From 888a71de914328e42a8814e9529d6934a7d3d0bf Mon Sep 17 00:00:00 2001 From: Arjen Poutsma Date: Sat, 25 Aug 2007 19:25:15 +0000 Subject: [PATCH] SWS-168 --- src/docbkx/common.xml | 4 +-- src/docbkx/security.xml | 76 ++++++++++++++--------------------------- 2 files changed, 27 insertions(+), 53 deletions(-) diff --git a/src/docbkx/common.xml b/src/docbkx/common.xml index 2f0e9b32..6c80cd53 100644 --- a/src/docbkx/common.xml +++ b/src/docbkx/common.xml @@ -1,10 +1,10 @@ + "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd"> Shared components - In this chapter, we will explore the the components which are shared between client- and server-side + In this chapter, we will explore the components which are shared between client- and server-side Spring-WS development. These interfaces and classes represent the building blocks of Spring-WS, so it is important to understand what they do, even if you do not use them directly. diff --git a/src/docbkx/security.xml b/src/docbkx/security.xml index 6f63ba55..aad2e611 100644 --- a/src/docbkx/security.xml +++ b/src/docbkx/security.xml @@ -1,6 +1,6 @@ + "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd"> Securing your Web services with Spring-WS @@ -13,9 +13,9 @@ Authentication - This is the process of determining whether a principal is who they claim to be. - In this context, a "principal" generally means a user, device or some other system which can perform - an action in your application. + This is the process of determining whether a principal is who they claim to be. + In this context, a "principal" generally means a user, device or some other system which can perform + an action in your application. @@ -29,19 +29,16 @@ Encryption and Decryption - Encryption - is the process of transforming data into a form that is impossible to read without the appropriate key. - It is mainly used to keep information hidden from anyone for whom it is not intended. - Decryption - is the reverse of encryption; it is the process of transforming of encrypted data back into an readable - form. + Encryption is the process of transforming data into a form that is impossible to + read without the appropriate key. It is mainly used to keep information hidden from anyone for whom it + is not intended. + Decryption is the reverse of encryption; it is the process of transforming of + encrypted data back into an readable form. - All of these three areas are implemented using the - XwsSecurityInterceptor - , which we will describe in - + All of these three areas are implemented using the XwsSecurityInterceptor, which we + will describe in . @@ -54,62 +51,39 @@
<classname>XwsSecurityInterceptor</classname> - The - XwsSecurityInterceptor - is an - EndpointInterceptor - (see - - ) that is based on SUN's XML and Web Services Security package (XWSS). This WS-Security implementation is - part of the Java Web Services Developer Pack ( - - Java WSDP - - ). + The XwsSecurityInterceptor is an EndpointInterceptor + (see ) that is based on SUN's XML and Web Services Security + package (XWSS). This WS-Security implementation is part of the Java Web Services Developer Pack + (Java WSDP). Like any other endpoint interceptor, it is defined in the endpoint mapping (see - + ). This means that you can be selective about adding WS-Security support: some endpoint mappings require it, while others do not. - The - XwsSecurityInterceptor - requires a - security policy file + The XwsSecurityInterceptor requires a security policy file to operate. This XML file tells the interceptor what security aspects to require from incoming SOAP messages, and what aspects to add to outgoing messages. The basic format of the policy file will be explained in the following sections, but you can find a more in-depth tutorial - here - - . You can set the policy with the - policyConfiguration - property, which requires a Spring resource. The policy file can contain multiple elements, e.g. require a + here. + You can set the policy with the policyConfiguration property, which + requires a Spring resource. The policy file can contain multiple elements, e.g. require a username token on incoming messages, and sign all outgoing messages. It contains a - SecurityConfiguration - element as root (not a - JAXRPCSecurity - element). + SecurityConfiguration element as root (not a JAXRPCSecurity element). - Additionally, the security interceptor requires one or more - CallbackHandler - s to operate. These handlers are used to retrieve certificates, private keys, validate user credentials, + Additionally, the security interceptor requires one or more CallbackHandlers to + operate. These handlers are used to retrieve certificates, private keys, validate user credentials, etc. Spring-WS offers handlers for most common security concerns, e.g. authenticating against a Acegi authentication manager, signing outgoing messages based on a X509 certificate. The following sections will indicate what callback handler to use for which security concern. You can set the callback handlers using - the - callbackHandler - or - callbackHandlers - property. + the callbackHandler or callbackHandlers property. - Here is an example that shows how to wire the - XwsSecurityInterceptor - up: + Here is an example that shows how to wire the XwsSecurityInterceptor up: