ESB: Invoking secured backend - Part 3 - Username Token with BasicAuth

This post shows, how to invoke an UsernameToken secured backend ( Hosted in WSO2 AS ), using basic auth. For this we use POXSecurityHandler, (Which comes default with WSO2 Products) to convert the HTTP basic auth information into wsse:UsernameToken.

Setting up environment : 

Setup both WSO2 AS and WSO2 ESB as mentioned in previous post.


ESB Proxy

• Create a proxy called EchoUTBasicProxy with following content. 

Testing Scenario

• Enable Soap tracer on WSO2 AS.
• Enable wire log in WSO2 ESB.
• Invoke EchoUTBasicProxy  using SOAP UI. 

You can see, there is no username token in incoming message to backend. Instead you see basic auth header in outgoing message to backend from ESB.

ESB: Invoking secured backend - Part 2 - Username Token - Dynamic username

My previous post shows how to invoke an username token secured backend using an ESB proxy. But we used static value for the username ( tom ), which is hard coded in the policy file. So each request authenticated as tom at the backend service.

But some may wants to access backend service as different users. This post discusses how you can extend it to support dynamic user name in policy file.


Setting up environment : 

Setup both WSO2 AS and WSO2 ESB as mentioned in previous post. 


ClassMediator (ESB)

• In this scenario, we set username as a property in the ESB proxy. 
• To pass username into RampartConfiguration, we use custom class mediator called, SetUserMediator.
• This custom mediator, adds username into rampartConfigCallbackProperties map and set the map into Axis2MessageContext. So later we can access these properties from Rampart ConfigCallbackHandlers. 
• We have to use customMediator, since we can't set a Map using standard ESB mediators.  
• ( Maven Project is located here. )

Rampart ConfigCallbackHandler (ESB)

• Similar to PasswordCallback handler, Rampart provides Configuration Callback handler to dynamically load Rampart configuaraion to runtime. We use this to set username dynamically. 
• ( Maven Project is located here. )

Policy for UsernameToken  ( ESB )

• Create an ESB in-line xml local entry called "UTOverTransportDynamic.xml" with following content. 

Proxy Service (ESB)

• Create a proxy called EchoUTDynamicProxy with following content. 

Testing Scenario

• Enable Soap tracer on WSO2 AS.
• Invoke EchoUTDynamicProxy  using SOAP UI. 

You can see Username token in request message as follows.

ESB: Invoking secured backend - Part 1 - Username Token

Scenario 

1. Backend service is secured using Username token. 
2. Client invokes ESB proxy using http. ( no security between client and ESB) 
3. At the ESB, proxy adds username token to outgoing message and invokes secured backend.
4. ESB sends back echo service's response back to client. 

Setting up environment 

Backend ( WSO2 Application server 5.2.1)

1. Start WSO2 AS 5.2.1 using ( Unix: sh wso2server.sh / Windows: wso2server.bat ) 
2. Log in to management console. ( https://localhost:9443/carbon/ ) 
3. Create two user called tom and bom
• Goto Configure -> Users and Roles -> Users
• Create an user called tom with password "tompass". 
• Create another user called bob with password "bobpass"
• Assign both users to "admin" role.
4. Secure Echo service with Username token. 
• Goto Main -> Services -> List 
• Click on "echo" service. This will open up "Service Dashboard (echo)" page.
• Under "Quality of Service Configuration", Select "security".
• In "Security for the service" page, Select Enable security.
• Under Security scenarios, select "Username token"  ( First security policy) and click next. 
• In next page, select "admin" under user group. 
• Click Finish. 

ESB ( WSO2 ESB 4.8.1 )

1. Start WSO2 ESB with port offset =1 ( Unix: sh wso2server.sh -DportOffset=1 / Windows: wso2server.bat --DportOffset=1) 

Rampart configuration for UsernameToken  ( ESB )

• Create an ESB in-line xml local entry called "UTOverTransport.xml" with following content. 

Password callback Implementation

• Create a jar with following class, and drop it to /repository/components/lib/
• Then restart ESB server. 
• ( Maven Project is located here. )

Some useful References on Rampart password callback handler:  

1. http://wso2.com/library/3733/
2. http://wso2.com/library/240/

ESB Proxy

• Create a proxy called EchoUTProxy with following content. 

Testing Scenario

• Enable Soap tracer on WSO2 AS.
• Invoke EchoUTProxy  using SOAP UI. 

You can see Username token in request message as follows.