Ping Java SDK And Web Services

Ping Java SDK and Web Services (WS-Trust)In an effort to get my head around Java Web Services I have thrown together a quickClient/Service scenario to learn how everything works. I am not the most advanced Javadeveloper and I am continually confused by all the different frameworks and interfaces thatJava provides so I wanted to build a default sandbox that I could play with to test certainweb services scenarios.I have a few scenarios here that all build from a common base. I have been using NetBeansfor this but you can pretty much insert your favourite Java IDE (ie Eclipse) as you wish –you may need to google some of the IDE things like configuring handlers etc. Step One: Basic Web Service provider (WS) and Web Service Client (WSC) Step Two: Enabling WS-Security on the WS (require SAML token) Step Three: Enabling WS-Security on the WSC (swap username token for SAMLtoken) Step Four: Receiving a local SAML token for the WS and returning the subject tothe web serviceThis may help as a learning tool or as the basics for a POC, or at least to save time fromjumping through multiple examples and sample code to produce a simple WS-Trustscenario.Pre-requisites Java IDE with EE capable web server (ie Netbeans with Glassfish)PingFederate with STS enabledPing Java SDKPing WSS Username Token TranslatorDisclaimerThis sample was farmed from various code snippets found all over the Internet,SDK samples and via my own keyboard. This is not guaranteed to work or besafe, secure or well-performing by any means. Good for a POC or to learn theconcepts but nothing else.PingFederate ConfigurationFor all scenarios, the following PingFederate configuration is used:Ping server is listening on sts.wst (and /sp/sts.wst)So the STS endpoint isI just have a self-signed SSL certificate so you will notice the following line in thecode: e);

code: e);IDP Side (to handle the authentication of the Web Services client):Token ProcessorUsername Token Processor 1.1 configured to verify a credential set (eithernamed users, LDAP etc). For this sample I used the “User Table withPassword” option to manually defined usersSP ConnectionWS-Trust connection configured as the screenshot below:SP Side (to service the WS (validate token re-issue local token))Token GeneratorSAML 2.0 Token Generator 1.1 used to issue a local SAML token for theWeb Service and to validate an existing SAML token. Configuration for thetoken generator is below:

IDP ConnectionUsed to interface with the Web Service. Defines the attribute contract,signing cert, issuer etc of the service. Configuration used is included below:

Step One: Basic Web Service provider (WS) and Web Service Client (WSC)Launch the NetBeans IDE and create a new Java Web Application project to create oursample Web Service.Give the project a name

I am using the built-in Glassfish server. Shouldn’t need to modify anything on this screenso you can hit Finish.Now we have a basic Web Application. We need to create the Web Service to sit in here.Right-click on the name of the project and choose New Web Service Give the servicea name and a package name. Also check the box to implement as a “Stateless SessionBean”

Now we have a basic web service that will say “Hello” to a name you provide. To test theservice:Right-click the Project and select “Deploy” to deploy it to the Glassfish web server.Expand the “Web Services” folder under the project, right-click on the service andselect “Test Web Service” to verify the service is correctly running.Once you have created the service, we will now create a web service client to communicatewith this web service.In the NetBeans IDE, create a new Java Application by choosing File New Project:Name the project and click Finish to create a basic Java application.

To create a reference to the Web Service we created, in the project explorer, right-click onthe application project name and select: New Web Service Client Choose to specify the WSDL from the Web Service project we created earlier and clickFinish to create the reference.Now we will add this reference into the Java code to call the web service from our Javaapp.Open the Java application source file in the editor.On the Project explorer, expand the levels under the “Web Service References” until yousee the web service method (red dot) and drag that into your code (under the closing braceof the “main method”)

Modify the main method to call this new method:Right-click the project and choose “Run” to execute the client. You should see the resultsof the web service call in the console:Success. We now have a working web service and web service client configuration.Step Two: Enabling WS-Security on the WS to require SAML security tokenThe next step is to protect the existing web service. The requirements now are that no onecan call this web service without providing a valid SAML security token.To protect the web service, we are going to use the Ping Java SDK to integrate with thePing STS. We are going to create a SOAP Handler to handle the SAML validation withouthaving to change the core web service code.Because we are using the Ping SDK, we need to add the required libraries to our project.In the project explorer, right-click “Libraries” and select “Add JAR/Folder”. Browse tothe location where you expanded the Ping Java SDK and select all the jars in the “lib”folder.In the Web Service project (SampleWS). create a new Java class (we call itSampleWSHandler):

Paste the following code into this Java file:[You may need to modify the package, class name and STS endpoint appropriately]package .NodeList;/**** @author pmeyer*/public class SampleWSHandler implements SOAPHandler SOAPMessageContext {private static String STS ENDPOINT URL c boolean handleMessage(SOAPMessageContext messageContext) {Boolean isRequest (Boolean)messageContext.get(MessageContext.MESSAGE OUTBOUND PROPERTY);//for response message only, true for outbound messages, false for inboundif (!isRequest) {try {SOAPMessage soapMsg messageContext.getMessage();SOAPHeader soapHeader soapMsg.getSOAPHeader();NodeList secHeaders -secext-1.0.xsd","Security");if (secHeaders.getLength() 0) {generateSOAPErrMessage(soapMsg, "No Security Header");}Element securityHeader (Element) secHeaders.item(0);STSClientConfiguration stsClientConfiguration .setStsEndpoint(STS ENDPOINT s(true);STSClient client;try {client new STSClient(stsClientConfiguration);

client new STSClient(stsClientConfiguration);} catch (MalformedURLException e) {throw new RuntimeException(e);}SamlToken token;try {token er);} catch (SecurityTokenException e) {throw new RuntimeException(e);}if (token null) {generateSOAPErrMessage(soapMsg, "No security token found");}boolean valid false;try {valid client.validateToken(token);} catch (STSClientException e) {generateSOAPErrMessage(soapMsg, e.getMessage());}if (!valid) {generateSOAPErrMessage(soapMsg, "Security token invalid");} else {// We have a valid token.System.out.println("WSP: VALID.");}} catch (SOAPException e) {System.err.println(e);}}}return true;@Overridepublic boolean handleFault(SOAPMessageContext context) {return true;}@Overridepublic void close(MessageContext context) {}@Overridepublic Set QName getHeaders() {return null;}}private void generateSOAPErrMessage(SOAPMessage msg, String reason) {try {SOAPBody soapBody t soapFault n);throw new SOAPFaultException(soapFault);} catch (SOAPException e) {}}Next we need to attach this handler to the existing web service code. In the projectexplorer, right-click the “SampleWS” service under the “Web Services” folder in the projectand select “Configure Handlers ”.Click the Add button and browse to the handler file we just created(SimpleWSHandler.java). Click okay to apply that change.To test the changes, re-deploy the web service by right-clicking on the Project name(SampleWS) and selecting “Deploy”.Right-click your Client project and choose “Run”. You should get an error indicating thatno security header was received.

Pretty cool that we only added the handler to the project. Minimal changes to the core webservice code were needed to secure it.[TODO: Modify the WSDL to advertise that we are expecting a SAML security token]Step Three: Enabling WS-Security on the WSC (swap username token for SAML token)Now we will follow a similar process on the client side. We want to authenticate a user viathe STS and present a SAML 2.0 assertion in the SOAP headers for the Web Service toconsume.As with the Web Service provider, in the Client project, right-click the “Libraries” folderand add the JARs from the Java SDK.We now can add a handler on the Client side. Right-click the project and create a new JavaClass In this java file, copy the following code. You can modify the contents appropriately:package ax.xml.ws.handler.soap.SOAPHandler;

import t org.w3c.dom.Element;public class SampleClientHandler implements SOAPHandler SOAPMessageContext ticStringStringStringStringWSS USERNAME TOKEN USERNAME "user123";WSS USERNAME TOKEN PASSWORD "User123";STS ENDPOINT URL "https://localhost:9031/idp/sts.wst";APPLIES TO "http://localhost";public SampleClientHandler() {}@Overridepublic boolean handleMessage(SOAPMessageContext context) {Boolean outboundProperty (Boolean)context.get(MessageContext.MESSAGE OUTBOUND PROPERTY);if (outboundProperty.booleanValue()) {// We are a Web Services Client. We need to get a SAML token to send throughto our service.// First of all, request a security token from the STS:STSClientConfiguration stsClientConfiguration new tStsEndpoint(STS ENDPOINT URL);stsClientConfiguration.setAppliesTo(APPLIES (true);STSClient client;// instantiate the STS clienttry {client new STSClient(stsClientConfiguration);} catch (MalformedURLException e) {throw new RuntimeException(e);}// Send in a Username token and receive the issued SAML tokenElement token;try {token client.issueToken(WSS USERNAME TOKEN USERNAME,WSS USERNAME TOKEN PASSWORD);} catch (STSClientException e) {// deal with the exceptionthrow new RuntimeException(e);}// We now have a SAML token to include in the Web Services RequestSystem.out.println("WSC: RST swapped for SAML token");StringUtils ppUtil new StringUtils();ppUtil.prettyPrint(token);// Insert the SAML token into the SOAP Headers.try {SOAPEnvelope envelope OAPFactory factory SOAPFactory.newInstance();String prefix "wsse";String uri 01-wsswssecurity-secext-1.0.xsd";SOAPElement securityElem factory.createElement("Security", prefix, uri);SOAPElement tokenElement Element(tokenElement);SOAPHeader header tyElem);} catch (Exception e) {e.printStackTrace();}} else {// inbound}}return true;@Overridepublic Set QName getHeaders() {return new TreeSet();}@Overridepublic boolean handleFault(SOAPMessageContext context) {