Troubleshooting JAXWS Message Level Security in GlassFish

Friday Mar 16, 2007

In Java EE 5, one can implement JAXWS Web Services through servlets and Ejb endpoints (JSR 109). GlassFish supports message level security for Web Services. You don't need to write special client and server Java code in order to take advantages of the message level security. What you need to do is specific a corresponding message-level-security element in sun-ejb-jar.xml, sun-web.xml, and sun-application.xml. For instance,

  <webservice-endpoint>
    <port-component-name>PingEjb</port-component-name>
    <endpoint-address-uri>/PingEjbService/PingEjb</endpoint-address-uri>
    <message-security-binding auth-layer="SOAP" provider-id="XWS_ServerProvider">
      <message-security>
        <message/>
        <request-protection auth-source="sender"/>
        <response-protection auth-source="content"/>
      </message-security>
    </message-security-binding>
  </webservice-endpoint>

Or you can turn on the default in domain.xml for server side or sun-acc.xml for appclient.

This blog will highlight some troubleshootings for JAXWS message level security.

Read logs

1. Look at client and server logs. The server log is located at $GLASSFISH_HOME/domains/your_domain/logs/server.log.
2. If you want to see more SOAP level debug info, like corresponding SOAP messages, then you can turn on provider's debug.
   For server and embedded client, one can achieve this by navigating from admin console: Configuration > Security > Message Security > SOAP > Providers:
   • For server, choose the provider XWS_ServerProvider, change the debug property to true and save the configuration.
   • For embedded client, choose the provider XWS_ClientProvider, change the debug property to true and save the configuration.
   For appclient, one need to change the debug property to true for the provider XWS_ClientProvider, and log-service level to INFO.

Endpoint info mismatch

For message level security, one need to ensure that the same request-policy and response-policy are applied to both client and server. These info can be specified in sun-*.xml for a given application or domain.xml and sun-acc.xml for default provider configuration (if default is on). If you see com.sun.xml.wss.impl.PolicyViolationException: Expected Signature Element as per receiver requirements or there is no security processing in SOAP message in debug log, then most probably some of the info about endpoint in sun-*.xml is not correct. You may like to double check each port-component-name (defined in JSR 109) and endpoint-address-uri inside message-security-binding in sun-*.xml are correct.

Note:

• According to JSR 181, we have the following:

  Value	Default
  @WebService.name	Simple name of the Java class or interface
  @WebService.serviceName	Simple name of the Java class + "Service"

  
  
• In GlassFish, the URL to access WebService and endpoint-address-uri in sun-*.xml are related as follows:

  Endpoint Type	WebService URL
  Servlet	http[s]://host:port/context-root/endpoint-address-uri
  Ejb	http[s]://host:port/endpoint-address-uri

  
  
• One can also find out the port-component-name by checking the generated webservices.xml in admin console as follows: Web Services > YOUR_WEB_SERVICES > Webservices.xml, and then correct the port-component-name, repackage and redeploy your application if necessary.

Like this post? | | | |

Posted at 11:24AM Mar 16, 2007 by swchan in Sun
Tags: