The Lowly Life of a Tech: weblog; Apache CXF; getting message-level encryption to work

Bash

Bash Arrays | Linux Journal

http://www.linuxjournal.com/content/bash-arrays

Provide a list in open/close parentheses, unadorned.

array=(one two three four [5]=five)

echo "Array size: ${#array[*]}"

echo "Array items:"
for item in ${array[*]}
do
    printf "   %s\n" $item
done

Bash For Loop Examples

http://www.cyberciti.biz/faq/bash-for-loop/

The array here doesn't use parentheses.

for VARIABLE in 1 2 3 4 5 .. N
do
 command1
 command2
 commandN
done

bash - escaping newlines in sed replacement string - Stack Overflow

http://stackoverflow.com/questions/8991275/escaping-newlines-in-sed-replacement-string

Newlines will be recognized in the replace clause (the second half), but not in the match clause. Instead, you will need to use the N and D flags.

echo 'abc' | sed 's/b/\ 
> /'
a
c

Gather dependencies from pom files

http://www.grymoire.com/Unix/Sed.html#uh-51

Navigate to the root directory of Maven project with sub-modules, copy and paste the following code. The code depends on the correct order of a dependency declaration: groupId, articleId, version. Otherwise, all bets are off. This is intended to be quick and dirty; a SAX parser would be more robust.

The following temp files are used for each pom.xml in turn.

work.txt: contains ''
work2.txt: strips off '', leaving groupId:articleId:version

results.txt: The final file, providing a compilation of dependencies for all pom.xml files.

for file in $(find . -name "pom.xml")
do

cfile=$(printf '%q' $file)

sed '
# look for a <groupId>...</groupId>
/[^<]*<groupId>\([^<]*\)<\/groupId>.*$/ {
# Found one - now read in the next line
 N
# delete the <groupId>...</groupId> and replace with <maven-dependency>
 s/[^<]*<groupId>\([^<]*\)<\/groupId>[\n\r]*[^<]*/<maven-dependency>\1/
}

/<artifactId>\([^<]*\)<\/artifactId>.*$/ {
 N
 s/<artifactId>\([^<]*\)<\/artifactId>[\n\r]*[^<]*/:\1/
}

s/<version>\([^<]*\)<\/version>.*/:\1<\/maven-dependency>/

' $file > work.txt

echo -e "\n${cfile}\n===========================================" > work2.txt

cat work.txt | grep "<maven-dependency>[^<]*<\/maven-dependency>" | sed "s/<maven-dependency>\([^<]*\)<\/maven-dependency>/\1/" >> work2.txt; cat work2.txt

cat work2.txt >> results.txt

done

Along the same lines, there is also a little Ruby script for extracting out the articleId from the groupId:articleId:version:

#[Extract dependency name (Ruby)]

#E.g., 
dependencies = %w[
edu.ucmerced.ucpath.idm:ucm-ucpath-idm:0.0.2-SNAPSHOT
it.svario.xpathapi:xpathapi-jaxp:RELEASE
org.eclipse.m2e:lifecycle-mapping:1.0.0
org.apache.maven.plugins:maven-install-plugin:2.4
com.google.code.maven-replacer-plugin:replacer:1.5.2
org.codehaus.mojo:properties-maven-plugin:1.0-alpha-2
org.apache.maven.plugins:maven-install-plugin:2.4
com.google.code.maven-replacer-plugin:replacer:1.5.2
]

puts dependencies.map{|x| first = x.index(/:/); x.slice(first+1, x.index(/:/, first+1) - first-1)}

How to reference a variable within sed? - The UNIX and Linux Forums

http://www.unix.com/shell-programming-scripting/39175-how-reference-variable-within-sed.html

tmp="abcdefg"
sed "s/${tmp}/good"

Replace the single quotes with double quotes. Single quotes prevent variable expansion.
http://www.unix.com/shell-programming-scripting/39175-how-reference-variable-within-sed.html

escape string in bash script so it can be used in command line

http://www.linuxquestions.org/questions/linux-software-2/escape-string-in-bash-script-so-it-can-be-used-in-command-line-360664/

Use double quotes.

You don't need to escape a string if you quote it - say you want to pass all the arguments to ls, instead of

ls $*

write

ls "$*"

Java; web services

Web Service Definition Language (WSDL)

http://www.w3.org/TR/wsdl#_soap:address

What purpose does soap:address serve? It appears to be the actual endpoint.

<definitions .... >
    <port .... >
        <binding .... >
           <soap:address location="uri"/> 
        </binding>
    </port>
</definitions>

? Apache CXF -- WS-SecurityPolicy http://cxf.apache.org/docs/ws-securitypolicy.html

Configuration for message-level encryption can be easily accomplished. The following server and client configurations should be loaded either in the Server/Client Java class or in the pom.xml configuration

Java Class

  SpringBusFactory bf = new SpringBusFactory();
  URL busFile = new ClassPathResource("wssec-server.xml").getURL();
  Bus bus = bf.createBus(busFile.toString());
  BusFactory.setDefaultBus(bus);

pom.xml

<plugin>
    <groupId>org.codehaus.mojo</groupId>
    <artifactId>exec-maven-plugin</artifactId>
    <executions>
        <execution>
            <phase>test</phase>
            <goals>
                <goal>java</goal>
            </goals>
            <configuration>
                <mainClass>edu.ucmerced.ucpath.idm.Runner</mainClass>
                <arguments>
                    <argument>../ws-ora-idm-wsdl/src/main/resources/wsdl/IDMServices/IDMServices.wsdl</argument>
                </arguments>
                <systemProperties>
                  <systemProperty>
                    <key>cxf.config.file</key>
                    <value>cxf-client.xml</value>     
                  </systemProperty>
                </systemProperties>
            </configuration>
        </execution>
    </executions>
</plugin>

Server

    <jaxws:endpoint id="server"
      implementor="demo.wssec.server.GreeterImpl"
      endpointName="s:SoapPort"
      serviceName="s:SOAPService"
      address="http://localhost:9001/SoapContext/SoapPort"
      wsdlLocation="wsdl/hello_world.wsdl"
      xmlns:s="http://apache.org/hello_world_soap_http">
        
      <jaxws:properties>
         <entry key="ws-security.signature.properties" value="serviceKeystore.properties"/>
         <entry key="ws-security.signature.username" value="myservicekey"/>

         <entry key="ws-security.callback-handler" 
                value="demo.wssec.server.ServerCallbackHandler"/>

         <entry key="ws-security.encryption.properties" value="serviceKeystore.properties"/>
         <entry key="ws-security.encryption.username" value="myclientkey"/>
      </jaxws:properties> 
    </jaxws:endpoint>

Client

    <jaxws:client name="{http://apache.org/hello_world_soap_http}SoapPort" createdFromAPI="true">
       <jaxws:properties>
           <entry key="ws-security.signature.properties" value="clientKeystore.properties"/>
           <entry key="ws-security.signature.username" value="myclientkey"/>
           <entry key="ws-security.callback-handler" 
                  value="demo.wssec.client.ClientCallbackHandler"/>
           <entry key="ws-security.encryption.properties" value="clientKeystore.properties"/> 
           <entry key="ws-security.encryption.username" value="myservicekey"/>
       </jaxws:properties>
   </jaxws:client>

Propery files should include location of certificates and keystore password. The private key password cannot be provided here, but should use the callback to provide the correct private key.

Properties

org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
org.apache.ws.security.crypto.merlin.keystore.type=jks
org.apache.ws.security.crypto.merlin.keystore.password=sspass
org.apache.ws.security.crypto.merlin.keystore.alias=myservicekey
org.apache.ws.security.crypto.merlin.keystore.file=keys/servicestore.jks

Java callback-handler

public void handle(Callback[] callbacks) throws IOException,
        UnsupportedCallbackException {
    for (int i = 0; i < callbacks.length; i++) {
        if (callbacks[i] instanceof WSPasswordCallback) {
            WSPasswordCallback pc = (WSPasswordCallback) callbacks[i];
            if ("myservicekey".equals(pc.getIdentifier())) {
                pc.setPassword("skpass");
                break;
            }
        }
    }
}

See https://github.com/dcvezzani/mustached-batman for a complete example.

Maven Repository: org.apache.ws.security » wss4j

» 1.5.6 http://mvnrepository.com/artifact/org.apache.ws.security/wss4j/1.5.6

Pom.xml dependency entry.

<dependency>
 <groupId>org.apache.ws.security</groupId>
 <artifactId>wss4j</artifactId>
 <version>1.5.6</version>
</dependency>

WS-SecurityPolicy 1.2

http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/ws-securitypolicy-1.2-spec-os.html

Documentation of the nodes in the WS-SecuirtyPolicy namespace.

XML Namespace Document for WS-Security-Policy 1.3

http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200802

Documentation of the nodes in the WS-SecuirtyPolicy namespace.

Re: Eclipse, CXF and WS-SecurityPolicy

http://mail-archives.apache.org/mod_mbox/cxf-users/201307.mbox/%3CF172D30F-6747-44B2-A4CE-7EFBD7710DEA@indivica.com%3E

https://www.google.com/search?q=cxf+%22No+assertion+builder%22&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a

An error like what follows indicates that possibly the wrong namespace is being specified or the namespace is missing altogether.

> Jul 27, 2013 12:41:56 AM org.apache.cxf.ws.policy.AssertionBuilderRegistryImpl handleNoRegisteredBuilder
> WARNING: No assertion builder for type {http://schemas.xmlsoap.org/ws/2005/07/securitypolicy}RequiredParts registered.

Maven Repository: org.apache.cxf » cxf-rt-ws-security

» 2.4.1 http://mvnrepository.com/artifact/org.apache.cxf/cxf-rt-ws-security/2.4.1

Entry description

<dependency>
 <groupId>org.apache.cxf</groupId>
 <artifactId>cxf-rt-ws-security</artifactId>
 <version>2.4.1</version>
</dependency>

Java web services: WS-Security with CXF

http://www.ibm.com/developerworks/library/j-jws13/

Walk-through for creating a web service, using WS-Security with the Apache CXF web services stack

X.509 Certificates

X.509 - Wikipedia, the free encyclopedia

http://en.wikipedia.org/wiki/X.509

Was researching what exactly the significance is of signed certificates.

As far as I can tell, most of the time it's only purpose is to validate a trusted public key.

The Most Common Java Keytool Keystore Commands

http://www.sslshopper.com/article-most-common-java-keytool-keystore-commands.html

https://www.google.com/search?q=keytool+view+public+cert&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a

A great resource common keytool commands.

The Lowly Life of a Tech

Saturday, September 28, 2013

weblog; Apache CXF; getting message-level encryption to work

Bash

Java; web services

X.509 Certificates

No comments:

Post a Comment

Followers

Blog Archive