axis-java-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Darren Marvin" <...@it-innovation.soton.ac.uk>
Subject Accessing context for a web service call
Date Thu, 27 May 2004 15:14:44 GMT
Hi,
 
Firstly this really is not a user question but hopefully points to
emerging requirements for Axis functionality.
 
I might be wrong but I would like to describe an issue I found
concerning the passing of request context to a service implementation. 
 
All the emerging WSSecurity specifications use the header to store
security context information relating to the SOAP message. In fact most
of the emerging web service standards are looking to use the header to
hold context information. In many cases the underlying service does not
need to know the details of this context, it is handled by the
infrastructure e.g. WSS4J handlers and therefore Axis as it stands is
sufficient - up to now service developers have concentrated on the
payload of the SOAP message. However there are circumstances where the
underlying service might wish to access context information e.g. get the
distinguished name of the certificate used to authenticate the message
under WSSecurity - this could be used for identification / authorisation
purposes within the service. This type of contextual information is
important in eScience applications that are trying to enable scientific
collaboration between academic institutions in the UK. We at IT
Innovation (http://www.it-innovation.soton.ac.uk
<http://www.it-innovation.soton.ac.uk/> )  are working on several
eScience projects and have had to address this issue.
 
Looking at the different ways that Axis can integrate with service
implementations we have (according to Axis documentation) :
 
Document Style:
 
public void method(PurchaseOrder po)    
 
where PurchaseOrder is a bean that represents a payload defined by some
XML schema
 
Wrapped Style:
 
public void purchaseOrder(String item, int quantity, String description)

 
where some marshalling of the contents of the payload is done
 
Message Services:
 
1) public Element [] method(Element [] bodies);
2) public SOAPBodyElement [] method (SOAPBodyElement [] bodies);
3) public Document method(Document body);
4) public void method(SOAPEnvelope req, SOAPEnvelope resp); 
 
where elements are passed directly and the underlying service
implementation must deal with them
 
So overall the only way I can see to obtain the message context e.g.
header information is by writing a message service using the fourth
method signature. Unfortunately this means that I have to manipulate XML
and this is not something that many eScientists would like to do (they
tend to be chemists, physicists etc with limited computing emphasis). It
also seems plausible that since specifications like WSSecurity are
defining standard ways to attach context information to a SOAP message,
there should be standard APIs for service developers to access context
information too.
 
Some of you might remember a query I made to this list about a month ago
concerning writing my own provider implementation. You might be pleased
to know that I have managed to do this as part of my project work at IT
Innovation and it is likely that it will be released as open source very
soon. What it does is instantiate a special sort of service object that
includes an object that gives access to context information. I have
concentrated initially on providing access to WSSecurity information
like the DN of the authenticated remote user but my service context
object can be extended easily. Context information is set in the service
context object using normal Axis handlers. I have a basic WSSecurity
Axis handler that can cope with checking message integrity (it uses a
WSSecurity library of my own, soon to be released as LGPL, but will
eventually use WSS4J)
 
I hope I have not missed some obvious functionality provided by Axis but
a recent Axis Dev post concerning accessing MessageContext would suggest
not. In reality this type of context object is similar to Servlet
context objects that have a standard API for accessing servlet context
information.
 
I obviously welcome any comments and feedback. If this all sounds
reasonable then I am willing to supply my code as a starting point for
adding service context support to Axis. 
 
Thanks in advance,
 
Darren.

 

Mime
View raw message