.xml.crypto.wss.provider.CredentialProvider;

import weblogic.wsee.security.unt.ClientUNTCredentialProvider;

import weblogic.xml.crypto.wss.WSSecurityContext;

import javax.xml.ws.BindingProvider;

import java.util.List;

import java.util.ArrayList;

import java.util.Map;

below imports are used to get the web service object and the port object:

import demo.HelloService;

import demo.Hello;

Now after creating the above Class we will use the below JWSC  ant of Weblogic to make the web service artifacts from the above class:

<!-- building the JAXWS Client -->

<target name="JAXWS-build-client-service">

<mkdir dir="${JAXWSClient.ear.dir}"/>

<jwsc

srcdir="${JAXWS.client.dir}"

destdir="${JAXWSClient.ear.dir}" >

<jws

file="JaxWSClient.java">

<clientgen

type="JAXWS"

wsdl="http://137.72.242.156:7001/Hello/HelloService?WSDL"

packageName="demo" />

</jws>

</jwsc>

</target>

--------------------------------

You can notice that we have used the clientgen child ant task within the JWSC ant task here. This is the difference between the standalone client and a JAX-WS client.

The complete build.xml file for generating the complete JAX-WS client and deploying it on the Weblogic server is given below:

----------------------------------------------build.xml--------------------------------------------------------------------

<project default="all" basedir=".">

<property value="${basedir}/JAXWSWebServiceClient" />

<property name="JAXWSClient.ear.dir" value="${basedir}/JAXWS-client-ear" />

<property value="weblogic" />

<property name="wls.password" value="weblogic" />

<property name="wls.hostname" value="localhost" />

<property name="wls.port" value="7001" />

<property name="wls.server.name" value="AdminServer" />

<!-- building the JAXWS Client -->

<target name="JAXWS-build-client-service">

<mkdir dir="${JAXWSClient.ear.dir}"/>

<jwsc

srcdir="${JAXWS.client.dir}"

destdir="${JAXWSClient.ear.dir}" >

<jws

file="JaxWSClient.java">

<clientgen

type="JAXWS"

wsdl="http://137.72.242.156:7001/Hello/HelloService?WSDL"

packageName="demo" />

</jws>

</jwsc>

</target>

<target>

<javac

srcdir="${JAXWS.client.dir}" destdir="${JAXWS.client.dir}"

classpath="${java.class.path};${ JAXWS.client.dir }"

includes="JaxWSClient.java"/>

</target>

<!-- deploying the client web service -->

<target name="JAXWSdeploy">

<wldeploy

action="deploy"

verbose="true"

failonerror="true"

name="JAXWSClientEar"

source="${JAXWSClient.ear.dir}"

user="${wls.username}"

password="${wls.password}"

adminurl="t3://${wls.hostname}:${wls.port}"

targets="${wls.server.name}" />

</target>

</project>

------------------------------------------------------------------------------------------------------------------------------

Steps to follow:

1: Make sure that the JAX-WS web service that is to be called is active and accessible.

Assume that the WSDL URL for that web service is : http://137.72.242.156:7001/Hello/HelloService?WSDL

2: Create a dir :  sample and place the above mentioned build.xml file in this sample dir:

3: create another dir inside sample dir : JAXWSWebServiceClient and place the JaxWSClient.java class in this dir:

4: Now open a command prompt and run the setDomainEnv.cmd file on this command prompt to set the necessary classpath and other environment variables. setDomainEnv.cmd file is available in the domain_home/bin dir:

5: Then on the command prompt opened above move to the sample dir created above:

6: from the command prompt run the following task:

ant JAXWS-build-client-service

this task is going to build the web service war for the current java class and the clientgen child ant task used within this task is going to create the necessary client artifacts from the WSDL url:

7: After successful completion of the above task run the below task to deploy the created war file:

ant JAXWSdeploy

8: After the deployment is successful you can log in to the Weblogic Admin Server Console and go to the Deployments Summary to see the deployed Web Service.

9: When you will open the Weblogic Web Service Client for this deployed Web Service with name: JAXWSClientEar then you will see the below window:



10: Just Clicking on the callJAXWS button available on the Weblogic web service Client window will invoke this client web service which in turn will call the Secured Web Service and you can see the below output on the Weblogic Server Standard output: