Re: AXIS2 - Security Policy Problem (Is this a bug?)

typolicy/IncludeToken/Never";> >> > >> >> > >> >> > >> >> > >> >> > >> > >> >

Re: AXIS2 - Security Policy Problem (Is this a bug?)

; > > > > > > > > > > >

Re: AXIS2 - Security Policy Problem (Is this a bug?)

g.apache.ws.security.crypto.merlin.keystore.type">JKS >name="org.apache.ws.security.crypto.merlin.file">client.jks >name="org.apache.ws.security.crypto.merlin.keystore.password">apache > > > > > > > > When I am running the 2nd client its working fine, since second client's > policy matches the service's 's first element, and if I am > running the 1'st client I am getting the error > "org.apache.axis2.AxisFault: Message is not signed" > > In service if I am switching the policy sequences, then the 1'st client > works fine and second client gives error. > > As per sepecification it should work for both client, Can anybody tell me > what I am doing wrong? > > Thanks in advance, > Amitesh > -- View this message in context: http://www.nabble.com/AXIS2---Security-Policy-Problem-tp24314266p24358644.html Sent from the Axis - User mailing list archive at Nabble.com.

AXIS2 - Security Policy Problem

signed" In service if I am switching the policy sequences, then the 1'st client works fine and second client gives error. As per sepecification it should work for both client, Can anybody tell me what I am doing wrong? Thanks in advance, Amitesh -- View this message in context: http://www.nabble.com/AXIS2---Security-Policy-Problem-tp24314266p24314266.html Sent from the Axis - User mailing list archive at Nabble.com.

Re: can't get axis2 security working for client code

Hi, I saw the policy in the article. You simply can append the few lines to the policy in the article. You can build assertions by hand using builders, but i don't see that is necessary. org.apache.ws.secpolicy12.builders.WSS10Builder Thank you, Dimuthu Peter Kempf wrote: Thanks! Yes,

Re: can't get axis2 security working for client code

Thanks! Yes, I was able to get this working if I attached an actual policy file. I looked to sample02 in rampart http://svn.apache.org/viewvc/webservices/rampart/trunk/java/modules/rampart-samples/policy/sample02/src/org/apache/rampart/samples/policy/sample02/Client.java?view=markup Using this

Re: can't get axis2 security working for client code

Hi, Please add the following assertion at the AsymmetricBinding assertion level. http://schemas.xmlsoap.org/ws/2005/07/securitypolicy";> Thank you, Dimuthu Peter Kempf wrote: Using Axis2 1.4.1, Rampart 1.4, eclipse 3.4,

can't get axis2 security working for client code

Using Axis2 1.4.1, Rampart 1.4, eclipse 3.4, jdk 1.5 I am unable to get the security to work. I am basing it on this article https://wso2.org/library/3415 only I'm running in eclipse. This is the exception I get when I execute. Any ideas what I'm doing wrong? Obviously I'm missing something, prob

axis2 security

wards. -- View this message in context: http://www.nabble.com/axis2-security-tp1831p1831.html Sent from the Axis - User mailing list archive at Nabble.com. - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional comm

RE: Axis2 Security Phases

Hi, Thanks for that Dimuthu!> Subject: Re: Axis2 Security Phases> From: [EMAIL PROTECTED]> To: axis-user@ws.apache.org> Date: Wed, 16 Apr 2008 10:27:51 +0530> > Hi,> > Please see my comments inline.> > On Tue, 2008-04-15 at 05:31 +, shams jawaid wrote

Re: Axis2 Security Phases

Hi, Please see my comments inline. On Tue, 2008-04-15 at 05:31 +, shams jawaid wrote: > Hi there, > > I had a question on what phase Rampart operates on, in Axis2. > > In this axis2 configuration file, in the InFlow settings, i see > "Security" right before pre-Dispatch. In the OutFlow

Re: Multiple Axis2 security mechanisms for a given web service

Hi Ted, On Fri, 2008-04-11 at 08:54 -0500, Ted Jones wrote: > Is it possible to have Rampart engaged for a web service but also > allow support for HTTPBasic, or is it just one or the other? It is just one or the other. What you can do is host two web services. Thank you, dimuthu > > TIA, > T

Axis2 Security Phases

Hi there, I had a question on what phase Rampart operates on, in Axis2. In this axis2 configuration file, in the InFlow settings, i see "Security" right before pre-Dispatch. In the OutFlow settings, i see "security" after Message Out. Am i right in assuming, that in the InFlow settings,

Multiple Axis2 security mechanisms for a given web service

Is it possible to have Rampart engaged for a web service but also allow support for HTTPBasic, or is it just one or the other? TIA, Ted

Re: Axis2 Security with Rampart

Thank you so much Paul! I got it work following your advice. I still have a question though: why did I spend so much time trying to figure it out by myself when I could've just emailed you guys!? :) I'm so mad now! Paul Fremantle <[EMAIL PROTECTED]> wrote: Yep you need some kind of policy to t

Re: Axis2 Security with Rampart

Yep you need some kind of policy to tell Rampart what parts of WS-Security to implement. Take a look at rampart-1.3\samples\policy\sample01 Paul On Jan 4, 2008 5:15 PM, red dog <[EMAIL PROTECTED]> wrote: > Hi Paul, > > So do i still need a policy file even if i send the pair username/password >

Re: Axis2 Security with Rampart

Hi Paul, So do i still need a policy file even if i send the pair username/password in clear text? Sorry, it seems I missed this part when I read the how-to steps. Thank you. Paul Fremantle <[EMAIL PROTECTED]> wrote: What is your rampart config/policy. If you just enable Rampart but

Re: Axis2 Security with Rampart

What is your rampart config/policy. If you just enable Rampart but don't give it any configuration it doesn't do much. Paul On Jan 4, 2008 4:51 PM, red dog <[EMAIL PROTECTED]> wrote: > Reg. message ID: BAY108-DAV6AE19CD9C371CBB93AB9CAE930 () phx ! gbl > > > Hi everyone, > > Is there any resolutio

Axis2 Security with Rampart

Reg. message ID: BAY108-DAV6AE19CD9C371CBB93AB9CAE930 () phx ! gbl Hi everyone, Is there any resolution to this? I'm facing the same issue and I'm using Axis 2 and rampart module 1.3. If I just send a SOAP message with an empty security header my method gets called. POST

Re: axis2: Security for SwA

I concur with Paul -- a better solution is to use MTOM in place of SwA. If you must use SwA, then you will need to use a combination of SSL and WS-Security. See the WS-I Basic Security Profile for advice. http://www.ws-i.org/Profiles/BasicSecurityProfile-1.0.html. Anne On Dec 14, 2007 1:24 PM, Pa

Re: axis2: Security for SwA

The reason Rampart doesn't support SwA security is not solved by a little bit of policy! The problem is that Rampart is based on XML security and the SwA message is not in XML. A much simpler solution is to move to use MTOM which is more interoperable and is fully supported in every aspect by Rampa

axis2: Security for SwA

Hi, We have implemented Axis2 for trading SOAP messages. As described by Axis2, we are using the Rampart module and Neethi policy to implement SOAP security. However, Rampart doesn't support SwA(SOAP with Attachment) security. Hence, I am trying to create a custom policy, which I can add it as pol

Re: Axis2 Security with Rampart

t;Andreas Fey" <[EMAIL PROTECTED]> > To: > Sent: Wednesday, October 31, 2007 9:21 AM > Subject: Axis2 Security with Rampart > > > > Hi, > > > > i recently tried to secure our webservices with rampart. I did this > > first for all webservice methods

Re: Axis2 Security with Rampart

Hello Andreas- which version Rampart are you using? Thanks/ Martin-- - Original Message - From: "Andreas Fey" <[EMAIL PROTECTED]> To: Sent: Wednesday, October 31, 2007 9:21 AM Subject: Axis2 Security with Rampart > Hi, > > i recently tried to secure our webser

Axis2 Security with Rampart

Hi, i recently tried to secure our webservices with rampart. I did this first for all webservice methods, and it worked well (after several hours of unsuccessfull tries...). But now, some of these methods have to be unsecured to enable simple access for guest users. I left everything unchanged e

Re: [Axis2] security headers missing

The fault was caused by the fact that the security headers in the SOAP request did not contain a timestamp. This is not mentioned anywhere in the rampart samples included with the distribution. Is it possible to require only a user and password without a timestamp? Axis2 1.1 and Rampart 1.1

[Axis2] Security runAs() Method Wrapper for invokeBusiness Login

Hi, The axis2 1.2 web service we are implementing is a front layer for our J2EE business application to be used by some internal client applications. i.e Web Service is a j2ee client for the j2ee application server. The J2EE application is using JAAS authentication. The same application may run in

Re: Axis2: Security phase (Rampart) alters response

Subject Re: Axis2: Security phase (Rampart) Please respond to alters response [EMAIL PROTECTED]

Re: Axis2: Security phase (Rampart) alters response

apache.org cc 08-02-2007 09:47 Subject Re: Axis2: Security phase (Rampart)

Re: Axis2: Security phase (Rampart) alters response

Hi, Can you please create a JIRA issue and add the WSDL. I'll try to reproduce the issue. Axis2: Security phase (Rampart) alters response Thanks, Ruchith On 2/8/07, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: Hi, I have registered a strange behaviour with Axis2 1.1.1 and ramp

Axis2: Security phase (Rampart) alters response

Hi, I have registered a strange behaviour with Axis2 1.1.1 and rampart 1.1. It seams like rampart alters the soap body response. Below are two soap response messages, taken with soapUI. One with Rampart enabled and one without. As you can see the elements in RetrieveFolderURIResponse isn't the s

Re: Axis2 - Security (Please Help)

Hi Sridhar, On 11/4/06, Sridhar <[EMAIL PROTECTED]> wrote: Hello, This could be a lengthy post, any help would be greatly appreciated. I'm a newbie in web services. Started a week back learning web services. I wrote a sample service and client using axis2 and don't have any problems. Co

Axis2 - Security (Please Help)

Hello,    This could be a lengthy post, any help would be greatly appreciated.  I'm a newbie in web services. Started a week back learning web services. I wrote a sample service and client using axis2 and don't have any problems. Coming to the real time application, I have to consume a Webserv

Re: axis2: security sample (about the names)

Hi Dmitry, Please check whether the value of the "" element of the services.xml is the alias of the private key you want to use at the service to sign the response. Thanks, Ruchith On 9/11/06, Dmitry Brigadirov <[EMAIL PROTECTED]> wrote: Yeah, I saw it... I can configure it on the client side

Re: axis2: security sample (about the names)

Yeah, I saw it... I can configure it on the client side at axis2.xml - everything works fine with any name here.But  I get this error on the Service-side.Service and client have the same pwcallback class, and the same keystroke file. Can service keep 'name' values anywhere else?Thanks,Dmitry

Re: axis2: security sample (about the names)

Please try this: http://www.wso2.net/kb/116 Thanks, Ruchith On 9/11/06, Dmitry Brigadirov <[EMAIL PROTECTED]> wrote: I've asked about generating own certificates for Axis here: http://marc.theaimsgroup.com/?l=axis-user&m=115770741811175&w=2 and was pointed to the page "Setting Up Keystores for

axis2: security sample (about the names)

I've asked about generating own certificates for Axis here: http://marc.theaimsgroup.com/?l=axis-user&m=115770741811175&w=2and was pointed to the page "Setting Up Keystores for a Client and a Service". I've managed to generate a working keystroke, but they only work with names "alice" and "bob" as

Re: axis2: security sample

Hi..> There is a  sample sec.jks file in the Axis2 security example containing> private/public keys.> I wish to generate my own file..> Can you please point to some readings how can I, or just tell the way how > this file was generated ( i.e. keytool parameters)>> Thanks>&

Re: axis2: security sample

Pls try this: http://www.wso2.net/tutorials/rampart/java/2006/06/29/setting-up-keystores Thanks, Ruchith On 9/8/06, Dmitry Brigadirov <[EMAIL PROTECTED]> wrote: Hi.. There is a sample sec.jks file in the Axis2 security example containing private/public keys. I wish to generate my ow

axis2: security sample

Hi..There is a  sample sec.jks file in the Axis2 security example containing private/public keys.I wish to generate my own file..Can you please point to some readings how can I, or just tell the way how this file was generated ( i.e. keytool parameters)Thanks-- Dmitry Brigadirov

Re: Axis2 security flaw?

In this light: chmodding the whole axis2 directory to 600 isn't a good practice, since it must remain accessible (chmod -x to a directory prevents access). Is it sufficient to chmod conf/axis.xml to read-only, or are there other files that must be protected? Bram Op Friday 12 mei 2006 20:43,

Re: Axis2 security flaw?

When building the "axis2.war" we use the ant:war [1] task and this is an extension of the ant:jar task[2]. The ant:jar task is not capable of preserving the file permissions hence I believe war task inherits the same incapability. The only way to preserve preserve file permissions that I have com

Re: Axis2 security flaw?

Thinking about this a little more, actually you're right. Looking at tomcat - which you seem to be using - all the files under conf are already set to 600. Could you file a jira? Robert http://www.braziloutsource.com/ On 5/12/06, Bram Biesbrouck <[EMAIL PROTECTED]> wrote: I know, but why doesn't

Re: Axis2 security flaw?

I know, but why doesn't the default behaviour doesn't do that? I guess there are a LOT of servers out there with that file in the open... b. Op Friday 12 mei 2006 16:30, schreef robert lazarski: > Try: > > chmod 600 /var/lib/tomcat4/webapps/axis2 > > > /WEB-INF/conf/axis2.xml > > That'll make the

Re: Axis2 security flaw?

Try: chmod 600 /var/lib/tomcat4/webapps/axis2 /WEB-INF/conf/axis2.xml That'll make the file read / writable by only the owner. Other accounts won't be able to access it. To make it read-only by only the ownew: chmod 400 /var/lib/tomcat4/webapps/axis2 /WEB-INF/conf/axis2.xml HTH, Robert ht

Axis2 security flaw?

Hi all, When I deploy axis2.war in Tomcat, the file /var/lib/tomcat4/webapps/axis2/WEB-INF/conf/axis2.xml (where the admin-pass is stored) is readable by all users on the system. I'm using Debian sarge (stable). Am I missing something or is this a serious security issue? Bram

Re: [axis2] Security

; > > > > -Original Message- > From: Ruchith Fernando [mailto:[EMAIL PROTECTED] > Sent: quarta-feira, 22 de Março de 2006 15:52 > To: axis-user@ws.apache.org > Subject: Re: [axis2] Security > > Hi Ameet, > > In the case of the security module... simply en

RE: [axis2] Security

, with the same contents as of the server, including the same configuration parameters of the service Thanks, Ameet -Original Message- From: Ruchith Fernando [mailto:[EMAIL PROTECTED] Sent: quarta-feira, 22 de Março de 2006 15:52 To: axis-user@ws.apache.org Subject: Re: [axis2] Security

Re: [axis2] Security

Hi Ameet, In the case of the security module... simply engaging the module is not sufficient. You also have to provide security module configuration with respect to the service in the service.xml file. This behaviour is useful since we will be just able to turn on security for a given service a

[axis2] Security

Hi all,   For testing purposes, I included in axis2.xml (0.94), downloaded security-0.94.mar to modules folder and restarted Tomcat (5.5.12). Then I tried to call the service from the client (without any modification), expecting that the service would throw some exception or error back t

[axis2] security manager error

Hi all, I'm deploying axis2 (war) in a Tomcat5 container (on Debian Sarge), and the Java security manager presents me with read/write permission errors when accessing the validation page. They are fixed by adding following lines to /etc/tomcat5/policy.d/04webapps.policy : permission java.util.P

Re: [Axis2] Security sample throws "Cannot find any provider supporting AES/CBC/ISO10126Padding" exception

Hi Ali, I just checked the security sample in the std-dist created using the svn head the ... we have to do a quite a few changes to it to get it working (updating the client's axis.xml file, adding the missing jars, etc)... I will make sure this will be fixed and will be made available for the ne

Re: [Axis2] Security sample throws "Cannot find any provider supporting AES/CBC/ISO10126Padding" exception

Hi Ruchith,Thank you very much for your quick response. I downloaded bcprov-jdk13-128.jar and put it under ...\axis2\lib folder. It did not work. Also tried bcprov-jdk14-128.jar and bcprov-jdk15-128.jar. Did not work either.Thanks again.Ali Sadik KumlaliRuchith Fernando <[EMAIL PROTECTED]> wrote: H

Re: [Axis2] Security sample throws "Cannot find any provider supporting AES/CBC/ISO10126Padding" exception

Hi, >From the trace you posted it seems like you are missing the bouncycastle library (bcprov-jdk13-128.jar). But the security module should contain these (all related third party jars) and its expected to work without having any additional jars in the classpath. I will check on this. Thanks,

[Axis2] Security sample throws "Cannot find any provider supporting AES/CBC/ISO10126Padding" exception

Dear all,I got several exceptions when trying out security sample found in ...\samples\security. There is a consice README.txt file under the folder. By following the instructions in the README.txt, I ran the ant script and got my first exceptions related with the missing libraries: xmlsec-1.3.0.ja

Re: [axis2] Problem with Websphere 6 and Axis2 security module

ct? > > Best Regards, > Johan Andersson > > -Original Message- > From: "Johan Andersson" <[EMAIL PROTECTED]> > To: axis-user@ws.apache.org > Date: Thu, 23 Feb 2006 13:58:01 +0100 > Subject: Re: [axis2] Problem with Websphere 6 and Axis2 security mo

Re: [axis2] Problem with Websphere 6 and Axis2 security module

Hello, Should I log a JIRA for this and if so on what project? Best Regards, Johan Andersson -Original Message- From: "Johan Andersson" <[EMAIL PROTECTED]> To: axis-user@ws.apache.org Date: Thu, 23 Feb 2006 13:58:01 +0100 Subject: Re: [axis2] Problem with Websphere 6 an

Re: [axis2] Problem with Websphere 6 and Axis2 security module

nando" <[EMAIL PROTECTED]> To: axis-user@ws.apache.org Date: Thu, 23 Feb 2006 12:25:08 +0600 Subject: Re: [axis2] Problem with Websphere 6 and Axis2 security module Hi, RE: Problem #2: > > Caused by: java.lang.RuntimeException: Unable to create &

Re: [axis2] Problem with Websphere 6 and Axis2 security module

Hi, RE: Problem #2: > > Caused by: java.lang.RuntimeException: Unable to create > nullNodejava.lang.NullPointerException > at > org.apache.xml.security.c14n.implementations.CanonicalizerBase.(Unknown > Source) The Axis2 security module contains the wss4j-SNAPSH

[axis2] Problem with Websphere 6 and Axis2 security module

Hello, I have some issues when trying to run Axis2 version 0.94 in Websphere 6 with the security module engaged. Please note that the services do not actually perform any encryption/signing etc, the module is only engaged in the axis2.xml. Problem no 1: - In Websphere 6 on WinXP.

Re: Axis2 security

If you are using tomcat, you can use org.apache.catalina.valves.RemoteAddrValve (see http://www.jguru.com/faq/view.jsp?EID=445942 for example and google for more example) -- dims On 8/20/05, Dave Hoffer <[EMAIL PROTECTED]> wrote: > Using Axis2, how can I limit what clients can access my web servi

Axis2 security

Using Axis2, how can I limit what clients can access my web services? What if I want to limit it to localhost, or a range of IP addresses? -dh