X509 Certificate Testing

Strategy

1. Generate a keystore for the "Service Provider"
2. Extract the "service provider's" certificate 
3. Generate a separate keystore for the "Service Consumer"
4. Import the "service provider's" certificate into the service consumer's keystore
5. Configure the SOAP UI to perform Encryption, Signature, Password, DateTime as shown below.
6. Create a policy at the OWSM(copy from the system provided ones)
7. Add Assertions. Enforce logging as one of the assertions
8. Register the webservice and attach this policy with the web service.
9. Test the request with the SOAP UI.

Concepts

• It is important to understand what happens during an outbound request
• For Authentication - the consumer provides the "userid" and "password" which is used by the Provider to authenticate through the Security provider(by connecting to the LDAP or custom repository)
• For Authorization - the consumer provides the "userid" and "password" which is used by the Provider to authenticate through the Security provider(by connecting to the LDAP or custom repository)
• For Confidentiality - the message is encrypted by the public key of the Provider. Due to this reason you need to select the provider's certificate that has been imported by providing the alias
• Based on the policy that is being enforced at the provider's OWSM, provide the corresponding "Key Identifier Type", "Encoding Algorithm", "Key Encryption Algorithm"
• For Integrity - the message should be signed with the private key of the consumer. So provide the corresponding alias.

Generate a Keystore

Execute the following command in a single line

keytool -genkey -dname "cn=Chandu Sankuratri, ou=soa, o=CrystalTrain, c=US" -alias dssoa -keypass iag12345 -keystore C:\chandu\Keystore -storepass iag12345 -validity 365 -keyalg "RSA"

Note : Enusre that the Key Algorithm is "RSA" as SOAP UI expects this. If you do not provide this, the default is DSA and you will see an exception java.lang.IllegalArgumentException: not an RSA key

You should verify the certificate by executing the following commands

keytool -export -alias dssoa -file dssoa.cer -keystore C:\chandu\Keys\keystore -storepass iag12345

keytool -printcert -file C:\chandu\Keys\dssoa.cer

This should print out

Serial number: 4b9abe40

Valid from: Fri Mar 12 17:20:48 EST 2010 until: Sat Mar 12 17:20:48 EST 2011
Certificate fingerprints:
MD5: 53:DB:0B:86:71:2E:5D:95:E8:EA:8C:D6:89:B2:D2:06
SHA1: EA:B0:90:F5:A9:12:FF:E9:A0:7A:96:F9:77:79:71:6B:18:62:86:3F
Signature algorithm name: SHA1withRSA
Version: 3

Add the generated keystore to SoapUI

Configure the outgoing SOAP request for encryption with X509 certificate. Similarly, you can also add "user Name" ,"Password" and the Signature.

Associate the configured security to the request

SOAP Request with WS-Security

Add the following to your SOAP request. Note the userid and Password. The Security Provider is the default Weblogic authentication Provider. This requires the weblogic userid and password that you login to Console. Use this to start your testing and build upon this by changing the security providers, encryption and signature.

<soap:Header>

<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken>
<wsse:Username>weblogic</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">iag123456</wsse:Password>
<wsse:Nonce>71srki+B97R3XIoA7amwbA==</wsse:Nonce>
</wsse:UsernameToken>
</wsse:Security>
</soap:Header>

Generating a WSIL file from WSDL

The OWSM11gR1 requires a WSIL file to register a service.

Following are the steps to generate a WSIL from WSDL

• WSIL can be easily generated from a WSDL through Eclipse Galileo. At the time of writing this is not supported by JDeveloper.
• Copy the WSDL file to your Eclispe project. Right click on it and follow the below instructions
• The following is taken from Eclipse Help

To generate a WSIL file through the import utility:

From the File menu, select Import > WSIL > Next. The WSIL Import window opens.

If you have selected to perform step 1, the WSIL URI field should be prefilled with the name of your WSDL file, where the extension has been changed from .wsdl to .wsil. The WSDL section should contain the URLs to the selected WSDL files. You can also enter additional WSDL URLs. Alternately, you can browse to the location of a WSIL file, or manually enter the location of the WSIL and WSDL files in the appropriate locations.

Click Finish. A WSIL file will be generated in the specified location.

Oracle Web Services Manager (OWSM) 11g

The official Developers Guide for OWSM 11gR1 from Oracle is available here
The FAQ on OWSM 11gR1 is available here

OWSM11gR1 is part of the Oracle SOA Suite11gR1. It does not need any separate installation if you are working with Oracle SOA. Enforcing the policy is straight forward as can be seen below.

Following are the steps to enforce a policy. Steps that need elaboration are entered as a separate blog

1. Create a Policy
2. Generate a WSIL for the Web Service
3. Register the Service
4. Associate the Service with the Policy
5. Generate SOAP requests through the SOAP UI to test the security