users@glassfish.java.net

Re: Authenticating WebServices

From: Markus KARG <markus.karg_at_gmx.net>
Date: Mon, 24 Mar 2008 14:32:36 +0100

Thank you so much for your tips: I was able to run the Web Service
Client now! Great! :-)

But I have related questions and I would be very glad if you could
answer them in brief:

(1) Is it really necessary to provide a *vendor specific* DD? I mean,
isn't there a standardized or annotations replacement for this?

<sun-ejb-jar>
    <enterprise-beans>
        <ejb>
            <ejb-name>StatisticsServer</ejb-name>
            <webservice-endpoint>
                <port-component-name>StatisticsServer</port-component-name>
                <login-config>
                    <auth-method>BASIC</auth-method>
                    <realm>default</realm>
                </login-config>
            </webservice-endpoint>
        </ejb>
    </enterprise-beans>
</sun-ejb-jar>

(2) I have added the following code to authenticate. Is that
programmatic code really necessary, and is it vendor transparent? I
mean, isn't there a way to tell JAX-WS to just ask for the password at
runtime, like adding an annotation or something instead of using a
programmatic API?

        final BindingProvider bindingProvider = (BindingProvider)
statisticsServer;
        final Map<String, Object> map = bindingProvider.getRequestContext();
        map.put(BindingProvider.USERNAME_PROPERTY, "MyUser");
        map.put(BindingProvider.PASSWORD_PROPERTY, "MyPassword");

(3) Everything runs well with a standalone client, but when I add
exactly that JAR to my EAR and launch it via Web Start (BTW, a great
feature of GlassFish!) then it tells me that it cannot find the stuff
generated by APT. Why isn't it working inside of the ACC while outside
the ACC it is running pretty well?

24.03.2008 14:23:01 com.sun.enterprise.appclient.MainWithModuleSupport
prepareSecurity
INFO: Security Manager is ON.
24.03.2008 14:23:02 com.sun.enterprise.appclient.MainWithModuleSupport
setTargetServerProperties
INFO: ACC001:Using ClientContainer file:
[C:\DOKUME~1\Markus\LOKALE~1\Temp\sunacc28855.xml].
24.03.2008 14:23:02 com.sun.enterprise.appclient.MainWithModuleSupport
<init>
INFO: ACC024: IIOP endpoint(s) = localhost:3700
24.03.2008 14:23:06 com.sun.enterprise.appclient.MainWithModuleSupport
loadMainClientClass
INFO: ACC009: Load Application Class: [statistics.client.StatisticsClient]
24.03.2008 14:23:07 com.sun.enterprise.appclient.MainWithModuleSupport
<init>
WARNUNG: ACC003: Application threw an exception.
com.sun.xml.ws.model.RuntimeModelerException: runtime modeler error:
Wrapper class statistics.server.jaxws.Average is not found. Have you run
APT to generate them?
    at com.sun.xml.ws.model.RuntimeModeler.getClass(RuntimeModeler.java:285)
    at
com.sun.xml.ws.model.RuntimeModeler.processDocWrappedMethod(RuntimeModeler.java:596)
    at
com.sun.xml.ws.model.RuntimeModeler.processMethod(RuntimeModeler.java:543)
    at
com.sun.xml.ws.model.RuntimeModeler.processClass(RuntimeModeler.java:370)
    at
com.sun.xml.ws.model.RuntimeModeler.buildRuntimeModel(RuntimeModeler.java:256)
    at
com.sun.xml.ws.client.WSServiceDelegate.addSEI(WSServiceDelegate.java:616)
    at
com.sun.xml.ws.client.WSServiceDelegate.getPort(WSServiceDelegate.java:319)
    at
com.sun.xml.ws.client.WSServiceDelegate.getPort(WSServiceDelegate.java:302)
    at
com.sun.xml.ws.client.WSServiceDelegate.getPort(WSServiceDelegate.java:295)
    at javax.xml.ws.Service.getPort(Unknown Source)
    at
statistics.server.StatisticsServerService.getStatisticsServerPort(StatisticsServerService.java:50)
    at statistics.client.StatisticsClient.go(Unknown Source)
    at statistics.client.StatisticsClient.main(Unknown Source)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at
com.sun.enterprise.util.Utility.invokeApplicationMain(Utility.java:266)
    at
com.sun.enterprise.appclient.MainWithModuleSupport.<init>(MainWithModuleSupport.java:449)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown
Source)
    at java.lang.reflect.Constructor.newInstance(Unknown Source)
    at
com.sun.enterprise.appclient.jws.boot.JWSACCMain.run(JWSACCMain.java:221)
    at
com.sun.enterprise.appclient.jws.boot.JWSACCMain.main(JWSACCMain.java:182)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at com.sun.javaws.Launcher.executeApplication(Unknown Source)
    at com.sun.javaws.Launcher.executeMainClass(Unknown Source)
    at com.sun.javaws.Launcher.doLaunchApp(Unknown Source)
    at com.sun.javaws.Launcher.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)
Error launching or running the application
java.lang.reflect.InvocationTargetException
java.lang.reflect.InvocationTargetException
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown
Source)
    at java.lang.reflect.Constructor.newInstance(Unknown Source)
    at
com.sun.enterprise.appclient.jws.boot.JWSACCMain.run(JWSACCMain.java:221)
    at
com.sun.enterprise.appclient.jws.boot.JWSACCMain.main(JWSACCMain.java:182)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at com.sun.javaws.Launcher.executeApplication(Unknown Source)
    at com.sun.javaws.Launcher.executeMainClass(Unknown Source)
    at com.sun.javaws.Launcher.doLaunchApp(Unknown Source)
    at com.sun.javaws.Launcher.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.RuntimeException:
java.lang.reflect.InvocationTargetException
    at
com.sun.enterprise.appclient.MainWithModuleSupport.<init>(MainWithModuleSupport.java:461)
    ... 15 more
Caused by: java.lang.reflect.InvocationTargetException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at
com.sun.enterprise.util.Utility.invokeApplicationMain(Utility.java:266)
    at
com.sun.enterprise.appclient.MainWithModuleSupport.<init>(MainWithModuleSupport.java:449)
    ... 15 more
Caused by: com.sun.xml.ws.model.RuntimeModelerException: runtime modeler
error: Wrapper class statistics.server.jaxws.Average is not found. Have
you run APT to generate them?
    at com.sun.xml.ws.model.RuntimeModeler.getClass(RuntimeModeler.java:285)
    at
com.sun.xml.ws.model.RuntimeModeler.processDocWrappedMethod(RuntimeModeler.java:596)
    at
com.sun.xml.ws.model.RuntimeModeler.processMethod(RuntimeModeler.java:543)
    at
com.sun.xml.ws.model.RuntimeModeler.processClass(RuntimeModeler.java:370)
    at
com.sun.xml.ws.model.RuntimeModeler.buildRuntimeModel(RuntimeModeler.java:256)
    at
com.sun.xml.ws.client.WSServiceDelegate.addSEI(WSServiceDelegate.java:616)
    at
com.sun.xml.ws.client.WSServiceDelegate.getPort(WSServiceDelegate.java:319)
    at
com.sun.xml.ws.client.WSServiceDelegate.getPort(WSServiceDelegate.java:302)
    at
com.sun.xml.ws.client.WSServiceDelegate.getPort(WSServiceDelegate.java:295)
    at javax.xml.ws.Service.getPort(Unknown Source)
    at
statistics.server.StatisticsServerService.getStatisticsServerPort(StatisticsServerService.java:50)
    at statistics.client.StatisticsClient.go(Unknown Source)
    at statistics.client.StatisticsClient.main(Unknown Source)
    ... 21 more


Thank you so much for your kind help! :-)

Markus


V B Kumar Jayanti schrieb:
> Markus KARG wrote:
>> I am running this WebService on Glassfish V2 (no additional
>> configuration done, just dropped it to the autodeploy directory):
>>
>> @Stateless
>> @WebService
>> public class StatisticsServer {
>> public double average(double x, double y) {
>> return (x + y) / 2.0;
>> }
>> }
>>
>> I am testing it with this client (running on Java 6, i. e., no
>> additional configuration but just used wsimport to create classes
>> from WSDL):
>>
>> public class StatisticsClient {
>> public final static void main(final String... arguments) {
>> StatisticsServer statisticsServer = new
>> StatisticsServerService().getStatisticsServerPort();
>> double average = statisticsServer.average(1, 2);
>> }
>> }
>>
>> It works pretty well.
>>
>> Now I want to add roles based security. So I am adding
>> @RolesAllowed("PlainUser") to the method "average" and redeploy the
>> server. After building the client once more, it tells me "Client not
>> authorized for invocation of public final double
>> statistics.server.StatisticsServer.average(double,double)".
>>
>> So my questions are:
>>
>> (1) How to tell the client that it shall authenticate me against the
>> service?
>> (2) I added a user to the "file" realm in Glassfish and set "Groups"
>> to "PlainUser". Anything else I need to do to make it work?
>>
> Please see the following :
> http://java.sun.com/developer/technicalArticles/J2EE/security_annotation/
>
> "For EJB web service endpoints with |_at_RolesAllowed|, you need to
> specify the type of authentication to use by specifying the
> |<login-config>| and |<auth-method>| elements in sun-ejb-jar.xml. For
> username-password authentication, set the |<auth-method>| element to
> BASIC, as shown in the following example. This step is required only
> for EJB web service endpoints, and is not required for EJBs."
>
> Let me know if that helped.
>
>> It seems when it comes to security, all that nice and easy
>> annotations things are over and there is a lot of hand work needed,
>> right? Or is there something I have overseen, like
>> "@AuthenticateAutomaticallyUsingCurrentOperatingSystemUserAccount"?
>>
> You can write and configure your own custom realm which can do
> AuthenticateAutomaticallyUsingCurrentOperatingSystemUserAccount
>
> Thanks.
>
>> Thanks a lot!
>> Markus
>>
>


-- 
http://www.xing.com/go/invita/58469