File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
http://aspose.com/file-tools
The moose likes Web Services and the fly likes Rampart encrypting options: I can't encrypt parameters Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Java » Web Services
Bookmark "Rampart encrypting options: I can Watch "Rampart encrypting options: I can New topic
Author

Rampart encrypting options: I can't encrypt parameters

Enrico Viappiani
Greenhorn

Joined: Nov 19, 2011
Posts: 11
hi guys, I have a Web service developed in java, deployed on Tomcat / Axis2.
Every method in the service, has "User", a class containing username and password in plain.
I need to encrypt that parameters in the SOAP request, so i engaged rampart, and seems to do the job, but using a soap monitor i noticed that the user/password parameters are in plain text, clear and unencrypted!!!
the soap request catched by soap monitor is this:





Any ideas? how can I configure rampart to encrypt that section? thanks

Enrico
Tim Moores
Rancher

Joined: Sep 21, 2011
Posts: 2408
The password isn't in clear text; it's digested. What are you worried about?

Update: Oh, you mean your password, not the WS-Security password. Sorry.

Update #2: It doesn't look like you're using WS-Encryption, it looks like you're using WS-Signature (which leaves the contents in clear text).
Enrico Viappiani
Greenhorn

Joined: Nov 19, 2011
Posts: 11
Tim Moores wrote:The password isn't in clear text; it's digested. What are you worried about?

Update: Oh, you mean your password, not the WS-Security password. Sorry.

Update #2: It doesn't look like you're using WS-Encryption, it looks like you're using WS-Signature (which leaves the contents in clear text).


I'm used to think that this configuration of axis2.xml was enough, but it seems that i was wrong:



thanks in advance guys!
Tim Moores
Rancher

Joined: Sep 21, 2011
Posts: 2408
Remove the Signature item. Or do you want to sign the request?

I also noticed an introduction to Encryption with Axis at http://www.javaranch.com/journal/2008/10/Journal200810.jsp#a5
Enrico Viappiani
Greenhorn

Joined: Nov 19, 2011
Posts: 11
Tim Moores wrote:Remove the Signature item. Or do you want to sign the request?

I also noticed an introduction to Encryption with Axis at http://www.javaranch.com/journal/2008/10/Journal200810.jsp#a5


Yeah I followed that guide some months ago!

Do you think that Signature will set the Encryption apart? I'll try it..

Edit: same problem , i'm searching for a full guide on rampart options and examples, but i can't find nothing useful
Enrico Viappiani
Greenhorn

Joined: Nov 19, 2011
Posts: 11
UPDATE: Added the policy.xml file... but nothing happens..
Tim Moores
Rancher

Joined: Sep 21, 2011
Posts: 2408
What is policy.xml?

Have you gotten the example in that article to run?
Enrico Viappiani
Greenhorn

Joined: Nov 19, 2011
Posts: 11
Tim Moores wrote:What is policy.xml?

Have you gotten the example in that article to run?


yes, but the body is plain text as before... i opened a issues on the apache page.

policy.xml sets the policy for the client and wsp protocol.
Rampart with encrypt tag, should encrypt the body as default anyway... I'm really stuck with this, i thinks this is a pretty stupid issue, but there's no error feedback on the console, i'm literally gettin mad..
Enrico Viappiani
Greenhorn

Joined: Nov 19, 2011
Posts: 11
I received an answer by JSF.
Configuration by properties is deprecated.. so i need to do that by using a policy.xml file.. but honestly i can't find nothing useful on the steps to perform to accomplish that, just a bunch on nonsense examples and nothing serious.
Which file has to be modified, which not.. great confusion.. i think i'm gonna downgrade to rampart 1 and get the project to work.
Enrico Viappiani
Greenhorn

Joined: Nov 19, 2011
Posts: 11
solved.. i was using a soap monitor that decrypt the request before that the monitor catch it.
 
I agree. Here's the link: http://aspose.com/file-tools
 
subject: Rampart encrypting options: I can't encrypt parameters