Securing a Proxy Service in WSO2 ESB using a Username and passwordDigest (Hashpassword)

In this post i am going to explain how to secure a simple proxy service in WSO2 ESB 4.7.0 to be authenticated with UsernameToken method with using the username and hashpassword.

The HashPassword or NoPassword options are defined with WS-Policy 1.2 specification onwards. Therefore in order to have this feature we need to write a policy file using WS-Policy 1.2 spec.

First let's create a simple pass through proxy and make it secured.

1. Add a new pass through proxy  and specify an endpoint of a running service there. I have used SimpleStockQuoteService which can be run in <ESB_Home>/samples/axis2Server/src/SimpleStockQuoteService. Build the service using 'ant' and start the Axis2 server by,

cd ESB_home/samples/axis2Server $ sh axis2Server.sh 

2. After this go to the list of service in the UI. You will see that 'StockQuoteSecure' service is displayed as "Unsecured". Click on this link and it will redirect to a page where you can enable security to this service. Enable security there and select UsernameToken as the basic authentication mechanism as shown in the image below. After that goto next page and select the user groups who can access this service.

3. Once you finish this, WSO2 ESB admin console will display the service as secured, and we can only invoke this service using https:// endpoint now.

4. Next we need to change a default UsernameToken policy of the service and make it able to validate Hashpasswords. Goto the service dashboard of the secured service by clicking on it. Under the 'Quality of Service Configuration' section 'Policies' will be defined.

5. When you click on 'Policies' link it will be redirected to edit the current policy. Find 'StockQuoteSecureSoap11Binding' tab in here and click on 'Edit Policy' button as shown below.

6. Now let's define our new policy here. Copy the Following policy configuration and replace the existing policy definition with this one.

Save the policy back.

    
        
            
                
                    
                        
                    
                
                
                    
                        
                    
                
                
                    
                        
                    
                
                
            
        
        
            
                
                    
                        
                        
                    
                
            
        
        
            useReqSigCert
	    admin
	    org.wso2.carbon.digestpwd.PWCBHandler
        
    

7. The StockQuoteSecure service is secured now and is configured to use Username and Hashpassword for authentication.

8. As defined in the policy configuration, it uses org.wso2.carbon.digestpwd.PWCBHandler class to validate the user. Here i have written PWCBHandler.java class which can validate the default 'admin' user of WSO2 ESB.  Before trying to invoke the proxy service we need to add this PWCBHandler-1.0.jar client library into <ESB_Home>/repository/components/lib directory. You can download the jar from here.

[ The above sample PWCBHandler class is written to validate the 'admin' user only. According to your requirements you can write a customized PasswordCallBackHandler class which validates a set of registered users etc. in similar manner. ]

9. Now we can invoke the secured service using a Client, and i have used SOAP UI as the sample client here. Create a new SoapUI project by using SimpleStockQuoteService.wsdl file attached here. Then use any of the operations defined in the SimpleStockQuoteService and send a request to oure secured proxy service using SoapUI. Before sending the request enter the following values as Request Properties.

Username: admin

Password: admin

WSS-Password Type: PasswordDigest

WSS Time to Live: 2000

10. Once sent the request there will be a response message  returned from SimpleStockQuoteService which implies that the Usename/Hashpassword combination is authenticated successfully.

Configuring proxy settings for Apache Maven

Ever wondered how to build your project with Apache Maven via a proxy server? This is a brief tutorial on how to do so.

Environment : Ubuntu 11.10 Oneiric

                        Apache maven 2.2.1

Apache maven holds all the configuration data in a single file called settings.xml file inside the 'conf' directory in the main directory of maven. The file includes configuration details regarding the proxies therefore we need to edit that section in order to enable the proxy server for a maven build.

This is how to do it.

• Download the maven binary distribution from Apache Maven downloads page. The newest version is 3.0.4 however the stable version is 2.2.1 for the existing projects which are not upgraded into maven 3.

• Extract the binary distribution into somewhere in your hard disk. apache-maven-2.2.1 directory will be visible now. Browse to the 'conf' directory inside 'apache-maven-2.2.1' main directory.

• The 'settings.xml' file is inside the 'conf' directory. Open the file with a text editor and uncomment the section between <proxy> </proxy> tags. Edit the <proxy> entry as follows.

<proxies>
    <!-- proxy
     | Specification for one proxy, to be used in connecting to the network.
     | -->
    <proxy>
      <id>optional</id>
      <active>true</active>
      <protocol>http</protocol>
      <username>proxyuser</username>
      <password>proxypass</password>
      <host>MYHOST.LK</host>
      <port>3200</port>
      <nonProxyHosts>www.google.com|*.somewhere.com</nonProxyHosts>
    </proxy>
   
  </proxies>

• Replace the MYHOST.LK address with the host address of your proxy server and replace the port number with relevant proxy port too. Save and close the file, now and you are ready to build via a proxy :)

How to set up Apache Subversion to be accessed via a proxy (With Ubuntu))

I was going to access a subversion repository from my university network proxy for the first time and it was then that i realized that it is not possible with the usual subversion configuration. There are many options can be used in overcoming this  but the following simple solution worked for me very well.

Apache Subversion uses the 'servers' file to keep track of its' server configurations. If we need to use subversion through a proxy server the proxy-host and the port must be first configured in this file as it is not enabled by default. The simple steps to do this is;

1. We have to add the proxy server configuration into the 'servers' file in both locations.

• /etc/subversion directory in our root directory 
• .subversion directory in our home directory. 

However it would be sufficient only changing the 'servers' file in  .subversion directory to make this works.

2.However we can't edit the 'servers' file in etc/subversion directory since it demands root permission to edit it. So we have to open file as the root.

Open a terminal window by using ctrl+alt+T keys and enter the following command.

isha@pc:~$ sudo su
[sudo] password for isha: 

This will demand you for the password before providing root privileges.Enter the password and now we have root access in our computer. Go to the directory and open 'servers' file in text editor now.

root@isha-pc:/home/isha# cd /etc/subversion 

root@isha-pc:/etc/subversion# gedit servers

The 'servers' file will be opened now in the text editor. Look for the [global] settings section you will see some lines like this.

[global]
# http-proxy-exceptions = *.exception.com, www.internal-site.org
# http-proxy-host = my.proxy.domain.com
# http-proxy-port = 7000
# http-proxy-username = defaultusername
# http-proxy-password = defaultpassword

Change the 'http-proxy-host' with the address of your proxy server (excluding http:// part) and enter the port number into 'http-proxy-port' line. If you need edit the username and password settings too.

Important: Remove # symbol and all the spaces in front of the line you changed as additional spaces will result errors in the configuration. 

After editing it will look like,

[global]
# http-proxy-exceptions = *.exception.com, www.internal-site.org
http-proxy-host = my.proxy.lk
http-proxy-port = 3100

Save the file and close it.

3.We need to add the same configuration into the 'servers' file in .subversion directory. However it doesn't need root access to edit this file. Therefore open the file as a normal user and add the above details. Save and close.

4. Open a new terminal tab and access subversion repository back.

A useful thread to know additional options will be, svn-over-http-proxy