ws-security on Jboss AS 6.1.0
Hi, I'm trying to secure a web service through ws-security on Jboss AS 6.1.0. I made a secured web service and a client which does not provide credentials, so it should be rejected, the problem is that the client is not rejected and it completes the call to the web service.
These are the full steps of what I have done:
1) Created a dynamic web project "hello" with this class in it:
import javax.jws.WebMethod;
import javax.jws.WebService;
import javax.jws.soap.SOAPBinding;
import org.jboss.ws.annotation.EndpointConfig;
@SOAPBinding(style=SOAPBinding.Style.RPC)
@WebService()
@EndpointConfig(configName="Standard WSSecurity Endpoint")
public class HelloWorld {
@WebMethod()
public String sayHello(String name) {
System.out.println("Hello: " + name);
return "Hello " + name + "!";
}
}
2) Configured web.xml with
<display-name>HelloWorld</display-name>
<servlet-name>HelloWorld</servlet-name>
<servlet-class>org.jboss.samples.webservices.HelloWorld</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>HelloWorld</servlet-name>
<url-pattern>/HelloWorld</url-pattern>
</servlet-mapping>
3) Created jboss-wsse-server.xml in WEB-INF (as it is a POJO web service) with this content:
<jboss-ws-security
xmnls="http://www.jboss.com/ws-security/config"
xmnls:xsi="http://ww.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.jboss.com/ws-security/config
http://www.jboss.com/ws-security/schema/jboss-ws-security_1_0.xsd">
<key-store-file>WEB-INF/server.keystore</key-store-file>
<key-store-type>jks</key-store-type>
<key-store-password>password</key-store-password>
<trust-store-file>WEB-INF/server.truststore</trust-store-file>
<trust-store-type>jks</trust-store-type>
<trust-store-password>password</trust-store-password>
<key-passwords>
<key-password alias="server" password="password" />
</key-passwords>
<config>
<encrypt type="x509v3" alias="client" />
<requires>
<encryption />
</requires>
</config>
</jboss-ws-security>
4) Put server.keystore and server.truststore in WEB-INF
5) Deployed the web service (it deploys with no errors)
6) Created a test client project "hello-client"
7) Used wsconsume on the test client project to generate the necessary classes to consume the web service
8) Created the next class on the test client to test the web service
public class Client {
/**
* @param args
*/
public static void main(String[] args) {
HelloWorldService helloWorldService = new HelloWorldService();
HelloWorld helloWorldPort = helloWorldService.getHelloWorldPort();
String sayHello = helloWorldPort.sayHello("Jhon");
System.out.println(sayHello);
}
}
I haven't created jboss-wsse-client.xml in the test client nor it's keystore and trustore, the problem is that if I execute the client it consumes the web service with no problem at all. Any clue why can I consume a secured web service without providing credentials? I guess the web service is not secured, but why?
I appreciate any tip you can give