Sun Microsystems 820433510 manual Securing the Sample Application

Configuring the Enterprise Server for Message Security

Configuring Application-Specific Web Services

Security

Application-specific web services security functionality is configured (at application assembly) by defining message-security-binding elements in the Sun-specific deployment descriptors of the application. These message-security-binding elements are used to associate a specific provider or message protection policy with a web services endpoint or service reference, and may be qualified so that they apply to a specific port or method of the corresponding endpoint or referenced service.

For more information on defining application specific message protection policies, refer to Chapter 5, “Securing Applications,” in Sun GlassFish Enterprise Server 2.1 Developer’s Guide.

Securing the Sample Application

The Enterprise Server ships with a sample application named xms. The xms application features a simple web service that is implemented by both a J2EE EJB endpoint and a Java Servlet endpoint. Both endpoints share the same service endpoint interface. The service endpoint interface defines a single operation, sayHello, which takes a string argument, and returns a String composed by pre-pending Hello to the invocation argument.

The xms sample application is provided to demonstrate the use of the Enterprise Server’s WS-Security functionality to secure an existing web services application. The instructions which accompany the sample describe how to enable the WS-Security functionality of the Enterprise Server such that it is used to secure the xms application. The sample also demonstrates the binding of WS-Security functionality directly to the application (as described in “Configuring Application-Specific Web Services Security” on page 133application.

The xms sample application is installed in the directory: as-install/samples/webservices/security/ejb/apps/xms/.

For information on compiling, packaging, and running the xms sample application, refer to the Securing Applications chapter of the Developers’ Guide.

Configuring the Enterprise Server for Message Security

■“Actions of Request and Response Policy Configurations” on page 134

■“Configuring Other Security Facilities” on page 135

■“Configuring a JCE Provider” on page 135

Chapter 10 • Configuring Message Security 133