Using property placeholders in Blueprint - here: http-conduit

[uio100]

Dear Forum,

using XML DSl, I'm experiencing difficulties to use property placeholders accessed via the

in attributes nested in the http-conduit configuration. Placeholders work fine on the bean level, but trying to specifiy, for example, paths to key stores and passwords in the http conduit does not work - the properties are not being resolved.

-

---

<http:tlsClientParameters disableCNCheck="true">

            <sec:keyManagers keyPassword="${pmfacade.ssl.keypass}">

                <sec:keyStore type="JKS" password="${pmfacade.ssl.keystorepass}"

                                 file="${pmfacade.ssl.keystore}"/>

            </sec:keyManagers>

            <sec:trustManagers>

                <sec:keyStore type="JKS" password="${pmfacade.ssl.truststorepass}"

                                file="${pmfacade.ssl.truststore}"/>

            </sec:trustManagers>

            <sec:cipherSuitesFilter>

                <!-- these filters ensure that a ciphersuite with

                    export-suitable or null encryption is used,

                    but exclude anonymous Diffie-Hellman key change as

                    this is vulnerable to man-in-the-middle attacks -->

                <sec:include>.EXPORT.</sec:include>

                <sec:include>.EXPORT1024.</sec:include>

                <sec:include>.WITHDES_.</sec:include>

                <sec:include>.WITHAES_.</sec:include>

                <sec:include>.WITHNULL_.</sec:include>

                <sec:exclude>.DHanon_.(FileInputStream.java:79)[:1.6.0_37]

        at org.apache.cxf.configuration.jsse.spring.TLSParameterJaxBUtils.getKeyStore(TLSParameterJaxBUtils.java:123)[170:org.apache.cxf.bundle:2.

Hard-coding paths to keystores and passwords in the blueprint.xml is a no-go - credentials are defintely something the IT production department wants to have their hands on.

Is it just not possible in blueprint and I would have to "fall back" to Spring or am I doing some mistake here?

kind regards

Michael

[ffang]

Hi,

FUSE ESB 4.4.x uaw cxf 2.4.x underlying, which doesn't have blueprint http configuration support yet. Since CXF 2.5.x it has blueprint support, so please use FUSE ESB 7.x if possible.

Freeman

[uio100]

Dear Freeman,

thanks for your reply. I'm experiencing the problems under FuseEnterprise 7.0.1 (70-84) with CXF 2.5.0.fuse-70-084. When trying to configure the http-conduit attributes, properties are not being resolved.

kind regards

Michael

[ffang]

Hi,

Ensure you're using blueprint style OSGi property placeholder,  take a look at this link[1]

as an example.

https://svn.apache.org/repos/asf/servicemix/components/trunk/bindings/servicemix-http/src/main/resources/OSGI-INF/blueprint/servicemix-http.xml

Freeman

[muruga.mani]

Slightly off topic, but still related.  Apologies, if this misleads here.

http:tlsClientParameters doesn't even work for me.  I have to put those values part of the JVM argument to make it work for the HTTPS enabled WS.

[ffang]

Hi,

Most likely your http:conduit name not match the endpoint.

The first thing to notice is the "name" attribute on <http:conduit>. This allows CXF to associate this HTTP Conduit configuration with a particular WSDL Port. The name includes the service's namespace, the WSDL port name (as found in the wsdl:service section of the WSDL), and ".http-conduit". It follows this template: "{WSDL Namespace}portName.http-conduit". Note: it's the PORT name, not the service name. Thus, it's likely something like "MyServicePort", not "MyService". If you are having trouble getting the template to work, another (temporary) option for the name value is simply "*.http-conduit".

If you still can't resolve it, I suggest you create another thread to post your question.

Freeman

[muruga.mani]

Thanks Freeman!  I am using "*.http-conduit".  I will open a new thread.

Edited by: muruga.mani on Nov 13, 2012 3:28 PM