oauth2.0 implementation to secure SOAP non spring/spring boot web service application

[sai rama krishna]

Hi All,
I need to secure SOAP web service non spring/spring boot application using oauth2.0 implementation. Can you please guide me what steps I have to take to achieve this. Any good examples, resources around this. Please advise

[Tim Holloway]

Hmmm. Let me apply De Morgan's Theorem to that question and see if it helps.

As I understand it, you have a vanilla, bog-standard webapp that uses SOAP protocols and you want to secure  it with OAuth2. No Spring, and definitely no Spring Boot. Correct? Something you deploy as a WAR in a stock webapp server like Tomcat or Websphere.

It has been at least 3 years since I screamed in frustration at OAUTH and a lot longer since I've done SOAP (I prefer YAML mostly now), but securing a SOAP webapp with OAUTH2 shouldn't be any different than any other JEE webapp. Likely Spring could help you, but it's not essential.

Since I'm not competent to assist here, the best I could do was try and make the problem more understandable to anyone who might be more capable.

In the mean time, do a web search on "SOAP OAUTH2 java" and see what you get. With luck maybe a Baeldung tutorial will pop up.

[Stephan van Hulst]

Please tell us what framework you are using to produce and consume SOAP messages.

[Tim Holloway]

OK, we're playing Forum Ping-Pong here!

I was thinking that we had an actual SOAP forum, but I can't find it in the list and anyway, as I said, OAUTH is for securing the entire webapp and not just SOAP services.

I've added this thread to "Web Services", although I think that SOAP isn't considered as a proper "web service" as it would have been back in its heyday.

Interestingly, we also seem to lack a forum for general webapp questions. Instead we have a smattering of forums relating to particular components of webapps such as JSPs, servlets, and so forth.

Note that if you use a container-managed security system then part of your job would include configuring the container itself, so if I knew whether you're working with Tomcat, Wildfly, WebLogic, or whatever, I could also link this thread there.

[sai rama krishna]

Thank you all.  I see some code relating to AXIS2 which seems framework being used to create this SOAP webservice.

[Tim Holloway]

I haven't worked much with Axis2. It's a lot different from Axis. Buth I'm fairly sure that neither framework provides any security services. I think they leave it up to the container and/or appliation logic.

[sai rama krishna]

This legacy SOAP project which seems not using spring framework. I am able to hit the WSDL URL with sample XML request and able to get sample  response XML now using Insomnia api tool without any authentication. I have to introduce OAUTH2.0 to this legacy SOAP project. So that if I give client id, client, secret and refreshed token and header prefix as Bearer then only it should work. What classes, interfaces, dependencies etc. I have to use for this purpose. Any sample code examples , links, resources around this that anyone can share? Please advise