SOAP Web 服务上的 XACML 应用程序

Question

I'm new to web-services and i would like to know the answer to some questions.

First, i know that REST APIS can be consumed just by having the URL of the rest endpoint, on the other side ( SOAP ), you can't consume any distant SOAP WS unless you develop a client. Is it correct? And if it is, is it the only difference between the 2 big families ?

Second, i would like to apply XACML on some SOAP Web Services for security purpose of course. I made a figure that resumes the entire process of XACML.

I developed some basic SOAP web services with simple 2 methods, and i don't know from where should i start the XACML code and configuration. I'm asking you guys for some good and helpful links to apply the XACML security filter.

Answer 1

You can find an example of CXF interceptor doing XACML-based (XACML 3.0) authorization on Colm O hEigeartaigh's blog (Colm is one of the main CXF developers). The actual source code of the CXF Interceptor: XACML3AuthorizingInterceptor . It is using OpenAZ as XACML implementation, but you can adapt it to use another XACML implementation, such as Axiomatics mentioned here by David Brossard, or AuthzForce (supporting embedded or remote RESTful PDP modes), or other implementations mentioned at the end of the XACML TC's page .

The first important part of the CXF Interceptor is at the beginning of the handleMessage(Message message) method:

SecurityContext sc = message.get(SecurityContext.class);

The SecurityContext gives you information about the authenticated user such as the user roles, which you can use as XACML subject attributes in the XACML request.

The code further creates the XACML Request using the DefaultXACML3RequestBuilder class , that extracts other information from the CXF Message using CXFMessageParser - that you can find in the cxf-rt-security-saml library - such as the SOAP service name, operation name (as defined in the WSDL), and the endpoint URI:

 CXFMessageParser messageParser = new CXFMessageParser(message);
 ...
 String actionToUse = messageParser.getAction(action);
 ...
 QName serviceName = messageParser.getWSDLService();
 QName operationName = messageParser.getWSDLOperation();
 ...