Dynamic address for Cxf Endpoint for external service with WSS UserToken

[rvojjala]

We have a requirement to intercept any call with URL certain pattern and rewrite the URL such that it points to an external web service.

To explain the requirement with an example:

Client application submits a SOAP request on a url

                    http://MyServer.com/ServicemixContext/services/HelloService/1.0

My application in (MyServer.com) should intercept any request with URL pattern       "http://MyServer.com/ServicemixContext" and construct another endpoint that points to an external service such as "http://ExternalServer.com/services/HelloService/1.0" and route the payload to this external service.

I am able to achieve this part for a service that did not require any authentication details using :

Above code worked fine.

Now, I need to pass WSS UsernameToken details as a SOAP header to the external service.

I am new to Servicemix/Camel/CXf world.

Please help me with your advice. Appreciate your response.

Edited by: rvojjala on Mar 6, 2013 12:22 PM

Edited by: rvojjala on Mar 6, 2013 7:38 PM

Edited by: rvojjala on Mar 6, 2013 7:40 PM

[davsclaus]

Does the client include the WSS UsernameToken  in the first place? Or do you need to add that yourself in the Camel route?

[rvojjala]

Thanks for the response.

WSS UsernameToken needs to be added in the Camel route for the external service.

Appreciate if you could give me any pointers.

[davsclaus]

Well the SOAP message can be represented in text/xml that is send over HTTP. So if you can add the WSS UsernameToken as a blob of xml then you can add that into the message body from the jetty.

For example from a java bean you can do

public String enrichWithUsernameToken(String xml) {
   // add the username into the xml
   return enriched;
}

You can use the Document API if that is easier

public Document enrichWithUsernameToken(Document dom) {
   // add the username into the xml
   return enriched;
}

[davsclaus]

Though if you are using Apache CXF it has some security functionality which you can read about

http://cxf.apache.org/docs/security.html

Though using CXF can be a configuration hell, as its sometimes verbose and confusing to configure properly.

Also you can check out the WebService Security Guide here

https://access.redhat.com/knowledge/docs/Fuse_ESB_Enterprise/

[davsclaus]

If the incoming SOAP message is not secure at all, then I think this is more difficult. And you may want to use the Apache CXF instead of the http component, to call the web-service. As Apache CXF supports WS-Secure and you can configure it to use the WS UserName token and whatnot. See the links I provided.

Though its not easy to configure and use IMHO. But that is the WS-* world.

[rvojjala]

Thanks a lot for your valuable inputs. I will try to implement the ideas you gave and let you know.