File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
The moose likes Web Services and the fly likes Ws-Security using wss4j Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Java » Web Services
Bookmark "Ws-Security using wss4j" Watch "Ws-Security using wss4j" New topic

Ws-Security using wss4j

D. Rose
Ranch Hand

Joined: Apr 25, 2003
Posts: 215
I have to implement oasis ws-security (using username token) for accessing web service.
Does anybody have experience with wss4j?
Can I use any other open source software?
Any guidance would be helpful.
Rr Kumaran
Ranch Hand

Joined: Sep 17, 2001
Posts: 548
you have below options :

a. you can use WSS4J alone to meet the requirements
b. generate the WS-Security headers/namespace programatically and use IBM XSS/Apache-XML-SECURITY/TSIK etc. to meet the requirements

I have used WSS4J and quite satisfied with that.

RR Kumaran
SCJP 1.4
D. Rose
Ranch Hand

Joined: Apr 25, 2003
Posts: 215
Hi Kumaran,

Is it OK if I mail my wss4j questions ,if any to you? or do you visit here regularly?

Also could you please post some links about using wss4j?

Thanks in advance.
Luis Canizares

Joined: Mar 12, 2005
Posts: 12

WSS4J is good for implementing the standard WSS, some other tools (or API's) you can use jointly could be Apache SOAP or Axis (Axis is helpful for deploying web services including security assertions).

I hope this will be helpful, so if you have any questions just let us know


Luis Canizares
Quito, Ecuador
D. Rose
Ranch Hand

Joined: Apr 25, 2003
Posts: 215

I have installed wss4j and experimenting with it.

It seems wss4j provides default Crypto provider called Merlin.

I tried testing it like

It worked fine when I copied keys subdirectory of wss4j installation in myclasspath.

It is not clear what keys and certificates this subdirectory holds and how they are used.
Is there any good reference for wss4j?
I do not want to test a secure web service client which send user name token.
[ September 19, 2005: Message edited by: D. Rose ]
I agree. Here's the link:
subject: Ws-Security using wss4j
jQuery in Action, 3rd edition