Added: webservices/website/wss4j/using.html URL: http://svn.apache.org/viewvc/webservices/website/wss4j/using.html?rev=1565626&view=auto ============================================================================== --- webservices/website/wss4j/using.html (added) +++ webservices/website/wss4j/using.html Fri Feb 7 11:52:13 2014 @@ -0,0 +1,243 @@ +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd";> +<!-- Generated by Apache Maven Doxia Site Renderer 1.4 at 2014-02-07 --> +<html xmlns="http://www.w3.org/1999/xhtml"; xml:lang="en" lang="en"> + <head> + <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> + <title>Apache WSS4J - </title> + <style type="text/css" media="all"> + @import url("./css/maven-base.css"); + @import url("./css/maven-theme.css"); + @import url("./css/site.css"); + </style> + <link rel="stylesheet" href="./css/print.css" type="text/css" media="print" /> + <meta name="Date-Revision-yyyymmdd" content="20140207" /> + <meta http-equiv="Content-Language" content="en" /> + + </head> + <body class="composite"> + <div id="banner"> + <a href="./" id="bannerLeft"> + Apache WSS4J + </a> + <a href="http://www.apache.org"; id="bannerRight"> + <img src="http://activemq.apache.org/images/asf-logo.png"; alt="$alt" /> + </a> + <div class="clear"> + <hr/> + </div> + </div> + <div id="breadcrumbs"> + + + <div class="xleft"> + <span id="publishDate">Last Published: 2014-02-07</span> + | <span id="projectVersion">Version: 2.0.0-SNAPSHOT</span> + </div> + <div class="xright"> + + </div> + <div class="clear"> + <hr/> + </div> + </div> + <div id="leftColumn"> + <div id="navcolumn"> + + + <h5>Apache WSS4J</h5> + <ul> + <li class="none"> + <a href="index.html" title="Home">Home</a> + </li> + <li class="none"> + <a href="download.html" title="Download">Download</a> + </li> + <li class="none"> + <strong>Using WSS4J</strong> + </li> + <li class="none"> + <a href="config.html" title="WSS4J Configuration">WSS4J Configuration</a> + </li> + <li class="none"> + <a href="migration.html" title="WSS4J 2.0.0 Migration Guide">WSS4J 2.0.0 Migration Guide</a> + </li> + <li class="none"> + <a href="topics.html" title="Special Topics">Special Topics</a> + </li> + <li class="none"> + <a href="best_practice.html" title="Security Best Practices">Security Best Practices</a> + </li> + <li class="none"> + <a href="wss4j16.html" title="WSS4J 1.6 Release Notes">WSS4J 1.6 Release Notes</a> + </li> + </ul> + <h5>Project Documentation</h5> + <ul> + <li class="collapsed"> + <a href="project-info.html" title="Project Information">Project Information</a> + </li> + </ul> + <a href="http://maven.apache.org/"; title="Built by Maven" class="poweredBy"> + <img class="poweredBy" alt="Built by Maven" src="./images/logos/maven-feather.png" /> + </a> + + + </div> + </div> + <div id="bodyColumn"> + <div id="contentBox"> + + +<div class="section"> +<h2>Using Apache WSS4J<a name="Using_Apache_WSS4J"></a></h2> + +<p> +This page describes how to use Apache WSS4J, either in a standalone manner, or in conjunction with +other software packages. For information about how to configure WSS4J 1.6, see the +<a href="config.html">configuration page</a>. +</p> + +<div class="section"> +<h3>Standalone<a name="Standalone"></a></h3> + +<p> +Apache WSS4J provides a set of APIs to implement WS-Security functionality on a SOAP message. It is +possible to use these APIs directly in a standalone manner. The best way of finding out how to do +this is to take a look at the test sources. For example: +</p> + +<ul> + +<li> +<a href="xref-test/org/apache/ws/security/message/UsernameTokenTest.html">Username Token Test</a> +</li> + +<li> +<a href="xref-test/org/apache/ws/security/message/EncryptionTest.html">Encryption Test</a> +</li> + +<li> +<a href="xref-test/org/apache/ws/security/message/SignatureTest.html">Signature Test</a> +</li> + +<li> +<a href="xref-test/org/apache/ws/security/message/TimestampTest.html">Timestamp Test</a> +</li> + +<li> +<a href="xref-test/org/apache/ws/security/saml/SamlTokenTest.html">SAML Token Test</a> +</li> +</ul> +</div> + +<div class="section"> +<h3>Apache CXF<a name="Apache_CXF"></a></h3> + +<p> +<a class="externalLink" href="http://cxf.apache.org";>Apache CXF</a> is an open-source web services stack. CXF uses +WSS4J to perform the core WS-Security functionality, and provides extended security functionality +based around the WS-SecurityPolicy, WS-SecureConversation and WS-Trust specifications. More +information: +</p> + +<ul> + +<li> +<a class="externalLink" href="http://cxf.apache.org/docs/ws-security.html";>CXF WS-Security configuration</a> +</li> + +<li> +<a class="externalLink" href="http://cxf.apache.org/docs/ws-secureconversation.html";>CXF WS-SecureConversation +configuration</a> +</li> + +<li> +<a class="externalLink" href="http://cxf.apache.org/docs/ws-securitypolicy.html";>CXF WS-SecurityPolicy configuration</a> +</li> + +<li> +<a class="externalLink" href="http://cxf.apache.org/docs/ws-trust.html";>CXF WS-Trust configuration</a> +</li> + +<li> +<a class="externalLink" href="http://cxf.apache.org/resources-and-articles.html";>CXF Security articles</a> +</li> +</ul> +</div> + +<div class="section"> +<h3>Apache Rampart<a name="Apache_Rampart"></a></h3> + +<p> +<a class="externalLink" href="http://axis.apache.org/axis2/java/rampart/";>Apache Rampart</a> is the security module +for the Axis2 web services stack. Rampart uses WSS4J to perform the core WS-Security functionality, +and provides extended security functionality based around the WS-SecurityPolicy, +WS-SecureConversation and WS-Trust specifications. More information: +</p> + +<ul> + +<li> +<a class="externalLink" href="http://axis.apache.org/axis2/java/rampart/developer-guide.html";>Rampart developer guide</a> +</li> + +<li> +<a class="externalLink" href="http://axis.apache.org/axis2/java/rampart/samples.html";>Rampart samples</a> +</li> + +<li> +<a class="externalLink" href="http://axis.apache.org/axis2/java/rampart/rampartconfig-guide.html";>Rampart configuration +guide</a> +</li> + +<li> +<a class="externalLink" href="http://axis.apache.org/axis2/java/rampart/articles.html";>Rampart articles</a> +</li> +</ul> +</div> + +<div class="section"> +<h3>Apache Axis 1<a name="Apache_Axis_1"></a></h3> + +<p> +The 1.5.x branch of WSS4J contains special support for +<a class="externalLink" href="http://ws.apache.org/axis/";>Apache Axis 1</a>, the open-source web services stack which has been +replaced by Axis2. For some information about how to use WSS4J 1.5.x with Axis 1 see: +</p> + +<ul> + +<li> +<a href="axis.html">Axis deployment tutorial 1</a> +</li> + +<li> +<a href="package.html">Axis deployment tutorial 2</a> +</li> +</ul> + +<p> +Please note that these deployment tutorials do not apply to WSS4J 1.6+, only WSS4J 1.5.x. +</p> +</div> +</div> + + + </div> + </div> + <div class="clear"> + <hr/> + </div> + <div id="footer"> + <div class="xright"> + Copyright © 2004-2014 + <a href="http://www.apache.org/";>The Apache Software Foundation</a>. + All Rights Reserved. + + </div> + <div class="clear"> + <hr/> + </div> + </div> + </body> +</html>
Added: webservices/website/wss4j/wss4j16.html URL: http://svn.apache.org/viewvc/webservices/website/wss4j/wss4j16.html?rev=1565626&view=auto ============================================================================== --- webservices/website/wss4j/wss4j16.html (added) +++ webservices/website/wss4j/wss4j16.html Fri Feb 7 11:52:13 2014 @@ -0,0 +1,316 @@ +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd";> +<!-- Generated by Apache Maven Doxia Site Renderer 1.4 at 2014-02-07 --> +<html xmlns="http://www.w3.org/1999/xhtml"; xml:lang="en" lang="en"> + <head> + <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> + <title>Apache WSS4J - </title> + <style type="text/css" media="all"> + @import url("./css/maven-base.css"); + @import url("./css/maven-theme.css"); + @import url("./css/site.css"); + </style> + <link rel="stylesheet" href="./css/print.css" type="text/css" media="print" /> + <meta name="Date-Revision-yyyymmdd" content="20140207" /> + <meta http-equiv="Content-Language" content="en" /> + + </head> + <body class="composite"> + <div id="banner"> + <a href="./" id="bannerLeft"> + Apache WSS4J + </a> + <a href="http://www.apache.org"; id="bannerRight"> + <img src="http://activemq.apache.org/images/asf-logo.png"; alt="$alt" /> + </a> + <div class="clear"> + <hr/> + </div> + </div> + <div id="breadcrumbs"> + + + <div class="xleft"> + <span id="publishDate">Last Published: 2014-02-07</span> + | <span id="projectVersion">Version: 2.0.0-SNAPSHOT</span> + </div> + <div class="xright"> + + </div> + <div class="clear"> + <hr/> + </div> + </div> + <div id="leftColumn"> + <div id="navcolumn"> + + + <h5>Apache WSS4J</h5> + <ul> + <li class="none"> + <a href="index.html" title="Home">Home</a> + </li> + <li class="none"> + <a href="download.html" title="Download">Download</a> + </li> + <li class="none"> + <a href="using.html" title="Using WSS4J">Using WSS4J</a> + </li> + <li class="none"> + <a href="config.html" title="WSS4J Configuration">WSS4J Configuration</a> + </li> + <li class="none"> + <a href="migration.html" title="WSS4J 2.0.0 Migration Guide">WSS4J 2.0.0 Migration Guide</a> + </li> + <li class="none"> + <a href="topics.html" title="Special Topics">Special Topics</a> + </li> + <li class="none"> + <a href="best_practice.html" title="Security Best Practices">Security Best Practices</a> + </li> + <li class="none"> + <strong>WSS4J 1.6 Release Notes</strong> + </li> + </ul> + <h5>Project Documentation</h5> + <ul> + <li class="collapsed"> + <a href="project-info.html" title="Project Information">Project Information</a> + </li> + </ul> + <a href="http://maven.apache.org/"; title="Built by Maven" class="poweredBy"> + <img class="poweredBy" alt="Built by Maven" src="./images/logos/maven-feather.png" /> + </a> + + + </div> + </div> + <div id="bodyColumn"> + <div id="contentBox"> + + +<div class="section"> +<h2>Apache WSS4J 1.6<a name="Apache_WSS4J_1.6"></a></h2> + +<p> +This page describes the new features of WSS4J 1.6, and the things to be aware of when upgrading +from WSS4J 1.5.x. +</p> + +<div class="section"> +<h3>New features<a name="New_features"></a></h3> + +<p> +This section describes the main new features that have been implemented in WSS4J 1.6. For more +information on the changes, please click on the links. You can also review the +<a class="externalLink" href="https://issues.apache.org/jira/browse/WSS/fixforversion/12313718";>list of JIRAs</a> +that have been fixed in WSS4J 1.6. +</p> + +<ul> + +<li> +<a class="externalLink" href="http://coheigea.blogspot.com/2011/03/wss4j-16-jsr-105-support.html";>JSR-105 support</a>: +WSS4J 1.6 has been ported to use the JSR 105 API for XML Digital Signature. +</li> + +<li> +<a class="externalLink" href="http://coheigea.blogspot.com/2011/02/support-for-saml2-assertions-in-wss4j.html";> +SAML2 support</a>: WSS4J 1.6 includes full support for creating, manipulating and parsing SAML2 +assertions, via the Opensaml2 library. +</li> + +<li> +Performance work: A general code-rewrite has been done with a focus on improving performance, +e.g. the <a class="externalLink" href="http://coheigea.blogspot.com/2011/01/wss4j-16-actionprocessor-loading-change.html";> +changes</a> that have been made to processor loading. +</li> + +<li> +<a class="externalLink" href="http://coheigea.blogspot.com/2011/03/wss4j-16-basic-security-profile-11.html";> +Basic Security Profile 1.1 compliance</a>: WSS4J 1.6 provides support for the BSP 1.1 specification. +</li> + +<li> +JDK 1.5 port: The JDK 1.4 requirement of WSS4J 1.5.x has been dropped as part of this work. +</li> + +<li> +<a class="externalLink" href="http://coheigea.blogspot.com/2011/01/wss4j-16-crypto-property-change.html";> +Support for Crypto trust-stores</a>: WSS4J 1.6 separates the concept of keystore and truststores for +Crypto implementations. +</li> + +<li> +<a class="externalLink" href="http://coheigea.blogspot.com/2011/04/wss4j-16-introducing-validators.html";> +New Validator interface</a>: WSS4J 1.6 moves all validation of security tokens into a new Validator +interface, which allows for custom validation of specific tokens. +</li> + +<li> +Support for the Kerberos Token Profile (in WSS4J 1.6.2 and 1.6.3). +</li> +</ul> +</div> + +<div class="section"> +<h3>Upgrade notes<a name="Upgrade_notes"></a></h3> + +<p> +This section describes the changes that have been made in WSS4J 1.6 that will impact on an existing +user of WSS4J 1.5.x. Although WSS4J 1.6 is not 100% backwards compatible with 1.5.x, a general goal for +the release was to restrict the API changes to those that were strictly necessary. +</p> + +<ul> + +<li> +All Axis1 dependencies have been removed. Any user wishing to use WSS4J with Axis1 must use the +WSS4J 1.5.x library. As Axis1 has been replaced by Axis2, this is unlikely to be an issue. +</li> + +<li> +A number of changes have been made to the Crypto interface. See +<a class="externalLink" href="http://coheigea.blogspot.com/2011/01/wss4j-16-crypto-property-change.html";>here</a>, +<a class="externalLink" href="http://coheigea.blogspot.com/2011/02/wss4j-16-changes-to-crypto-interface.html";>here</a> +and <a class="externalLink" href="http://coheigea.blogspot.com/2011/02/wss4j-16-change-to-publickey-validation.html";>here</a> +for an indepth explanation. In a nutshell, these changes are: + +<ol style="list-style-type: decimal"> + +<li> +The BouncyCastle crypto implementation has been removed (replaced by Merlin) +</li> + +<li> +A new set of Merlin "truststore" configuration tags have been added. The behaviour of the old Merlin +configuration tags will work exactly the same way in WSS4J 1.6. +</li> + +<li> +The CA certs are now <b>not</b> loaded by default. +</li> + +<li> +PublicKeys (from KeyValues) are now not handled by a PublicKeyCallback, but by the Crypto implementation +directly. +</li> +</ol> +</li> + +<li> +If the WSEncryptionPart used to point to an element for signature or encryption does not either store +the element directly, or store the wsu:Id, <b>all</b> DOM Elements that match the stored +localname/namespace will be processed. See the +<a class="externalLink" href="http://ws.apache.org/wss4j/topics.html#Specifying_elements_to_sign_or_encrypt";>Special Topics page</a> +for more information. +</li> + +<li> +WSS4J 1.5.x used Opensaml1 to provide extremely limited support for SAML 1 assertions. WSS4J 1.6 has +been upgraded to Opensaml2, and provides far more comprehensive support for SAML. See +<a class="externalLink" href="http://coheigea.blogspot.com/2011/02/support-for-saml2-assertions-in-wss4j.html";>here</a> for +more information on this. Some changes to be aware of are: + +<ol style="list-style-type: decimal"> + +<li> +The way of creating SAML assertions via a properties file has completely changed. For example, see a +<a href="xref-test/org/apache/ws/security/saml/SamlTokenTest.html">SAML Token Test</a>. +</li> + +<li> +WSS4J 1.5.x ignored (enveloped) signatures on SAML (1.1) assertions - this is no longer the case, so +deployments which do not set the correct keystore/truststore config for dealing with signature +verification will fail. +</li> + +<li> +The SAMLTokenProcessor no longer saves all tokens as an "WSConstants.ST_UNSIGNED" action. It saves +tokens that do not have an enveloped signature as this action, and token which <b>do</b> have an enveloped +signature are saved as a "WSConstants.ST_SIGNED" action. +</li> + +<li> +The object that is saved as part of the action above has changed, from an Opensaml1 specific Assertion +object, to an AssertionWrapper instance, which is a WSS4J specific object which encapsulates an +Assertion, as well as some information corresponding to signature verification, etc. +</li> +</ol> +</li> + +<li> +The way that UsernameTokens are processed has been changed. See +<a class="externalLink" href="http://coheigea.blogspot.com/2011/02/usernametoken-processing-changes-in.html";>here</a> for +more information. Some important changes are: + +<ol style="list-style-type: decimal"> + +<li> +The plaintext password case has exactly the same behaviour as the digest case. The identifier is now +WSPasswordCallback.USERNAME_TOKEN and not WSPasswordCallback.USERNAME_TOKEN_UNKNOWN, and the +CallbackHandler does not do any authentication, but must set the password on the callback. +</li> + +<li> +The custom password type case defaults to the same behaviour as the plaintext case, assuming +wssConfig.getHandleCustomPasswordTypes() returns true. +</li> + +<li> +For the case of a username token with no password element, the default behaviour is simply to ignore it, +and to store it as a new result of type WSConstants.UT_NOPASSWORD. +</li> +</ol> +</li> + +<li> +Some changes have been made to the WSPasswordCallback identifiers, used to obtain passwords for various +actions. For more information see +<a class="externalLink" href="http://coheigea.blogspot.com/2011/02/wspasswordcallback-changes-in-wss4j-16.html";>here</a>. In +a nutshell, these changes consist of: + +<ol style="list-style-type: decimal"> + +<li> +The WSPasswordCallback KEY_NAME, USERNAME_TOKEN_UNKNOWN and WSPasswordCallback.ENCRYPTED_KEY_TOKEN +identifiers have been removed. +</li> + +<li> +CUSTOM_TOKEN is not longer used in the processors to get a secret key. +</li> + +<li> +SECRET_KEY is a new identifier for finding secret keys. It replaces the occasionally incorrect use of +CUSTOM_TOKEN, as well as KEY_NAME and ENCRYPTED_KEY_TOKEN. +</li> +</ol> +</li> + +<li> +Timestamp validation and signature trust verification is not done by the WSHandler implementation +any more, but is performed when the security header is processed. +</li> +</ul> +</div> +</div> + + + </div> + </div> + <div class="clear"> + <hr/> + </div> + <div id="footer"> + <div class="xright"> + Copyright © 2004-2014 + <a href="http://www.apache.org/";>The Apache Software Foundation</a>. + All Rights Reserved. + + </div> + <div class="clear"> + <hr/> + </div> + </div> + </body> +</html>
![http://activemq.apache.org/images/asf-logo.png"](http://activemq.apache.org/images/asf-logo.png"){kind=link}