Showing posts with label ws security. Show all posts
Showing posts with label ws security. Show all posts

Friday, May 13, 2016

What is a nonce? (15/250-2016)

In cryptography, a nonce is an arbitrary number that may only be used once.
It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks.

May include 

  • timestamp (requires clock synchronization between organizations)







Reference:
https://en.wikipedia.org/wiki/Cryptographic_nonce

Wednesday, April 22, 2015

What is a SOAPHandler in WS-Security? (41 of 285 technotes for 2015)



SOAP handler is a SOAP message interceptor, which is able to intercept incoming or outgoing SOAP message and manipulate its values.

“javax.xml.ws.handler.soap.SOAPHandler” is the Interface which needs to be implemented by someone who wants to use the SOAP Handler.

It inherits 4 methods namely
  • getHeaders() 
  • close()
  • handleFault()
  • handleMessage()
Any implementation of SOAPHandler interface will implement the handleMessage() operation to intercept the SOAP message.

SampleCode:

public boolean handleMessage(SOAPMessageContext context) {
Boolean isOutboundMessage = (Boolean) context.get(MessageContext.MESSAGE_OUTBOUND_PROPERTY);
if (isOutboundMessage) {
SOAPPart messageSoapPart = context.getMessage().getSOAPPart();
WSSecHeader securityHeader = new WSSecHeader();
try {
securityHeader.insertSecurityHeader(messageSoapPart);
} catch (WSSecurityException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
Map map = new HashMap();
map.put(Constants.MAPPING_ALIAS, “CT_J2C_FDSH_ALIAS”);
CallbackHandler callbackHandler = null;
LoginContext loginContext = null;
try {
callbackHandler = WSMappingCallbackHandlerFactory.getInstance().getCallbackHandler(map, null);
loginContext = new LoginContext(“DefaultPrincipalMapping”, callbackHandler);
loginContext.login();
Subject subject = loginContext.getSubject();
Set credentials = subject.getPrivateCredentials();
PasswordCredential passwordCredential = (PasswordCredential) credentials.iterator().next();
String userid = passwordCredential.getUserName();
String password = new String(passwordCredential.getPassword());
WSSecUsernameToken usernameToken = new WSSecUsernameToken();
usernameToken.setPasswordType(WSConstants.PASSWORD_DIGEST);
usernameToken.setUserInfo(userid, password);
WSSecTimestamp timestamp = new WSSecTimestamp();
usernameToken.build(messageSoapPart, securityHeader);
timestamp.build(messageSoapPart, securityHeader);
} catch (Exception e) {
System.out.println(“FDSHJavaHandler - Exception occured while loggin in”);
}
}
return true;
 

Tuesday, March 31, 2015

What is WS-Security (Web Services)? (15 of 285 technotes for 2015)

What is WS Security?

WS-Security addresses how to maintain a secure context over a multi-point message path.

  • Secure services beyond SSL over HTTP (HTTPS) (see http://bit.ly/1afA8Kg for more info)
  • SOAP header extensions for end-to-end SOAP messaging security 
  • Uses
    • XML Signature & Encryption - ways to encrypt and sign contents of XML message
    • XML Cannonicalization - making XML ready for signing and encrypting
  • WS-Security gives a framework to embed the above mentioned technologies into SOAP message - using a transport neutral fashion.