WS config

[nickarls]

I'm trying to secure my existing web service, I added

@EndpointConfig(configName = "Standard WSSecurity Endpoint")

and it is picked up (garbling => error)

and put an

<?xml version="1.0" encoding="UTF-8"?>
<jboss-ws-security xmlns="http://www.jboss.com/ws-security/config"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://www.jboss.com/ws-security/config
 http://www.jboss.com/ws-security/schema/jboss-ws-security_1_0.xsd">
 <key-store-file>META-INF/wsse.keystore</key-store-file>
 <key-store-password>jbossws</key-store-password>
 <trust-store-file>META-INF/wsse.truststore</trust-store-file>
 <trust-store-password>jbossws</trust-store-password>
 <config>
 <sign type="x509v3" alias="wsse" />
 <encrypt type="x509v3" alias="wsse" />
 <requires>
 <signature />
 <encryption />
 </requires>
 </config>
</jboss-ws-security>

and it is picked up (garbling => error)

since it is an EAR with the WS class in an JAR, I put all the ws-related files in the META-INF directory of the jar (following the wiki).

But still my wsdl shows no sign of encryption tags. Suggestions?

[nickarls]

Any help would be...helpful.

[nickarls]

A starting point?
A working sample to reverse-engineer?
A bone?

[peterj]

Have you seen http://jbws.dyndns.org/mediawiki/index.php?title=JAX-WS_User_Guide#WS-Security?

What do you mean by "(garbling => error)"?

Have you also set up the client to use WSSecurity?

[nickarls]

"PeterJ" wrote:
Have you seen http://jbws.dyndns.org/mediawiki/index.php?title=JAX-WS_User_Guide#WS-Security?

Yep, I used that as a starting point

"PeterJ" wrote:

What do you mean by "(garbling => error)"?

I mean that if I introduce an error into the file then the config stops working and from that I conclude that the file is found and being used.

"PeterJ" wrote:

Have you also set up the client to use WSSecurity?

Well, I haven't got as far as the client yet, I started at the server-end assuming that the wsdl would show some security tags if it was properly configured.

[peterj]

That's a negative. There are no artifacts in the WSDL that indicate WSSecurity is required. All you get is an error is the client doesn't supply the credentials (see my travails at http://www.jboss.com/index.html?module=bb&op=viewtopic&t=120672).

This makes sense because you can then easily layer security on top of an existing web service without modifying it or the client (just add the necessary config files).

[nickarls]

Whoa! Worked. Thanks. I've been staring too much at the wsdl.