ESB: Invoking secured backend - Part 1 - Username Token

Scenario 

1. Backend service is secured using Username token. 
2. Client invokes ESB proxy using http. ( no security between client and ESB) 
3. At the ESB, proxy adds username token to outgoing message and invokes secured backend.
4. ESB sends back echo service's response back to client. 

Setting up environment 

Backend ( WSO2 Application server 5.2.1)

1. Start WSO2 AS 5.2.1 using ( Unix: sh wso2server.sh / Windows: wso2server.bat ) 
2. Log in to management console. ( https://localhost:9443/carbon/ ) 
3. Create two user called tom and bom
• Goto Configure -> Users and Roles -> Users
• Create an user called tom with password "tompass". 
• Create another user called bob with password "bobpass"
• Assign both users to "admin" role.
4. Secure Echo service with Username token. 
• Goto Main -> Services -> List 
• Click on "echo" service. This will open up "Service Dashboard (echo)" page.
• Under "Quality of Service Configuration", Select "security".
• In "Security for the service" page, Select Enable security.
• Under Security scenarios, select "Username token"  ( First security policy) and click next. 
• In next page, select "admin" under user group. 
• Click Finish. 

ESB ( WSO2 ESB 4.8.1 )

1. Start WSO2 ESB with port offset =1 ( Unix: sh wso2server.sh -DportOffset=1 / Windows: wso2server.bat --DportOffset=1) 

Rampart configuration for UsernameToken  ( ESB )

• Create an ESB in-line xml local entry called "UTOverTransport.xml" with following content. 

Password callback Implementation

• Create a jar with following class, and drop it to /repository/components/lib/
• Then restart ESB server. 
• ( Maven Project is located here. )

Some useful References on Rampart password callback handler:  

1. http://wso2.com/library/3733/
2. http://wso2.com/library/240/

ESB Proxy

• Create a proxy called EchoUTProxy with following content. 

Testing Scenario

• Enable Soap tracer on WSO2 AS.
• Invoke EchoUTProxy  using SOAP UI. 

You can see Username token in request message as follows.