Mailing-List: contact axis-user-help@ws.apache.org; run by ezmlm
Precedence: bulk
Reply-To: axis-user@ws.apache.org
Received-SPF: pass (herse.apache.org: local policy)
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Is wss4j still an active project? (was:  Rampart configuration
	question)
Date: Mon, 9 Jul 2007 10:59:20 -0400
Message-ID: <70786C90113B6D4C89A76D69F151A041BE2B51@ONEV01.hrdc-drhc.net>
In-Reply-To: <70786C90113B6D4C89A76D69F151A041BE2B50@ONEV01.hrdc-drhc.net>
Thread-Topic: wrapping OMElement from XMLStreamReader with SOAPEnvelope
	error
Thread-Index: Ace/2QmMBEdW3YhUTO2ygm9I+9rLoAAH+35gAIwzBgA=
From: <Michael.Davis@servicecanada.gc.ca>
To: <axis-user@ws.apache.org>

Hi,

I didn't see any replies to the question below, so I started digging =
through the rampart/wss4j code. I found a workaround that will allow me =
to hard-code the private key into my client and server, and not have to =
have absolute paths to key files. This involves making a small change to =
one of the wss4j classes.

I got the wss4j source code and tried to build it. Unfortunately it was =
build with axis version 1, and I'm using axis2. It's trying to import =
org.apache.axis packages whereas the new version's package names begin =
with org.apache.axis2. Moreover, some classes from the old version have =
moved since the new one. For example, wss4j tries to import =
org.apache.axix.Message, but there is no such class =
org.apache.axis2.Message, so I can't just change the package names.

Anyway, is wss4j still in active development? It doesn't look like it. =
Has anyone moved the source to be compatible with axis2?

cheers,
md
=20

> -----Original Message-----
> From: Davis, Michael=20
> Sent: Friday, July 06, 2007 2:28 PM
> To: 'axis-user@ws.apache.org'
> Subject: Rampart configuration question
>=20
>=20
> Hi,
>=20
> I'm trying to use Rampart to encrypt my message body using a=20
> symetric secret key.
>=20
> Sample 9, included with the Rampart distibution, does just=20
> this. The actual key is hard-coded in a callback function=20
> both on the client and the server. My understanding is that=20
> the key is the only piece of data needed to encode the message.
>=20
> I was wondering why this part of the client config file:
>=20
>         <action>
>             <items>Encrypt</items>
>             <user>client</user>
>            =20
> <encryptionKeyIdentifier>EmbeddedKeyName</encryptionKeyIdentifier>
>            =20
> <EmbeddedKeyCallbackClass>org.apache.rampart.samples.sample09.
> PWCBHandler</EmbeddedKeyCallbackClass>
>             <encryptionPropFile>client.properties</encryptionPropFile>
>             <EmbeddedKeyName>SessionKey</EmbeddedKeyName>
>         </action>
>=20
> contains the encryptionPropFile property. The said property=20
> file contains this:
>=20
> org.apache.ws.security.crypto.provider=3Dorg.apache.ws.security.
> components.crypto.Merlin
> org.apache.ws.security.crypto.merlin.keystore.type=3Djks
> org.apache.ws.security.crypto.merlin.keystore.password=3Dapache
> org.apache.ws.security.crypto.merlin.file=3Dclient.jks
>=20
> Now, I can see why we need to configure the provider class.=20
> But why does Rampart need the keystore? I'm not using=20
> public/private keys or certificates, just one secret key.
>=20
> The code works, but I'd like to simplify it as much as=20
> possible. The properties and keystore files shouldn't be=20
> necessary, unless I'm misunderstanding something.
>=20
> Many thanks
> Michael Davis
>=20

---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org