How to use Security Policies in WebLogic SCA Web Service Binding

Weblogic SCA provides the ability to take an existing Java class that you have, and expose its interface as a web service. This allows you to take POJOs from an existing library or application and allow other applications to access its interface over a network.

This article shows a simple example of how to use the web services binding functionality of Weblogic SCA to expose a POJO as a web service and protect that web service with a security policy.

For an overview discussion of Weblogic SCA, please see http://blogs.oracle.com/WebLogicServer/2009/12/getting_started_with_weblogic.html

The POJO:
Consider the following Java class that has one simple method that takes a Person object as parameter and returns a String greeting that Person:

package com.oracle.test;public class PersonHelloImpl {  public String helloPerson(Person p) {      return "Happy " + p.getAge() + "th" + " Birthday, " +          p.getFirst() + " " + p.getLast() + "!";  }}

The class Person is shown below:

package com.oracle.test;public class Person implements Serializable {  private String first;  private String last;  private int age;  public String getFirst() {        return first;  }  //....public getters and setters for remaining attributes here....}

Configuring Web Service Binding With Security Policy:
The spring-context.xml required to expose the class PersonHelloImpl as a web service binding is shown below. The binding.ws element includes a PolicyReference element that adds a security policy to the published web service.

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xmlns:sca="http://xmlns.oracle.com/weblogic/weblogic-sca"
       xmlns:wlsb="http://xmlns.oracle.com/weblogic/weblogic-sca-binding"
       xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
          http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
          http://xmlns.oracle.com/weblogic/weblogic-sca
          http://xmlns.oracle.com/weblogic/weblogic-sca/1.0/weblogic-sca.xsd
          http://xmlns.oracle.com/weblogic/weblogic-sca-binding
          http://xmlns.oracle.com/weblogic/weblogic-sca-binding/1.0/weblogic-sca-binding.xsd">

    <sca:service name="SCAHelloService"
        type="com.oracle.test.PersonHelloImpl"
        target="complexHello">
       <binding.ws xmlns="http://xmlns.oracle.com/weblogic/weblogic-sca-binding"
           name="mysvc" port="myport"
           uri="/ myprotectedsvcuri">
          <PolicyReference xmlns="http://schemas.xmlsoap.org/ws/2004/09/policy"
             URI="policy:Wssp1.2-Https-UsernameToken-Plain.xml" />
       </binding.ws>
    </sca:service>
    <bean id="complexHello" class="com.oracle.test.PersonHelloImpl"/>
</beans>

The effect of the PolicyReference element on a binding.ws is the same as a class level @weblogic.jws.Policy annotation on a JAX-WS web service. Operation level policies are not currently supported in Weblogic SCA.

(Note: For details on packaging the application, please see the overview discussion and the Weblogic SCA documentation)

Viewing Published Web Service:
When the above application is packaged and deployed to a Weblogic server, the PersonHelloImpl class will be exposed as a web service with a security policy requiring https connection and username token.

A WSDL will be generated for the published service, which shows the policy information. The relevant snippet of the WSDL is shown below:

Invoking the Web Service:
This web service can be invoked like any JAX-WS web service that requires username token authentication. A sample request SOAP message to invoke this service with the required security headers is shown below:

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:test="http://test.oracle.com">
   <soapenv:Header>
     <wsse:Security
      xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
      <wsse:UsernameToken
        <wsse:Username>myusername</wsse:Username>
        <wsse:Password>mypasswd</wsse:Password>
      </wsse:UsernameToken>
     </wsse:Security>
   </soapenv:Header>
   <soapenv:Body>
      <test:helloPerson>
         <arg0>
            <age>80</age>
            <first>Mickey</first>
            <last>Mouse</last>
         </arg0>
      </test:helloPerson>
   </soapenv:Body>
</soapenv:Envelope>

A future article will show how to use Weblogic SCA references to access external services that have a security policy enabled.