Encrypting a SOAP message

[Andrew Braithwaite]

I have written the code below to send a soap message built from a file to a webservice. It does exactly what I want, but I need to encrypt the message using TLS. Can anybody give me any pointers on how to go about doing this?

public static String sendPDSMessage(String destination, String messageFilename)
{
StringBuffer result = new StringBuffer();

try
{
// First create the connection
SOAPConnectionFactory soapConnFactory = SOAPConnectionFactory
.newInstance();
SOAPConnection connection = soapConnFactory.createConnection();
 
// Next, create the actual message
MessageFactory messageFactory = MessageFactory.newInstance();
SOAPMessage message = messageFactory.createMessage();
 
// Create mime headers
MimeHeaders hd = message.getMimeHeaders();
hd.addHeader("SOAPAction", "xxx");

// Create objects for the message parts
SOAPPart soapPart = message.getSOAPPart();
SOAPEnvelope envelope = soapPart.getEnvelope();
SOAPBody body = envelope.getBody();

// Populate the Message
StreamSource preppedMsgSrc = new StreamSource(new FileInputStream(
messageFilename));
soapPart.setContent(preppedMsgSrc);
 
// Save the message
message.saveChanges();
 
// Check the input
result.append("\nREQUEST:\n");
ByteArrayOutputStream requestOutputStream = new ByteArrayOutputStream();
message.writeTo(requestOutputStream);
result.append(requestOutputStream.toString());
 
// Send the message and get a reply
SOAPMessage reply = connection.call(message, destination);
 
result.append("\nRESPONSE:\n");
ByteArrayOutputStream responseOutputStream = new ByteArrayOutputStream();
reply.writeTo(responseOutputStream);
result.append(responseOutputStream.toString());

// Close the connection
connection.close();
}
catch (Exception e)
{
result.append("\nException:\n").append(e.getMessage());
e.printStackTrace();
}
 
return result.toString();
}

[Ulf Dittmer]

You can send it over HTTPS instead of HTTP, which would use SSL or TLS.

If you want to specifically encode it, you would normally use WS-Security, for which an implementation is available at http://ws.apache.org/wss4j/. I'm not sure if it supports TLS, though.
[ November 16, 2005: Message edited by: Ulf Dittmer ]