Client AXIS Handler & XML Signature

[Rr Kumaran]

Hi All,

I want to implement an client axis handler that will implement the xml signature using the keystore file's keys, certifcates
and by using xml signature specification implementation frameworks like Apache XML Project, IBM XSS etc.

Basically there is a third party web service provider that verifies the incoming soap messages xml signature and so I
want to write a axis client that sends soap messages with xml signatures implemented on them.

Any ideas on how to proceed on this will be great help.

[Madhu]

Hi,
You will have to write a Axis Client Handler by extending the BasicHandler provided by Axis and register it using client-config.wsdd..Add the client-config.wsdd to the classpath of your server..

[Rr Kumaran]

Hi Madhu,

what is client-config.wsdd ? can you please paste the complete sample source code for client-config.wsdd

if you can paste the source code of the client axis handlers and which xml signature framework you are using then it would be great.

also, I want to implement an axis handler and I am confused with Interface javax.xml.rpc.handler.Handler and Class org.apache.axis.handlers.BasicHandler (implements Interface org.apache.axis.Handler)

In what cases ones uses org.apache.axis.handlers.BasicHandler over implementing avax.xml.rpc.handler.Handler

[Madhu]

Hi Kumar,
Find below a sample client-config.wsdd..

<?xml version="1.0" encoding="UTF-8"?>
<deployment xmlns="http://xml.apache.org/axis/wsdd/" xmlns:java="http://xml.apache.org/axis/wsdd/providers/java">
<globalConfiguration>
<parameter name="adminPassword" value="admin"/>
<parameter name="disablePrettyXML" value="true"/>
<parameter name="sendXsiTypes" value="true"/>
<parameter name="sendMultiRefs" value="true"/>
<parameter name="sendXMLDeclaration" value="true"/>
<requestFlow>
<handler type="java:com.prometric.handlers.DSigHandler">
<parameter name="keystore" value="c:\keystore.jks" />
</handler>
</requestFlow>
</globalConfiguration>

<transport name="http" pivot="java rg.apache.axis.transport.http.HTTPSender"/>

</deployment>

And regarding the implementation of the Handlers it is entirely upto you..

If you implement the Handler interface then you have u override all the methods and provide the implementation..Instead the BasicHandler implements the Handler interface and provides some default implementation of those methods..So u can override just the invoke method of it..

Hope this helps...

[Rr Kumaran]

Hi Madhu,

You are hitting the nail on its head.

In what cases ones uses org.apache.axis.handlers.BasicHandler over implementing avax.xml.rpc.handler.Handler ?

Also, what xml signature framework you are using ... IBM XSS, VeriSign TSIK etc. ?

Can you post your axis handler code as well ?

[Madhu]

Kumar,
Rite now I'm testing with wss4j..
u can also use Apache XML Signature..

[Rr Kumaran]

is wss4j and ibm xss both same ?

can you explain how are you implementing the integration between wss4j, axis handlers both on client side and server side ?

[Madhu]

Kumar,
WSS4J and IBM XSS4J are different..
WSS4J is a open source project from Apache..

In my case the Web Services provider is not under our control..Itz an external system with which we are interacting..

But that doesn't really matter..All it matters is digitally signing the SOAP message..Watever implementation used on the server-side shud b able to validate the signature and process the SOAP request..

[Rr Kumaran]

I have below question. Can you please answer ?

1. Is apache's xss4j more matured than ibm xss, verisign tsik etc. ?

2. In what cases ones uses org.apache.axis.handlers.BasicHandler over implementing avax.xml.rpc.handler.Handler ?

3. I think you need wrap the xss4j framework under axis handlers written by you use these handlers for signing the soap request message (on the client side) and also, write axis handlers on the server side for validating the signature in the soap message. Right ? If so can you please paste your handlers code here ...

Thanks & Regards,

[damon williams]

2. In what cases ones uses org.apache.axis.handlers.BasicHandler over implementing avax.xml.rpc.handler.Handler ?

Implement javax.xml.rpc.handler.Handler when you don't want your solution to be Axis-dependant. There are plenty of other SOAP toolkits out there.

[Rr Kumaran]

Hi Damon,

When you'll go for implementing jax-rpc handler and extending AXIS BasicHandler class ?


Thanks & Regards,

[damon williams]

Originally posted by R Kumar:
Hi Damon,

When you'll go for implementing jax-rpc handler and extending AXIS BasicHandler class ?


Thanks & Regards,

I don't understand your questions