12 Web Services Security Setup Guidelines

There are numerous ways to build or implement secured service to protect the SOA infrastructure against attack. Standards allow policies to be applied to SOA, thus allowing controlled usage and monitoring and provide security ramifications in enterprise integration. Standards such as WS-Security, SAML, WS-Trust, WS-Secure Conversation and WS-SecurityPolicy focus on the security and identity management aspects of SOA implementations that use web services.

The WS-* architecture is a set of standards-based protocols designed to secure Web service communication. WebLogic Web services use WS-Policy files to enable a destination endpoint to describe and advertise its Web service reliable messaging capabilities and requirements. The WS-Policy specification provides a general purpose model and syntax to describe and communicate the policies of a Web service.

These WS-Policy files are XML files that describe features such as the version of the supported WS-ReliableMessaging specification, the source endpoint's retransmission interval, the destination endpoint's acknowledgment interval, and so on.

The web services exposed by Oracle retail applications are used as service providers in Retail Service Backbone (RSB) architecture. Please refer to RSB documentation for more details about RSB architecture. The Oracle Retail application services are used as edge application services in RSB and they are consumed by Web services through the OSB 12.2.1.4.0 layer. When used with RSB, the Oracle Retail application services are not consumed directly, instead the consumers invoke OSB 12.2.1.4.0 services which in turn invoke the Oracle retail application services. Due to these requirements, Oracle Retail application services need to be secured with WebLogic Web service polices, which are interoperable with OWSM policies. Following is the list of WebLogic Web service policies that are currently supported for securing application services.

Username token over SSL: The following WebLogic policy is used for username token over SSL, it is also referred to as PolicyA in RSB documentation:

Wssp1.2-2007-Https-UsernameToken-Plain.xml:
Username token with Message Protection: Following is the set of policies which are used to secure services with username token and message protection. This is also referred to as PolicyB in RSB documentation:

Wssp1.2-2007-Wss1.1-UsernameToken-Plain-EncryptedKey-Basic128.xml

Wssp1.2-2007-SignBody.xml

Wssp1.2-2007-EncryptBody.xml

This document doesn't go into the detailed steps for securing Web services. The detailed step-by-step instructions are provided in RSB Security Guide. Refer to that document for more details.

Client-Side Setup

Web services can be invoked from Java clients as well as PL/SQL clients. This section describes the configuration for invoking a secured Web service from both clients.

Java Client Setup

Client code for calling Web services can be generated using the Java consumer option of the retail-soa-enabler-gui-<version> tool. The generated zip file contains all the jar files required for the classpath of the application that calls the Web service. To run the client, follow the steps required to run Java consumer.

The following is sample code for calling a secured Web service.

Note:

The code below is sample code for invoking the PayTerm service. When you generate Java consumer for a Web service, the generated jar file will contain classes specific to that Web service. Use the appropriate classes in the client code. Service namespace and WSDL location also should be changed appropriately.

package com.oracle.retail.rms.client;
 
import java.net.URL;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
 
import javax.xml.namespace.QName;
import javax.xml.ws.BindingProvider;
 
import com.oracle.retail.integration.base.bo.paytermdesc.v1.PayTermDesc;
import com.oracle.retail.integration.base.bo.paytermref.v1.PayTermRef;
import com.oracle.retail.rms.integration.services.paytermservice.v1.PayTermPortType;
import com.oracle.retail.rms.integration.services.paytermservice.v1.PayTermService;
 
import weblogic.wsee.security.unt.ClientUNTCredentialProvider;
import weblogic.xml.crypto.wss.WSSecurityContext;
import weblogic.xml.crypto.wss.provider.CredentialProvider;
 
import junit.framework.TestCase;
 
 
public class PayTermClient extends TestCase{
       public void testFindPayTerm(){
              try{
                      //qName is namespace of the service
                      QName qName = new                 QName("http://www.oracle.com/retail/rms/integration/services/PayTermService/v1","PayTermService");
 
                      // url is the URL of the WSDL of the web service
                      URL url = new     URL("http://example.com:7001/PayTermBean/PayTermService?WSDL");
 
                     //create an instance of the web service 
                     PayTermService service = new PayTermService(url,qName);
                     PayTermPortType port =   service.getPayTermPort();
 
                     //set the security credentials in the service context
                     List credProviders = new ArrayList();
                     CredentialProvider cp = new    ClientUNTCredentialProvider("<username>","<password>");   
                     credProviders.add(cp);   
                     Map<String, Object> rc =              ((BindingProvider)port).getRequestContext();   
                     rc.put(WSSecurityContext.CREDENTIAL_PROVIDER_LIST, credProviders); 
 
                     //populate the service method input object
                    PayTermRef ref = new PayTermRef();
                    ref.setTerms("terms");
                    ref.setTermsXrefKey("key");
 
                    //call the web service.here desc is the response object
                    PayTermDesc desc =  port.findPayTermDesc(ref);
 
                    System.out.println("desc="+desc);
            }catch(Exception e){
                   e.printStackTrace();                 
            }
      }
}

PL/SQL Client Setup for WS with Call-out

Client code for calling Web services can be generated using the PL/SQL consumer option of the retail-soa-enabler-gui-<version> tool. The generated zip file contains all the jar files and PL/SQL code required to invoke the web service from PL/SQL. To run the client, follow the steps required to run PL/SQL consumer.

The following is a sample PL/SQL procedure for calling a secured Web service.

Note:

The code below is sample code for invoking the GlAccountValidation service. When you generate PL/SQL consumer for a Web service, the generated jar file will contain classes specific to that Web service. Use the appropriate classes in the client code. Service namespace and WSDL location should also be changed appropriately.

Write a PL/SQL procedure which will work as the client to call the web service. An example is given below for reference:

Example:

The following is an example procedure to call GlAccountValidationService web service.

create or replace PROCEDURE GlAccountValidationClient AS 
BEGIN
  DECLARE
  ARG0 VARCHAR2(200);
  v_ReturnValue  VARCHAR2(5000);
  ribObject RIB_OBJECT;
  
  GLAcctDesc_REC "RIB_GLAcctDesc_REC";
  GLAcctDesc_TBL "RIB_GLAcctDesc_TBL";
  GLAcctColDesc_REC "RIB_GLAcctColDesc_REC";
  
  GLAcctColRef_REC "RIB_GLAcctColRef_REC";
  
BEGIN
  
  GLAcctDesc_REC := "RIB_GLAcctDesc_REC"(1, 'RMS', 1);
  
  GLAcctDesc_TBL := "RIB_GLAcctDesc_TBL"();
  GLAcctDesc_TBL.EXTEND(1);
  GLAcctDesc_TBL(1) := GLAcctDesc_REC;
  
  GLAcctColDesc_REC := "RIB_GLAcctColDesc_REC"(17, 1, GLAcctDesc_TBL);
  
  v_ReturnValue := GlAccountValida-tion_SC.ping('https://msp8925.us.oracle.com:47032/GlAccountValidationBean/GlAccountValidationService?WSDL', 'PolicyA', 'rsbadmin', 'rsbadmin1', 'Hi from prantor PolicyA');
  
DBMS_OUTPUT.PUT_LINE('v_ReturnValue = ' || v_ReturnValue);
  
  v_ReturnValue := GlAccountValida-tion_SC.ping('http://blr00abi.idc.oracle.com:47035/GlAccountValidationBean/GlAccountValidationService?WSDL', 'PolicyU', '', '', 'Hi from prantor PolicyU');
  
DBMS_OUTPUT.PUT_LINE('v_ReturnValue = ' || v_ReturnValue);
  
  v_ReturnValue := GlAccountValida-tion_SC.ping('http://blr00abi.idc.oracle.com:39001/GlAccountValidationBean/GlAccountValidationService?WSDL', 'PolicyC', 'rsbuser', 'rsbuser1', 'Hi from prantor PolicyC');
 
  DBMS_OUTPUT.PUT_LINE('v_ReturnValue = ' || v_ReturnValue);
  
  
  GLAcctColRef_REC := GlAccountValida-tion_SC.validateGlAccount('https://msp8925.us.oracle.com:47032/GlAccountValidationBean/GlAccountValidationService?WSDL', 'PolicyA', 'rsbadmin', 'rsbadmin1', GLAcctColDesc_REC);
  
  DBMS_OUTPUT.PUT_LINE('validateGlAccount done.');
  
  
END;
 
END GlAccountValidationClient;

After the procedure is created without any errors, you can run the procedure as follows:

SET SERVEROUTPUT ON SIZE 500000
CALL dbms_java.set_output(500000);
exec GlAccountValidationClient;

PL/SQL Client Setup

The following is a sample PL/SQL procedure for calling a secured Web service.

Note:

The code below is sample code for invoking the PayTerm service. When you generate PL/SQL consumer for a Web service, the generated jar file will contain classes specific to that Web service. Use the appropriate classes in the client code. Service namespace and WSDL location should also be changed appropriately.

create or replace
PROCEDURE wstestClient IS
 
ref "OBJ_PAYTERMREF" := null ;
objdesc "OBJ_PAYTERMDESC" := null;
wsm varchar2(100);config varchar2(32000);
BEGIN
wsm := 'oracle.webservices.dii.interceptor.pipeline.port.config';
   config :='<port-info>
   <runtime enabled="security">
   <security>
   <outbound>
   <username-token name="" password=""/>
   </outbound>
   </security>
   </runtime>
   </port-info>' ;
   
 PayTermServiceConsumer.setProperty(wsm, config);
 
PayTermServiceConsumer.setEndpoint('http://example.com:7001/PayTermBean/PayTermService');
PayTermServiceConsumer.setUsername('<RMS username>');
PayTermServiceConsumer.setPassword('<RMS password>');
ref := "OBJ_PAYTERMREF"('x','t',null,null,null);
dbms_output.PUT_LINE(PayTermServiceConsumer.getEndPoint());
dbms_output.PUT_LINE(PayTermServiceConsumer.ping('TestMessage'));
objdesc := PayTermServiceConsumer.findPayTermDesc(ref) ;
dbms_output.PUT_LINE('Done.');
EXCEPTION
   WHEN OTHERS THEN
    dbms_output.PUT_LINE(SQLCODE);
   dbms_output.PUT_LINE(SQLERRM);
END;