javasslhttpswebservice-clientxfire

Consume Web service over ssl using XFire

My project use xfire as a web service client api. My project is in legacy Servlet/JSP. We used XFire eclipse plugin to generate client stub.

Web-service has Migrated to SLL (HTTPS). Is there any easy way to consume Webservice over SSL in XFire.

I found some code at http://docs.codehaus.org/display/XFIRE/HTTP+Transport. I have some confusion there too. It motivates to use not-so-common-ssl which is in Alpha and I don't know if it is stable enough to be used in production.

// Technique similar to http://juliusdavies.ca/commons-    ssl/TrustExample.java.html
HttpSecureProtocol protocolSocketFactory = new HttpSecureProtocol();

// "/thecertificate.cer" can be PEM or DER (raw ASN.1).  Can even be several PEM certificates in one file.
TrustMaterial trustMaterial = new TrustMaterial(getClass().getResource("/thecertificate.cer"));

// We can use setTrustMaterial() instead of addTrustMaterial() if we want to remove
// HttpSecureProtocol's default trust of TrustMaterial.CACERTS.
protocolSocketFactory.addTrustMaterial(trustMaterial);

// Maybe we want to turn off CN validation (not recommended!):
protocolSocketFactory.setCheckHostname(false);

Protocol protocol = new Protocol("https", (ProtocolSocketFactory) protocolSocketFactory, 8443);
Protocol.registerProtocol("https", protocol);

Now above is a way to create a Protocol factory and getting it registered with Apache HTTPclient api. But id doesnot say what to do further with the generated stub.

Please feel free to ask more information if any.

We can't move to other web-service client api so that is not an option.

Solution

  • Managed to solve my own problem. This is how I did it. XFire use Apache Http client internally so setting Security certifect detail on this Api will do the job. We will use no-yet-common-ssl.jar for this purpose.

    First we will create org.apache.commons.ssl.TrustMaterial using commons and then set it in HttpSecureProtocol which is a child of javax.net.ssl.SSLSocketFactory.

    Suppose XYZ.cer is the client certifect provided by service provider.

    HttpSecureProtocol protocolSocketFactory = new HttpSecureProtocol();
protocolSocketFactory.addTrustMaterial(TrustMaterial.DEFAULT); //for trusting all the certifects in java trusted Store. 
protocolSocketFactory.addTrustMaterial(new TrustMaterial(getClass().getResource("/XYZ.cer")));
Protocol protocol = new Protocol("https", (ProtocolSocketFactory)protocolSocketFactory, 443);
Protocol.registerProtocol("https", protocol);

    If this is a web Application you can do this in ServletContextListener or in any part of code that executes when application boots.

    Now you can use any ssl service using Xfire client stub. Any service which implement the above certifect.

    Now why this work. Because XFire uses Apache Http Client as a connection api and we are telling Http client to use the above TrustManager when HTTPS is used.