WSM in Fusion Middleware 11G

Probably you already knew the Web Service Manager of Soa Suite 10.1.3, The 10.1.3 version was mainly used in combination with Soa Suite because this was the only way to secure the BPEL and ESB Services. In FMW 11g Oracle changed WSM so it is fully integrated in all the Fusion Middleware components. Now you can use WSM in ADF, in the Services and References of Soa Suite and in the jax-ws services or proxy clients.
In FMW 11G you can also define your own ws-security policies ( just use a wizard in the EM website) or use the standard policies, So it can always comply to your security requirements.

In this blog entry I will show you how to setup FMW on Weblogic and define security on a BPEL service, call this service with an ADF Web Service Datacontol and a java web service proxy client.

Special thanks to Vishal Jain of Oracle who helped to solve the issues and explained how WSM works with keystores.

First we need to generate a keystore with a self signed certificate. Somehow certificates with generated with OpenSSL fails in FMW.
keytool -genkey -keyalg RSA -keystore C:\test_keystore.jks -storepass password -alias client_key -keypass password -dname "CN=Client, OU=WEB AGE, C=US" -keysize 1024 -validity 1460

Now here comes the trick , copy this keystore to fmwconfig folder ( domain_name/config ) of the soa suite domain

Go the Enterprise Manager Website where we can configure the just created keystore. We have to select the weblogic domain and go to the security menu / credentials.


Here we can change maps or passwords which will be stored in the cwallet.sso file. If you see the oracle.wsm.security map then you can delete this map. This map contains the keystore password.


Go the Security Provider Configuration menu item in the security menu where we will add the keystore to FMW
Press the Configure button in the keystore part of the screen.

Here we can add the keystore details. Use ./ as keystore path. This will fill the oracle.wsm.security map in the credentials menu.

Go back to the Credentials where we will add an extra entry in the wsm map. Create a new key basic.credentials with as username weblogic and with password weblogic1


Restart the Weblogic server.

Next part is to add a wsm policy to a BPEL Service.

Select the server policy you like to use and deploy this to the soa suite server.


Now we can make a jax-ws proxy client so we can test the policy. In this client we will use the matching client policy. If this fails check your libraries.

package nl.whitehorses.wsclient;

import java.util.Map;

import javax.xml.ws.BindingProvider;
import javax.xml.ws.WebServiceRef;

import oracle.webservices.ClientConstants;

import weblogic.wsee.jws.jaxws.owsm.SecurityPolicyFeature;

public class BPELProcess1_ptClient
{
 @WebServiceRef
 private static Bpelprocess1_client_ep bpelprocess1_client_ep;

 public static void main(String [] args)
 {
   bpelprocess1_client_ep = new Bpelprocess1_client_ep();
  
     SecurityPolicyFeature[] securityFeature = new SecurityPolicyFeature[] {
                      new SecurityPolicyFeature("oracle/wss10_message_protection_client_policy") };

     BPELProcess1 port = bpelprocess1_client_ep.getBPELProcess1_pt(securityFeature);
    
    
     Map reqContext = ((BindingProvider) port).getRequestContext();
     reqContext.put(ClientConstants.WSSEC_KEYSTORE_TYPE, "JKS");
     reqContext.put(ClientConstants.WSSEC_KEYSTORE_LOCATION, "C:\\test_keystore.jks");
     reqContext.put(ClientConstants.WSSEC_KEYSTORE_PASSWORD, "password");
     reqContext.put(ClientConstants.WSSEC_SIG_KEY_ALIAS, "client_key");
     reqContext.put(ClientConstants.WSSEC_SIG_KEY_PASSWORD, "password");
     reqContext.put(ClientConstants.WSSEC_ENC_KEY_ALIAS, "client_key");
     reqContext.put(ClientConstants.WSSEC_ENC_KEY_PASSWORD, "password");
     reqContext.put(ClientConstants.WSSEC_RECIPIENT_KEY_ALIAS, "client_key");
     System.out.println("output = " + port.process("aaaa"));
 
 }
}

If all went well then we can do same with a ADF Web Service Datacontrol.

To add the client policy select the DataControls.dcx and go to the structure window.

Here we can define web service security

Select the right client policy and in this case we need to override properties, press the button and fill in the recipient with your key alias. Else you will get a orakey error.

And at last deploy this webapplication with a ear profile to the Soa Suite server and test your webapp.