Secure Webservice under SSL

[maikyal]

I'm developing a web sevice and i would like to limit access only for https conections. My services is a JAX-RPC servlet and i can use it with a http connection (non ssl of course). How can i do to limit access throw a non secure connection

[anders.hedstrom]

Secure it in your web.xml

<security-constraint>
 <web-resource-collection>
 <web-resource-name>YourServletName</web-resource-name>
 <url-pattern>/your_pattern</url-pattern>
 <http-method>POST</http-method>
 </web-resource-collection>
 <user-data-constraint>
 <transport-guarantee>CONFIDENTIAL</transport-guarantee>
 </user-data-constraint>
</security-constraint>

Create a certificate with keytool and enable the SSL in <jboss_home>/server/configuration/deploy/jbossweb-tomcat55.sar/server.xml

<Connector port="8443" address="${jboss.bind.address}"
 maxThreads="100" minSpareThreads="5" maxSpareThreads="15"
 scheme="https" secure="true" clientAuth="false"
 keystoreFile="${jboss.server.home.dir}/conf/your_certkeystore"
 keystorePass="passwd" sslProtocol = "TLS" />

See:
http://wiki.jboss.org/wiki/Wiki.jsp?page=SSLSetup
http://wiki.jboss.org/wiki/Wiki.jsp?page=JBossWS


Cheers
Anders

[maikyal]

Thanks anders, i'm going to try it.