Axis2/Rampart compatability

[Bai Shen]

I'm creating a web service using Axis2 and I want to secure it with Rampart. My question is how compatible is this with other systems? Will I be able to hand the wsdl to someone and have them connect and authenticate without using Axis2 or Rampart?

[Ulf Dittmer]

Yes. The beauty of using standards like SOAP, WSDL and WS-Security is that you don't need the same software -or even the same language- on both ends of the connection.

[Bai Shen]

-nods- I knew that was the case with SOAP and WSDL, but I wasn't sure about the security part.

[Bai Shen]

Also, how does the user know what the security settings are for Rampart? The WSDL doesn't change AFAIK, and the return messages aren't very helpful.

Also, I just sent a message with the wrong user name to my web service, and it gave back a 202 Accepted message. No indication that anything was wrong on the client side.

Do I have to give users all the implementation info for the security?

[Ulf Dittmer]

Also, I just sent a message with the wrong user name to my web service, and it gave back a 202 Accepted message. No indication that anything was wrong on the client side.

That doesn't sound right - it should result in an exception (and normally does). Make sure the server-side security handler class does the right thing.

[Bai Shen]

Well, the server threw an exception, but nothing made it back to the client. I'm using the PWHandlerServer class from your examples.

[Taariq San]

Originally posted by Bai Shen:
Well, the server threw an exception, but nothing made it back to the client. I'm using the PWHandlerServer class from your examples.

I think he means put in a breakpoint, or some logs to see what the code is doing.
Is it even being called at all?

[Bai Shen]

Originally posted by Taariq San:


I think he means put in a breakpoint, or some logs to see what the code is doing.
Is it even being called at all?

It's being called, and throwing an exception on the server side. The problem is that on the client side, there's no way to tell the difference. The client gets back a 202 Accepted code whether there was an exception or not.

[Taariq San]

Originally posted by Bai Shen:


It's being called, and throwing an exception on the server side. The problem is that on the client side, there's no way to tell the difference. The client gets back a 202 Accepted code whether there was an exception or not.

Can you use tcpmon and post the soap response from the server?