Developing Secure Java Web Services, Java EE 6

Size: px

Start display at page:

Download "Developing Secure Java Web Services, Java EE 6"

Augustine McCoy
6 years ago
Views:

1 Developing Secure Java Web Services, Java EE 6 Student Guide DWS-4120-EE6 Rev B D66105GC10 Edition 1.0 June 2010 D67630

2 Copyright 2010, Oracle and/or its affiliates. All rights reserved. Disclaimer This document contains proprietary information, is provided under a license agreement containing restrictions on use and disclosure, and is protected by copyright and other intellectual property laws. You may copy and print this document solely for your own use in an Oracle training course. The document may not be modified or altered in any way. Except as expressly permitted in your license agreement or allowed by law, you may not use, share, download, upload, copy, print, display, perform, reproduce, publish, license, post, transmit, or distribute this document in whole or in part without the express authorization of Oracle. The information contained in this document is subject to change without notice. If you find any problems in the document, please report them in writing to: Oracle University, 500 Oracle Parkway, Redwood Shores, California USA. This document is not warranted to be error-free. Sun Microsystems, Inc. Disclaimer This training manual may include references to materials, offerings, or products that were previously offered by Sun Microsystems, Inc. Certain materials, offerings, services, or products may no longer be offered or provided. Oracle and its affiliates cannot be held responsible for any such references should they appear in the text provided. Restricted Rights Notice If this documentation is delivered to the U.S. Government or anyone using the documentation on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS The U.S. Government s rights to use, modify, reproduce, release, perform, display, or disclose these training materials are restricted by the terms of the applicable Oracle license agreement and/or the applicable U.S. Government contract. Trademark Notice Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

3 This page intentionally left blank.

4 This page intentionally left blank.

5 Contents How to Use Course Materials...xxviii Conventions...xxviii The Traveller Project...xxxi The Auction Project...xxxvi 1 Introduction to Security 1-1 Web Services Web Services Security Security Strategies and Technologies Web Services Security Threats and Countermeasures 2-1 Additional Reading Principles Vulnerabilities Securing Java TM Web Services Using JavaEE 3-1 Underlying Technologies Transport-Layer Security Authentication and Authorization JavaEE Technologies Web Tier Security v

6 CONTENTS CONTENTS Securing a JAX-WS Web Service Using Web-Tier Security Securing a JAX-RS Web Service Using Web-Tier Security Introduction to WS-* Extensions 4-1 Additional Reading Securing Communications Web Services Extensions WS-Policy WS-Addressing WS-Security WS-ReliableMessaging Other WS Extensions Using WS Extensions Web Services Security with JAX-WS and Project Metro 5-1 Additional Reading JAX-WS and Metro WS-Policy WS-Addressing WS-Security Security Policy WS-ReliableMessaging WS-AtomicTransactions Authentication in JAX-WS 6-1 Additional Reading SAAJ vi Developing Secure Java TM Web Services

7 CONTENTS CONTENTS JAAS JAX-WS Handler Framework WSIT Authentication Framework Identity Management and OpenSSO 7-1 Identity and Identity Management OpenSSO A Introduction to SAML A-1 Additional Reading...A-2 Distributed Identity Frameworks...A-3 SAML...A-7 B Alternative Technologies B-1 C Using JAX-WS C-1 Additional Resources...C-2 Overview of JAX-WS...C-3 Creating a Web Service Using JAX-WS...C-9 Creating a Web Service Using JAX-WS: Bottom-Up...C-9 Customizing the JAX-WS Web Service...C-17 Creating a Web Service Using JAX-WS: Top-Down...C-22 Writing a WSDL Description of a Service...C-24 Generating JAX-WS Artifacts...C-27 Schema Validation...C-34 Comparing Development Approaches...C-35 Strong Typing for Web Services...C-35 Benefits and Costs of Starting from a Java Development ApproachC-36 - vii

8 CONTENTS CONTENTS Benefits and Costs of Starting from WSDL Development ApproachC-37 Deploying POJO Web Service Providers...C-38 Debugging Web Service Interactions...C-39 D RESTful Web Services: JAX-RS D-1 Mapping REST Principles to JAX-RS Constructs...D-2 Deploying a JAX-RS Web Service Provider...D-9 E Code Listings E-1 viii Developing Secure Java TM Web Services

9 List of Figures 1 Course Map...xxiv 2 Use Cases for Traveller Project...xxxii 3 Domain Types for Traveller Project...xxxii 4 Application Services for the Traveller Project...xxxiv 5 DAO Classes for the Traveller Project...xxxv 6 Use Cases for Auction System...xxxvi 7 Domain Types for Auction System...xxxix 1.1 Service-Oriented Architecture Loosely Coupled Services SOA Model Characteristics of a Service Technologies for SOA Web Services Architecture Application Security Features Cryptography Symmetric-Key Cryptography Asymmetric-Key Cryptography Digital Certificates Session-Key Cryptography ix

10 LIST OF FIGURES LIST OF FIGURES 1.13 Crypto Mechanisms and Network Layers Message Digests Digital Signatures The Process of Digital Signing Kerberos LDAP Web Services Security Issues Web Services Security Vulnerabilities Web Services Security Model Message-Layer Security Transport-Layer vs Message-Layer Transport-Layer Security TLS Protocol TLS Session HTTPS Securing Web Services Using TLS Java Authentication and Authorization Service JAAS Framework End-to-End Security Model JavaEE Technologies JavaEE Web Services Security Mapping Roles to Users and Groups Basic Authentication Form-Based Authentication Client Certificate Authentication x Developing Secure Java TM Web Services

11 LIST OF FIGURES LIST OF FIGURES 3.15 Propagating Security Identity Simple Approach to Deploying a JAX-RS Web Service Point-to-Point Message Transport Message Transport through Relays Transport- vs Message-Level Security Specifying Policies in WSDL Transport-Dependent Properties HTTP Properties Transport Neutrality Message Addressing Properties WS-MetadataExchange WS-Security and SOAP Envelope WS-Trust Securing SOAP Messages Security-Related SOAP Headers WS-SecureConversation Handshake WS-SecureConversation Authorization via XACML WS-ReliableMessaging WS-ReliableMessaging Conversation SOAP and MTOM MTOM - Binary Payload Optimization WS-AtomicTransaction End-to-End Security JAX-WS Runtime Architecture WSIT Web Services Stack WSIT Programming Model Server-Side Model xi

12 LIST OF FIGURES LIST OF FIGURES 5.4 WSIT Programming Model Client-Side Model Specifying Policies Embedded Specifying Policies Referenced Message Addressing Properties Enabling WS-Addressing Using WSDL Extensions Enabling WS-Addressing Using Policy WS-Addressing Sample SOAP Message Specifying Signed Elements SignedParts Specifying Signed Elements via SignedElements Specifying Encrypted Elements via EncryptedParts Specifying Encrypted Elements via EncryptedElements Syntax of Symmetric Binding Policy Assertion Syntax of Asymmetric Binding Policy Assertion Syntax for Transport Binding Assertion Syntax for Specifying Algorithm Suite WS-Security Sample SOAP Message: Signature Sample SOAP Message: Before Encryption Sample SOAP Message: After Encryption Syntax for SupportingTokens Elements UsernameToken Syntax Enabling WS-Security in NetBeans Security Dialog A Sample SecurityContextToken Enabling WS-SecureConversation WSDL Policy Assertion Enabling WS-SecureConversation NetBeans Dialog Enabling WS-ReliableMessaging WS-ReliableMessaging Sample SOAP Message xii Developing Secure Java TM Web Services

13 LIST OF FIGURES LIST OF FIGURES 6.1 SAAJ Representation A SOAP Message in SAAJ SAAJ API SAAJ and DOM Attachments in SAAJ SOAP Faults in SAAJ JAAS Framework JAAS Application API JAAS Callback JAX-WS Runtime Architecture JAX-WS Handler Types Executing JAX-WS Handlers A More Complex Handler Chain Configuration WSIT Client Programming Model WSIT Server Programming Model Implementing PasswordValidator Identity Challenges Need for Identity Management Transformation of Identity Data Identity Management Solution Identity Management Technologies OpenSSO Architecture Centralized Access Control OpenSSO Components Web Single Sign On xiii

14 LIST OF FIGURES LIST OF FIGURES 7.10 Authentication Using OpenSSO Authorization Using OpenSSO Policy Agents Cross-Domain Single-Sign-On A.1 Essential Roles...A-4 A.2 Identity Data Flow...A-5 A.3 Components of SAML...A-9 A.4 Sample SAML Assertion...A-11 A.5 SAML Assertion Syntax...A-12 A.6 SAML Subject Syntax...A-13 A.7 Sample SAML Authentication Element...A-14 A.8 SAML Authentication Syntax...A-15 A.9 Sample SAML Attribute Element...A-16 A.10 SAML Attribute Syntax...A-17 A.11 Web SSO Use Case...A-21 A.12 SSO Scenarios SP-initiated flow with redirect and POST bindings...a-22 A.13 SSO Scenarios IdP-initiated flow with POST binding...a-24 A.14 SSO Scenarios SSO Using ECPs...A-25 A.15 Identity Federation Use Case...A-26 A.16 Identity Federation Out-of-Band Federation...A-28 A.17 Identity Federation Using Persistent Pseudonyms...A-29 A.18 Identity Federation Using Transient Pseudonyms...A-30 A.19 SAML Authorization...A-31 B.1 Java Security APIs...B-2 xiv Developing Secure Java TM Web Services

15 LIST OF FIGURES LIST OF FIGURES B.2 Java Secure Sockets Extension...B-5 B.3 Java Generic Security Services...B-6 B.4 Java GSS-API...B-7 B.5 Java SASL...B-8 B.6 Using SASL...B-9 B.7 Simple and Protected GSS-API Negotiation Mechanism...B-9 C.1 JAXWS Artifacts...C-5 C.2 Starting From a Java Class...C-10 C.3 Sample SOAP Request for AirportManager...C-15 C.4 Sample SOAP Response from AirportManager...C-15 C.5 Raw SOAP/HTTP Request...C-16 C.6 Raw SOAP/HTTP Response...C-17 C.7 Target Namespace for Application Elements...C-21 C.8 Starting From a WSDL Description...C-23 C.9 Structure of a WSDL file...c-23 C.10 Definition of a Service Using WSDL...C-25 - xv

16 LIST OF FIGURES LIST OF FIGURES xvi Developing Secure Java TM Web Services

17 List of Tables 1 Prefixes and XML Namespaces used in this course...xxx 1.1 Comparison of Crypto Schemes Requirements and Technologies Support for WS-* Standards July Possible Header Layouts JavaEE vs WS-AtomicTransaction C.1 WSDL-to-Java Technology Component Translations...C-6 xvii

18 LIST OF TABLES LIST OF TABLES xviii Developing Secure Java TM Web Services

19 List of Code Examples 3.1 A Secured Web Service Configuring web.xml to secure a JAX-WS web service Configuring Login Options in web.xml Configuring sun-web.xml Retrieving Security Information in a Servlet Retrieving Security Information via Dependency Injection Logging Callers in a Servlet Simple POJO WS Client Authenticating POJO WS Client A Secured JAX-RS Web Service JAX-RS Deployment: Alternative Approach # JAX-RS Deployment: Alternative Approach # Additional Features: Logging in JAXRS Securing Web Service URLs Dependency Injection in JAXRS Logging Callers in JAX-RS Simple Jersey Client Authenticating Jersey Client Sample Web Service Policy Enabling WS-Addressing Using Annotations xix

20 LIST OF CODE EXAMPLES LIST OF CODE EXAMPLES 5.3 Enabling WS-Addressing Specifying Actions Explicitly Using Annotations Sample Authentication Policy Enabling WS-AtomicTransaction Using Policy Assertions Enabling WS-AtomicTransaction Using Annotations Enabling WS-AtomicTransaction Using JTA Transactions Obtaining a LoginContext LoginModule Configuration LoginModule Configuration File LoginModule Configuration File Example A Trivial CallbackHandler A Hardcoded CallbackHandler A Sample LoginModule Interface javax.xml.ws.handler.handler Annotations on JAX-WS Handlers Types of JAX-WS Handler An Authentication Handler Sample Handler Chain Specification A Web Service Associated to a HandlerChain Using a WSDL Customization File Programmatic Configuration of Handlers for a JAX-WS Client A Sample HandlerResolver Sample Authentication Policy Retrieving Authentication Data Specifying a CallbackHandler Static UsernameToken Configuration xx Developing Secure Java TM Web Services

21 LIST OF CODE EXAMPLES LIST OF CODE EXAMPLES 6.21 Specifying Validators C.1 A Simple Service: AirportManager...C-11 C.2 A Simplest Web Service...C-11 C.3 Sample ant task for apt...c-13 C.4 Generated WSDL for AirportManager Class...C-13 C.5 XML Schema Generated for AirportManager...C-14 C.6 Custom WSDL Description: Class NamedAirportManager...C-18 C.7 Customized Generated WSDL...C-18 C.8 Customized Generated XML Schema...C-19 C.9 Capturing Overloaded Methods...C-20 C.10 Generated WSDL Overloaded Operations...C-20 C.11 Custom WSDL Description: Custom Namespace...C-21 C.12 UserDirectory porttype...c-26 C.13 XML Schema Type for addpassenger...c-26 C.14 WSDL Bindings for PassengerManager...C-27 C.15 Generated Java SEI...C-29 C.16 Service Implementation Class...C-30 C.17 Embedded Customization: Package... C-31 C.18 Embedded Customization: Class... C-32 C.19 Embedded Customization: Method... C-32 C.20 Class Generated From Customized WSDL...C-33 C.21 How to Enable Schema Validation...C-34 C.22 Simple Standalone Server...C-38 C.23 Finer Control over Standalone Server...C-39 D.1 JAX-RS IDs Simple Path...D-3 D.2 JAX-RS Path with Embedded Parameters...D-4 - xxi

22 LIST OF CODE EXAMPLES LIST OF CODE EXAMPLES D.3 JAX-RS Path with Form Parameters...D-5 D.4 Use Standard HTTP Methods: GET...D-6 D.5 Use Standard HTTP Methods: POST...D-6 D.6 JAX-RS Support for Multiple Representations...D-7 D.7 JAX-RS Parameters...D-8 D.8 Explicit Declaration of Root Resources...D-9 D.9 Runtime Retrieval of Root Resources...D-10 D.10 Deploying Within a Java VM...D-10 xxii Developing Secure Java TM Web Services

Java Programming Language

Java Programming Language Additional Material SL-275-SE6 Rev G D61750GC10 Edition 1.0 D62603 Copyright 2007, 2009, Oracle and/or its affiliates. All rights reserved. Disclaimer This document contains proprietary