站内搜索: 请输入搜索关键词

当前页面: 开发资料首页 → Netbeans 专题 → Securing Web Services Using the Liberty Token Profile

Securing Web Services Using the Liberty Token Profile

摘要: NetBeans Enterprise Pack 5.5 comes bundled with all the necessary runtimes to enable you to start developing secure, identity-enabled web services clients and providers. These runtimes include

NetBeans Enterprise Pack 5.5 comes bundled with all the necessary runtimes to enable you to start developing secure, identity-enabled web services clients and providers. These runtimes include:

This tutorial illustrates how you can secure an identity-based web service provider (WSP) within an enterprise or organization. Identity in a web service client to web service provider web service interaction can be characterized as:

Netbeans Enterprise Pack provides support for token profiles that fall into two categories:

This tutorial explains how the IDE uses the Liberty token profile to send the caller's identity to the Calendar Service.

Prerequisites

This tutorial assumes that you have some basic knowledge of, or programming experience with, the Java language and platform and the NetBeans IDE.

System Requirements

These tutorials assume that your system meets the requirements specified in the System Requirements topic of the NetBeans Enterprise Pack 5.5 Release Notes.

Software Needed for the Tutorial

Before you begin, you must install the following software on your computer:

  • NetBeans IDE 5.5 with NetBeans Enterprise Pack 5.5 (download)
  • In order to complete the deployment steps in this tutorial, you must have Sun Java System Application Server Platform Edition 9 Update 1. This Application Server is bundled with the NetBeans Enterprise Pack 5.5 download.

Contents

top


Configuring the Tutorial Environment

  1. Start the IDE.
  2. To verify that the Sun Java System Application Server is configured in the IDE, click the Runtime tab and expand the Servers node.
  3. If the Servers node does not contain a Sun Java System Application Server 9 node, follow the steps in Adding an Application Server.
  4. In the Runtime window, expand the Servers node, right-click the Sun Java System Application Server 9 node and choose Start from the pop-up menu.
    Wait until the following message appears in the Output window:
    Application server startup complete.
    When the server is running, the IDE displays a green arrow badge on the Sun Java System Application Server 9 node.
    Note: If the Start option is not available, your server is already running.

top


Creating the Tutorial Projects

There are two tutorial projects: CalendarServer and CalendarClient. The Calendar application is a simple implementation for the creation of calendar events. It maintains a static map of calendar events and returns them as required.

To create the CalendarServer project:

  1. From the IDE's main menu, choose File > New Project.
  2. In the Categories list, expand the Samples node, then select the Identity Blueprints node.
  3. In the Projects list, select Calendar Service.
  4. Click Next.
  5. Accept the default Project Name (CalendarServer) and optionally change the Project Location.
  6. Click Finish.
    A progress dialog box appears, and then the CalendarServer project node appears in the Projects window.

To create the CalendarClient project:

  1. From the IDE's main menu, choose File > New Project.
  2. In the Categories list, expand the Samples node, then select the Identity Blueprints node.
  3. In the Projects list, select Calendar Client.
  4. Click Next.
  5. Accept the default values for Project Name (CalendarClient) and Project Location.
  6. Click Finish.
    A progress dialog box appears, and then the CalendarClient project node appears in the Projects window.

top


Securing Web Services Using a Liberty Security Mechanism

Before you can deploy the project, the web service must be secured using one of the Liberty security mechanisms. In this scenario, we are using the Liberty Bearer Token security profile.

To configure the web service provider:

  1. In the Projects window, expand the CalendarServer project node and the Web Services node.
  2. Under the Web Services node, right-click the CalendarService node and choose Edit Web Service Attributes from the pop-up menu.
    The Web Service Attributes Editor opens with the Security tab open so you can configure the web service provider security.
  3. Select the Enable Message Level Security checkbox.
  4. Under Security Mechanism, from the Request drop-down list, select LibertyBearerToken.

  5. Click OK.

To configure the web service client:

  1. In the Projects window, expand the CalendarClient node and the Web Service References node.
  2. Under the Web Service References node, right-click the CalendarService node and choose Edit Web Service Attributes from the pop-up menu.
    The Web Service Attributes Editor opens with the Security tab open so you can configure the web service client security.
  3. Select the Enable Message Level Security checkbox.
  4. Under Security Mechanism, from the Request drop-down list, select LibertyDiscoverySecurity.
  5. Select the Response checkbox to verify the response.
  6. Under Existing Certificate Settings, leave the Use Default Key Store checkbox selected.

  7. Click OK.

top


Deploying and Running the Project

  1. In the Projects window, right-click the CalendarServer project node and choose Deploy Project.
    The IDE does the following:
    • Starts the application server if it is not already started.
    • Builds the CalendarServer project.
      You can see the build results in the Output window.
    • Deploys server.war to the Application Server.
  2. In the Projects window, right-click the CalendarClient project node and choose Run Project.
    The IDE does the following:
    • Builds the CalendarClient project.
      You can see the build results in the Output window.
    • Deploys client.war to the Application Server.
    • Opens the application in the browser.
  3. Type jsmith in the User Name and Password fields.

    Click to enlarge

  4. Click Log In.
    The Welcome page of the application opens.
  5. From the drop-down list, select jsmith and in the date field, enter a date or accept the default.

  6. Click Get events.
    Notice that the Calendar of jsmith is posted.

    Click to enlarge

top


Exploring the Client Application Deployment Descriptor

  1. In the Projects window, expand the CalendarClient project node and expand the Configuration Files node.
  2. Right-click the sun-web.xml node and choose Edit.
    Notice line 3:

    <sun-web-app error-url="" httpservlet-security-provider="AMHttpProvider">

    and then starting at line 15:

    <message-security-binding auth-layer="SOAP" provider-id="AMClientProvider">
<message-security>
<message/>
<request-protection auth-source="content"/>
<response-protection auth-source="content"/>
</message-security>
</message-security-binding>

    Notice that these providers ensure that the web service is secured with the Liberty token profile to talk to the CalendarServer.
    The following diagram illustrates the workflow of the request originating from the web service client (WSC) to the web service provider (WSP) through the identity provider (IDP) and Discovery Service (Disco). Keep in mind that there is an end user involved in this WSC access and that the user's identity is what is finally transmitted to the WSP in this security context.

    Click to enlarge

    In the diagram above, the HTTPProvider referred to is the AMHttpProvider configured in the Sun deployment descriptor. Similarly the SOAPProvider is the AMClientProvider configured in the Sun deployment descriptor. The WSP is first registered to the Discovery Service as part of the deployment from the IDE. Then when the WSC tries to send a request to the WSP, the end user accessing the WSC is first authenticated successfully with the Access Manager to interact with the Discovery Service. Then the workflow continues to obtain the WSP credentials and the request is sent to the WSP. Upon receiving the request, the WSP's configured Liberty SOAPProviders perform the token verification and set the subject to be that of the authenticated user at the WSC side. Now the business logic at the WSP proceeds.

top


Exploring the Log Files

The instructions in this section are optional. They are meant for users who are interested in seeing the changes in the log files.

  1. Before you proceed to the next step, enable the finest logging level.
    Follow the instructions in Changing the Security Level on the Application Server.
  2. In the Projects window, right-click the CalendarClient project node and choose Run Project from the pop-up menu.
  3. Open the Application Server log file (server.log) in the following directory: application-server-installation-directory\domains\domain1\logs.
    If you accepted the default values during installation, this would be the C:\Sun\AppServer\domains\domain1\logs directory.
  4. Look for ServerAuthContext.validateRequest and ClientAuthContext.secureRequest to find the changes in the log file.
    Samples of the modified parts of the log file are available from the links below.

top


Additional Configuration Tasks

This section provides information about additional configuration tasks that you may want to perform.

Adding an Application Server

  1. In the Runtime window, right-click the Servers node and choose Add Server from the pop-up menu.
    The Add Server Instance dialog box opens.
  2. In the Choose Server page, from the Server drop-down list, select Sun Java System Application Server.
  3. (Optional) In the Name field, accept the default value or type the name you want to use to identify the server in the IDE.
  4. Click Next.
    The Platform Location Folder page opens.
  5. In the Platform Location field, use the Browse button to navigate to and select the Application Server installation location.
    If you accepted the default values during the installation, the location is C:\Sun\Appserver.
  6. Select the Register Local Default Domain radio button.
  7. Click Next.
  8. Supply the user name and password for the domain's administrator.
    If you accepted the default values during the installation, the user name is admin and the password is adminadmin.
  9. Click Finish.

top

Verifying the Configuration of the Access Manager Installation

  1. Start the application server.
  2. In the Runtime window, expand the Sun Java System Access Managers node.
  3. Right-click the Default Instance node and choose View Admin Console.
    A new browser session starts, pointing at the following URL: http://localhost:8080/amserver.
    The Sun Java System Access Manager Log In page opens, indicating that Access Manager server is running.

top

Configuration Information for Application Server not Installed on Port 8080

If the installation of the Sun Java System Application Server was done on a port other than 8080, you must perform the additional configuration steps shown below.

  1. In the Projects window, expand CalendarClient > Web Pages > WEB-INF and wsdl, and open the CalendarService.wsdl file in the editor.
  2. Click the Source button to switch to the Source view of the file.
  3. Scroll to the bottom of the file and locate the following line:
    <soap:address location="http://localhost:8080/CalendarService/CalendarService"/>
  4. Replace the 8080 value with the port number where the Application Server is installed.
  5. Save your changes and close the file.

top

Changing the Security Level on the Application Server

  1. In the Runtime window, right-click the Sun Java System Application Server 9 node and choose View Admin Console.
  2. Type admin for the username and adminadmin for the password.
  3. In the left navigation frame, click the Application Server link.
  4. In the right frame, click the Logging tab and then click the Log Levels tab.

    Application Server admin console, Log Levels tab, click to enlarge

  5. Scroll to the bottom of the page and set the Security to FINEST.

    Application Server admin console, Security setting, click to enlarge

  6. Click the Save button and log out.

top

Configuring Support for the LibertySAMLToken Profile

For the Liberty sample, NetBeans Enterprise Pack supports 3 token profiles: LibertyBearerToken, LibertyX509Token, and LibertySAMLToken. If you want to use the LibertySAMLToken profile, you must perform the following manual configuration steps:

  1. Make sure the application server is running.
  2. Start a new browser session and point at the following URL: http://localhost:8080/amserver.
  3. At the Login screen, use the following values to log in:
    User: amadmin
    Password: admin123 (this is the default password).
  4. Click the Web Services tab and then, in the Web Services page, click the Discovery Service tab.
  5. Scroll to the bottom of the page and in the Resource Offerings for Bootstrapping area, click the default Service Type, urn:liberty:disco:2003-08.
    The Edit Resource Offerings page opens.
  6. Under Service Instance, in the Service Description area, select the checkbox next to the urn:liberty:security:2003-08:null:null entry and click the Delete button.
    The Service Description area now has no items.
  7. In the Service Description area, click the New Description button.
    The New Security Mechanism ID page opens.
  8. In the New Security Mechanism ID page, in the Available list, select urn:liberty:security:2005-02:null:X509 and click OK.
    Note: If the system asks you for an End Point URL, you can use http://localhost:8080/amserver/Liberty/disco. If your server is not installed on port 8080, replace 8080 with the correct port number.
    The Edit Resource Offering page opens and under Service Instance, in the Service Description area, there is now an entry labeled urn:liberty:security:2005-02:null:X509.
  9. At the Edit Resource Offering page, click Save, then at the Discovery Service page, click Save.
  10. In the upper navigation area, click Log Out.

top


Troubleshooting

This section provides workaround information for issues that you may encounter.

Exception Thrown When Invoking the Client

When the client is invoked it throws the following exception on the browser: 

Caught an exception java.rmi.ServerException: JAXRPCSERVLET28: Missing port information

The possible cause for this exception:

  • The security mechanism chosen for the client is not in the list of supported mechanisms for the server. In this case, ensure that you select the same security mechanism for the client and the server.

top


References



top


Summary

In this tutorial, you used NetBeans Enterprise Pack 5.5 to secure an identity-based web service provider (WSP). You used Liberty Security Profile-based authentication for a calendar web service. You learned how to secure an identity-based web service provider (WSP), and how to authenticate the user accessing the web service via a web service client (WSC). The tutorial shows the inherent ease of use provided by NetBeans since all you needed to do was use the Web Service Client and Provider Security Configuration wizards.



top



↑返回目录
前一篇: Securing a Web Application in NetBeans IDE 5.5
后一篇: Securing Web Services Using the SAML or UserNameToken Profiles