Java Web Services Part 2 - SOAP and REST Security

Build a simple Java web service provider and client that sums two numbers in a step-by-step approach, with emphasis on security and ws standards.

Create the sum ws maven web application in eclipse using a web app archetype, set groupId com.bharath.trainings.ws and artifactId sum ws, and configure src/main/resources, src/main/java, and index.jsp under src/main/webapp.

Create the web services endpoint by building two DTOs for a sum operation. Implement a sumWS interface and its sumWSImpl to return the sum of the two request numbers.

Mark the request and response DTOs with JAXB annotations to enable XML serialization and deserialization for the soap engine, using @XmlType for the root element and @XmlElement for fields.

Configure the CXF endpoint by creating the cxf-servlet.xml, defining a jax-ws server with a unique id and service class, and setting the address to /someWS.

Configure the CXF servlet in web.xml to handle web services requests in a Tomcat deployment, and map it to /services/start with load on startup.

Deploy and run the web application on Tomcat via Maven clean and install, deploy the WAR, and access CXF services and the generated WSDL through the services URL.

Understand why ws standards matter for soap-based web services, defining where authentication data belongs in the soap envelope, header, or body.

Explore WS-Security authentication, confidentiality, integrity, and non-repudiation with a shopping use case, detailing username token, X.509, SAML, encryption, signatures, and timestamp protection.

Configure ws-security with WSS4J inside Apache CXF using interceptors on client and server sides to enable authentication, encryption, signature, and timestamp via passwordCallbackRef and property files.

Understand the username token profile, the primary method to authenticate soap based web services by passing a username and password in the soap header, wrapped by ws-security.

Configure the WSS4J in interceptor in the cxf-servlet.xml to enable username token profile security for the soap endpoint, using a map with action, password type, and password callback.

Create and configure the password callback handler for WSS4J, implementing callback handler, mapping user IDs to passwords in a map, and supplying the password at runtime during username token processing.

Deploy the server-side username token profile authentication, run the app on the server, and validate end-to-end testing by launching the client and loading the page in the browser.

Retrieve the CXF client proxy from the port using CXF's getClient method, then obtain the endpoint to attach in and out interceptors for username token profile support.

Programmatically create the WSS4J out interceptor for username token profile, populate its properties hashmap, and attach it to the endpoint's out interceptors to run before sending the SOAP message.

Configure the username token profile by setting three properties in props, using WS handler constants for action, password type, and the password callback class, then save and format the changes.

Run the end-to-end test to verify authentication, where the client sends a username token in the soap header and the server validates it via the password callback handler.

Demonstrates confidentiality in web services through encryption and decryption, explaining symmetric and public-key cryptography, keys, and concepts like RSA, AES, Blowfish, and private/public keys for secure message exchange.

Explore the Java keytool to generate private and public keys, create and protect a keystore, manage aliases and passwords, and export certificates for client encryption and signature verification.

Generate a key pair with the java keytool by executing genkeypair with alias, key store, and passwords; set validity and name details in the keystore.

Export the public key from the key store using keytool with RFC format to create mycert.cer for client distribution. Then import the certificate into the other key store for encryption.

encrypt the client-to-server message and decrypt it on the server using three steps with WSS 4G interceptors, a keystore property file, and an updated client password callback.

Learn how the trustcacerts flag in keytool allows importing self-signed certificates by using the JDK's trusted CA certificates to establish a trusted certificate chain.

Copy the keystore files into their projects to enable encryption and decryption in the next lecture, organizing a keystore folder under resources for the server and client keystores.

Configure the encryption action and its properties in WSS4J to encrypt the username token alongside the message using the server's public key, keystore, and a properties file.

Create and configure the client keystore properties file for soap and rest security with four properties: keystore path, password, type, and alias to enable client key retrieval and decryption.

Update the password callback handler to return the password for my client key alias and add it to the passwords map, enabling private key retrieval from the keystore for encryption.

Configure server-side decryption by updating CXF-servlet.xml to add the encrypt action and specify the decryption prop file path for decrypt/service keystore properties. Create service keystore.properties to support the decryption step.

Demonstrate end-to-end soap message encryption and decryption by building and running a server-side and client tests with maven, validating encrypted requests and decrypted responses.

Configure server-side encryption by adding a WSS4J out interceptor in the CXF servlet.xml, enabling the encrypt action and using the client key from the encryption property file for encryption.

Enable client-side decryption by configuring WSS4JInInterceptor with the decryption properties and key store, attach it to the endpoint chain, and verify the test passes.

Configure signature on the client to sign outbound messages with the client private key, verifiable by the server using the client public key and a signature property file.

Verify that the server signs messages by configuring the client to enforce a signature in the interceptor, using the client key store for public keys and the server private key.

Explore WS-Security timestamps to prevent replay attacks by defining created and expires times as a time-to-live window, and configure expiry with WSS4J for SOAP messages.

Run the application and the sum ws test, start the server, and examine inbound and outbound soap messages for ws-security timestamps, verifying creation and expiry times, default expiry 300 seconds.

Set the timestamp's time to live to 30 seconds to limit replay attacks, configuring the time to live property and verifying the 30-second expiry window in tests.

Encryption and signatures apply to the soap body; the body is encrypted and the signature is calculated from the soap body, not the header.

Encrypt the signature and the soap body on the server side using a semicolon delimiter, configure cxf-wss4j interceptors, and verify encrypted results in a test.

Include the wsu timestamp in the soap signature to prevent replay attacks by including the timestamp and body in the signature calculation and verifying on the server.