ws-security on Jboss AS 7

[mblanco]

Hi, I have a very simple question. I wanted to know if it is possible to secure web services trough ws-security on Jboss AS 7 (version 7.0.2 nowadays), if it is, then what's the preferred method? Are there any complete examples available?

Please note that I have been trying to use jbossws, but the version 4 (which comes with jboss 7) is still in beta stage and (for example) does not provide the @EndpointConfig annotation, necessary to secure the web service. According to this thread (http://community.jboss.org/thread/170522) I could build jbossws from source and get springframework to use the annotation, but this made me think that maybe there are other options.

I'm writing this post as a general Jboss 7 question, I don't know if jbossws is the only option to add ws-security, if it is not then I appreciate if any of you could give me options.

I also wanted to make clear that I'm no expert in any of this stuff, so I might be missing something completely obvious

Thanks in advance.

[asoldano]

Please have a look at https://docs.jboss.org/author/display/JBWS/WS-Security which has the documentation for WS-Security usage on AS 7 series with JBossWS 4.

ATM you can have a WS-Security enabled endpoint on AS7 withouth Spring, using the @EndpointConfig annotation.

Regarding JBossWS 4 being on Beta stage, that's going to reach Final/GA by the time JBoss AS 7.1.0.Final is released, but most features are already available and usable nevertheless.

[mblanco]

Alessio, thanks for your answer.

Actually reading that guide is what had confused me in the first place. The guide uses org.jboss.ws.api.annotation.EndpointConfig to secure the web service, but I can't import that annotation. I thought EndpointConfig was part of spring witch explained why it wasn't available, but apparently I was wrong. As I understand from your answer EndpointConfig should be available, right?

Any idea why I can't import EndpointConfig? Do I need an external jar?

[asoldano]

@org.jboss.ws.api.annotation.EndpointConfig is part of the jbossws-api. That's in module org.jboss.ws.api on AS7 and should be automatically available to any deployments. On client side / at compile time you can use the last beta of org.jboss.ws:jbossws-api maven artifact.

[mblanco]

I will better move to jboss 6, I find it easier to find documentation and examples on the web.

I marked the first response as correct given that it answered my initial concern, thank you very much for your time.