IBM WebSphere V5.0 Security - CGISecurity

Open the Web Service proxy client generated by WebSphere Studio Application
Developer. In this class, you will see the methods that we exposed as Web
Services, for example in our case you would see the getBranchBalance and
getCustomerBalance methods; add the following lines to the code.
Example 7-3 Setting user name and password for the SOAP transport
SOAPHTTPConnection soaptransport = new SOAPHTTPConnection();
soaptransport.setUserName("your-userName");
soaptransport.setPassword("your-Password");
call.setSOAPTransport(soaptransport);
Save the proxy class and restart the test environment server. Now, when you test
your Web Service again, if you use TCP/IP Server to check the SOAP request,
the SOAP header will consist of user credentials. However, this information is by
default encrypted using Base64 encryption algorithm, so you won’t be able to
read the user name and password.
HTTP Basic Authentication with SSL
It is very easy to use these Web Services we developed using SSL. Make sure
you have the HTTPS port enabled for your test environment in WebSphere
Studio by selecting it on server configuration page.
We know the URL for our test Web Service sample is:
http://localhost:9080/itsobank/sample/ConsultationHelper/TestClient.jsp
To use SSL, you just need to change the port number from 9080 to 9443 in the
above URL and check
http://localhost:9443/itsobank/sample/ConsultationHelper/TestClient.jsp
in the browser; you should see the certificate appear.
Secured and non-secured services together
It is possible that we need to secure some services and not others. Even for the
services we do secure, it is true that if all those services are accessed using the
same URL and if a user supplies the credentials for one service, the user can
access any service with this URL. For protection, we need to create different
URLs for each secured service and allow them for different users, groups and
roles.
For example, create two servlet URLs; one is protected and one is not. If you
look at the web.xml sample below, you will find that this is very simple, as you
only have to create another URL for services.This security configuration is
discussed in the above sections.
Chapter 7. Securing Enterprise Integration components 145