SSL Web Services on Glassfish

[Bernhard Haeussermann]

Hi. I'm having trouble with deploying a web service using SSL on Glassfish v. 2.1.
Normally when I deploy a web service, I export it to a .WAR file in Eclipse. I then deploy this file on a Glassfish server via the admin console.
How do I tell Glassfish to make the web service use SSL, using the security certificate currently configured?
Alternatively, how do I indicate that it should use http-listener-2 (not http-listener-1), which works on port 8181 and is security-enabled (https) by default?

Your insight in this matter would be significantly appreciated!

[Ivan Krizsan]

Hi!
Use the web.xml deployment descriptor. Here is an example that shows how to configure SSL for the POST operations to a web service. You probably do not want to require SSL for accessing the WSDL (which is accessed using GET).

<?xml version="1.0" encoding="UTF-8"?> 
<web-app 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns="http://java.sun.com/xml/ns/javaee" 
    xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" 
    xsi:schemaLocation=" 
        http://java.sun.com/xml/ns/javaee 
        http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" 
        id="WebApp_ID" version="2.5"> 
    <display-name>JAX-WS_MyService</display-name> 
    <security-constraint> 
        <display-name>SecurityConstraint</display-name> 
        <web-resource-collection> 
            <web-resource-name>Secure Area</web-resource-name> 
            <url-pattern>/HelloWorldWSService</url-pattern> 
            
            <!-- 
                JSR-109 specifies that http-method POST must be used. 
                If we include GET here, access to the WSDL will also 
                be protected, otherwise not. 
             --> 
            <http-method>POST</http-method> 
        </web-resource-collection> 
        
        <!-- 
            Plain SSL and mutual authentication both require CONFIDENTIAL 
            transport-guarantee to be configured. 
        --> 
        <user-data-constraint> 
            <transport-guarantee>CONFIDENTIAL</transport-guarantee> 
        </user-data-constraint> 
    </security-constraint> 
</web-app> 

Best wishes!

[Bernhard Haeussermann]

Thanks!