Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

Java Web Services Part 2 - SOAP and REST Security

Master advanced web services concepts and implement them in easy steps

Created byBharath Thippireddy

Last updated 7/2026

English

EnglishJapanese [Auto],

What you'll learn

Develop a simple SOAP service and client
Learn what WS Security is
Master the four security concepts - Authentication Confidentiality Integrity and Non Repudiation
Implement SOAP Web Services security using Apache CXF and WSS4J
Implement Username Token Profile authentication on client and the provider
Understand Encryption and Decryption
Learn how to use the java keytool
Generate and use keys/certificates
Implement Encryption and Decryption
Sign the SOAP messages and ensure message integrity
Enable Timestamps to prevent replay attacks
And much more in the future on this agile style and incremental course

Course content

15 sections • 109 lectures • 4h 22m total length

Instructor and course introduction2:34
Private Course Feedback Link0:14
How to make the best of this course1:53
Maximize your learning in Java web services part 2 with lectures, quizzes (target 70%), and hands-on assignments after setting up JDK, Tomcat, and Eclipse; use free preview and expect updates.
Troubleshooting Maven Projects1:25
Download the completed projects0:55
Download the completed sum ws and sum ws client projects from resources, unzip, and import them as Maven projects in Eclipse; configure the server and run the ws client tests.

Simple Usecase0:46
Create the Project2:32
Create the sum ws maven web application in eclipse using a web app archetype, set groupId com.bharath.trainings.ws and artifactId sum ws, and configure src/main/resources, src/main/java, and index.jsp under src/main/webapp.
Add Maven Dependencies3:13
<properties>

<cxf.version>3.1.9</cxf.version>

</properties>

<build>

<plugins>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-compiler-plugin</artifactId>

<version>3.2</version>

<configuration>

<source>1.8</source>

<target>1.8</target>

</configuration>

</plugin>

<plugin>

<artifactId>maven-war-plugin</artifactId>

<version>2.1</version>

<configuration>

<webXml>src/main/webapp/WEB-INF/web.xml</webXml>

</configuration>

</plugin>

</plugins>

<finalName>sumws</finalName>

</build>

<dependencies>

<dependency>

<groupId>org.apache.cxf</groupId>

<artifactId>cxf-rt-frontend-jaxws</artifactId>

<version>${cxf.version}</version>

</dependency>

<dependency>

<groupId>org.apache.cxf</groupId>

<artifactId>cxf-rt-transports-http</artifactId>

<version>${cxf.version}</version>

</dependency>

<dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-core</artifactId>

<version>3.2.0.RELEASE</version>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-context</artifactId>

<version>3.2.0.RELEASE</version>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-web</artifactId>

<version>3.2.0.RELEASE</version>

</dependency>

</dependencies>
Create the WS Endpoint4:03
Mark with JAXB Annotations2:42
Mark with JAX-WS Annotations1:40
Configure the endpoint3:26
Configure the cxf servlet1:59
Configure the CXF servlet in web.xml to handle web services requests in a Tomcat deployment, and map it to /services/start with load on startup.
Deploy and Run2:27
Deploy and run the web application on Tomcat via Maven clean and install, deploy the WAR, and access CXF services and the generated WSDL through the services URL.

Create the client Project2:01
Generate the Stubs2:53
<properties>

<cxf.version>3.1.9</cxf.version>

</properties>

<build>

<plugins>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-compiler-plugin</artifactId>

<version>3.2</version>

<configuration>

<source>1.8</source>

<target>1.8</target>

</configuration>

</plugin>

<plugin>

<groupId>org.apache.cxf</groupId>

<artifactId>cxf-codegen-plugin</artifactId>

<version>${cxf.version}</version>

<executions>

<execution>

<id>generate-sources</id>

<phase>generate-sources</phase>

<configuration>

<sourceRoot>${basedir}/src/generated</sourceRoot>

<wsdlOptions>

<wsdlOption>

<wsdl>${basedir}/src/main/resources/sumService.wsdl</wsdl>

</wsdlOption>

</wsdlOptions>

</configuration>

<goals>

<goal>wsdl2java</goal>

</goals>

</execution>

</executions>

</plugin>

</plugins>

<finalName>sumwsclient</finalName>

</build>

<dependencies>

<dependency>

<groupId>org.apache.cxf</groupId>

<artifactId>cxf-rt-frontend-jaxws</artifactId>

<version>${cxf.version}</version>

</dependency>

<dependency>

<groupId>org.apache.cxf</groupId>

<artifactId>cxf-rt-transports-http</artifactId>

<version>${cxf.version}</version>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-core</artifactId>

<version>3.2.0.RELEASE</version>

</dependency>

<dependency>

<groupId>org.apache.cxf</groupId>

<artifactId>cxf-rt-ws-security</artifactId>

<version>${cxf.version}</version>

</dependency>

<dependency>

<groupId>commons-httpclient</groupId>

<artifactId>commons-httpclient</artifactId>

<version>3.1</version>

</dependency>

<dependency>

<groupId>commons-codec</groupId>

<artifactId>commons-codec</artifactId>

<version>1.9</version>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-context</artifactId>

<version>3.2.0.RELEASE</version>

</dependency>

<dependency>

<groupId>junit</groupId>

<artifactId>junit</artifactId>

<version>4.4</version>

</dependency>

</dependencies>
Create the client and test4:41
Enable CXF logging2:02

What is Username Token Profile?1:00
Steps to Configure Username Token Profile0:30
Update the maven dependencies1:46
<dependency>

<groupId>org.apache.cxf</groupId>

<artifactId>cxf-rt-ws-security</artifactId>

<version>${cxf.version}</version>

</dependency>

<dependency>

<groupId>commons-httpclient</groupId>

<artifactId>commons-httpclient</artifactId>

<version>3.1</version>

</dependency>

<dependency>

<groupId>commons-codec</groupId>

<artifactId>commons-codec</artifactId>

<version>1.9</version>

</dependency>
Configure User Name Token Profile3:47
Configure the WSS4J in interceptor in the cxf-servlet.xml to enable username token profile security for the soap endpoint, using a map with action, password type, and password callback.
Create and configure the PasswordCallbackHandler5:09
Create and configure the password callback handler for WSS4J, implementing callback handler, mapping user IDs to passwords in a map, and supplying the password at runtime during username token processing.
Run the application on the server1:24
Update Client Maven Dependencies1:02
Retrieve the CXF Client Proxy1:16
Create the WSSJ Interceptors Programmatically1:39
Programmatically create the WSS4J out interceptor for username token profile, populate its properties hashmap, and attach it to the endpoint's out interceptors to run before sending the SOAP message.
Configure the properties2:19
Configure the username token profile by setting three properties in props, using WS handler constants for action, password type, and the password callback class, then save and format the changes.
Run the test2:20
WS Security - Authentication

Confidentiality Introduction4:03
Demonstrates confidentiality in web services through encryption and decryption, explaining symmetric and public-key cryptography, keys, and concepts like RSA, AES, Blowfish, and private/public keys for secure message exchange.
The Java keytool1:22
Generate a key pair using the keytool5:23
Generate a key pair with the java keytool by executing genkeypair with alias, key store, and passwords; set validity and name details in the keystore.
Export the public certificate2:04
Encryption and Decryption Concepts

Steps to enable Encryption0:43
Create the Key Pairs6:20
keytool -genkey -keyalg RSA -sigalg SHA1withRSA -validity 600 -alias myservicekey -keypass skpass -storepass sspass -keystore serviceKeystore.jks -dname "cn=Bharath"

keytool -genkey -keyalg RSA -sigalg SHA1withRSA -validity 600 -alias myclientkey -keypass ckpass -storepass cspass -keystore clientKeystore.jks -dname "cn=Bharath"
Export the public keys3:03
keytool -export -rfc -keystore clientKeystore.jks -storepass cspass -alias myclientkey -file MyClient.cer

keytool -export -rfc -keystore serviceKeystore.jks -storepass sspass -alias myservicekey -file MyService.cer
Import the certificates2:07
keytool -import -trustcacerts -keystore serviceKeystore.jks -storepass sspass -alias myclientkey -file MyClient.cer -noprompt

keytool -import -trustcacerts -keystore clientKeystore.jks -storepass cspass -alias myservicekey -file MyService.cer -noprompt
The trustcacerts Flag1:15
Copy the keystores to projects1:05
Copy the keystore files into their projects to enable encryption and decryption in the next lecture, organizing a keystore folder under resources for the server and client keystores.
Configure Encryption Action and Properties1:49
Configure the encryption action and its properties in WSS4J to encrypt the username token alongside the message using the server's public key, keystore, and a properties file.
Create the property file2:48
Update the PasswordCallbackHandler0:44
Add decryption action1:27
Configure server-side decryption by updating CXF-servlet.xml to add the encrypt action and specify the decryption prop file path for decrypt/service keystore properties. Create service keystore.properties to support the decryption step.
Create the property file1:08
Update the PasswordCallbackHandler0:25
Test encryption and decryption3:16
Demonstrate end-to-end soap message encryption and decryption by building and running a server-side and client tests with maven, validating encrypted requests and decrypted responses.
What just happened?1:32
Enable encryption on the Server2:37
Enable Decryption on the client4:22

What are Signatures?2:27
Configure Signature on the client1:59
Configure signature on the client to sign outbound messages with the client private key, verifiable by the server using the client public key and a signature property file.
Run the test and verify the signature0:45
Configure to check for signature on the Server1:46
Sign the message on the server1:14
Verify the signature on the client2:01
Verify that the server signs messages by configuring the client to enforce a signature in the interceptor, using the client key store for public keys and the server private key.
Integrity

Introduction1:22
Encryption and signatures apply to the soap body; the body is encrypted and the signature is calculated from the soap body, not the header.
Encrypt the Signature Part on the Client4:09
Encrypt the Signature Part on the Provider and Test4:07
Encrypt the signature and the soap body on the server side using a semicolon delimiter, configure cxf-wss4j interceptors, and verify encrypted results in a test.
Use Timestamp Part in the Signature4:14
Include the wsu timestamp in the soap signature to prevent replay attacks by including the timestamp and body in the signature calculation and verifying on the server.

Requirements

Complete my Java Web Services Course on UDemy
Or Should Have Apache CXF and SOAP and REST Web Services Knowledge

Description

The ONLY Course That Covers SOAP and REST Web Services Security Comprehensively!

What Students Are Saying

“Straight to the point. I was looking for an alternative to Axis2/Rampart for SOAP WS-Security, and I’m glad I found this course. As a nice bonus (for me at least), this course also covers REST security.”

“I have completed both the Web Services courses by Bharath. They are extremely knowledgeable and provide real-world experience. I was able to use the same examples in my company. Now I am planning to take the Create REST APIs using Spring Data REST course by Bharath. Friends, go for the course—you won’t regret it!”
— Vivek Kumar Gupta

“Awesome! Completed up to Encryption & Decryption. Clear explanation. So far, so good.”
— Brady Adams

What You’ll Get

All source code available for download
Responsive instructor — all questions answered within 24 hours
Professional-quality video and audio recordings (check the free preview lectures)

This course is a continuation of my Java Web Services course, one of the most popular Java Web Services courses on Udemy.

If you’re interested in learning and implementing advanced Web Services concepts such as Security, this course is for you.

This is an evolving course, and new topics such as OAuth, Asynchronous Communication, and other advanced Web Services concepts will continue to be added.

What You’ll Learn

Do you want to master the four key security areas and secure your SOAP Web Services?

This course simplifies the concepts through clear explanations and step-by-step implementations. By the end of this course, you will be able to:

Understand the four key security areas.
Use the WS-Security standard to secure your services.
Implement Authentication.
Understand encryption and why it is essential.
Generate security key pairs using the Java Keytool.
Implement Encryption and Decryption on both the Web Service client and provider.
Learn what SOAP message signing is, why it is needed, and how to implement it.
Prevent replay attacks by enabling Timestamps.
Learn additional advanced SOAP and REST Web Services topics as they are added to the course.

Who this course is for:

Students who have completed my Java Web Services Course on UDemy
or Students with strong SOAP and REST web services knowledge
Student who want to master the security concepts and implementation
Students who want to learn and implement advanced web services concepts

Java Web Services Part 2 - SOAP and REST Security

What you'll learn

Explore related topics

Course content

Start Here5 lectures • 7min

SOAP Web Service Creation9 lectures • 23min

SOAP Web Service Client Creation4 lectures • 12min

SOAP WS Standards Concepts3 lectures • 9min

WS Security - Authentication11 lectures • 22min

Encryption and Decryption Concepts4 lectures • 13min

WS Security - Confidentiality(Encryption/Decryption)16 lectures • 35min

WS Security - Integrity (Signatures)6 lectures • 10min

WS Security - Non Repudiation (Timestamp)4 lectures • 7min

Securing parts of the message4 lectures • 14min

Requirements

Description

Who this course is for: