XACML PDP WSDL

[kiergray]

Hello,

I downloaded the pdp sample from PicketLink downloads and realized the XACML PDP is exposed as a servlet:

org.picketlink.identity.federation.bindings.servlets.SOAPSAMLXACMLServlet

Do you provide a way to expose the PDP as a web service with a wsdl in particular? My concern is that it would make PEP/client-side development (through code generation and taking advantage of wsdl/jax-ws/ws-security and so on) much easier in my opinion. It is accessed through SOAP protocol and all SAML 2.0 / XACML 2.0 xsd are available I believe. What is missing?

FYI, I have an example with wsdl here for Oracle product:

http://download.oracle.com/docs/cd/E12890_01/ales/docs32/webservicesprogrammersguide/webservice_xacml.html

Unfortunately, it does no support SAML 2.0 profile of XACML as you do.

Thank you for any help.

Regards,

KG

[anil.saldhana]

Have you tried the JAX-WS Dispatch API Call?

[kiergray]

No, I haven't. Could you be more explicit? I don't figure out how that would help. Thanks.

[anil.saldhana]

Something like we use in STSClient

http://anonsvn.jboss.org/repos/picketlink/federation/branches/Branch_1_x/picketlink-fed-core/src/main/java/org/picketlink/identity/federation/core/wstrust/STSClient.java

I am guessing (I may be wrong) that the Jax-WS Dispatch call should be able to send a soap message across to any endpoints on the network.

[kiergray]

OK. I got the idea. So I would need to build the SOAP request XML before passing to the dispatch call (such as RequestSecurityTokenCollection for the STSClient you pointed me to), don't I ?

Yet, I would prefer having a WSDL for the PDP as it would make it easier to write/generate the client code (than using the Dispatch API). In particular, I am interested in adding WS-Policy/WS-SecurityPolicy to such a WSDL.

Thanks again.

[anil.saldhana]

Kier,  this is Open Source and you are welcome to submit a patch that has the webservice.  You have the core SAML/XACML constructs.  All you need to do is expose a wsdl via maybe an ejb3 webservice or POJO service. Many of our users contribute patches.

I think the world is moving toward a REST style services.

[kpeeples]

I am looking into creating a Web Service for the PDP.  I will post an update when I am able to get it completed.

[salarzai]

Hi,

I want to use JBossXACML/PicketBox XACML in axis2 for securing a web service. I want to make a module and call JBOSS PDP from a handler within axis2. All I need is to use PDP code with policy and to call it from the handler.

However there is no proper documentation how do I configure and call PDP of the JbossXACML.

Can someone kindly guide me from where to start please?

Waiting for your kind response.

Sardar

[kpeeples]

I would look at the Authorization Modules [1] for the Web and EJB (ejb/EJBXACMLPolicyModuleDelegate.java and web/WebXACMLPolicyModuleDelegate.java) to use as an example on how to make your module, which would act as the PEP, communicate with the PDP with the Request Context and Response Context.  Look at the authorize and process methods.  You can look at the XACML specification [2] to see further information on the PEP and PDP behaviors.  There may be some other documentation concerning writing a custom PEP for Picketbox but not aware of it.  Others may have comments about documentation and if there is a better way than what I mention above.  Hope this helps.

[1] http://anonsvn.jboss.org/repos/jbossas/projects/security/security-jboss-sx/trunk/jbosssx/src/main/java/org/jboss/security/authorization/modules/

[2] http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-core-spec-os.pdf

[anil.saldhana]

PicketLink2 build has a PDP that is a SOAP based WS.

http://community.jboss.org/message/584988#584988

Documentation: http://community.jboss.org/wiki/XACMLPDPSOAPService

Also ,  simple usage of JBossXACML is given in:http://anil-identity.blogspot.com/2011/02/usagejboss-xacml.html

http://anil-identity.blogspot.com/2011/02/usagejboss-xacml.html