IBM WebSphere V5.0 Security - CGISecurity

Open the Web Service proxy client generated by WebSphere Studio ApplicationDeveloper. In this class, you will see the methods that we exposed as WebServices, for example in our case you would see the getBranchBalance andgetCustomerBalance methods; add the following lines to the code.Example 7-3 Setting user name and password for the SOAP transportSOAPHTTPConnection soaptransport = new SOAPHTTPConnection();soaptransport.setUserName("your-userName");soaptransport.setPassword("your-Password");call.setSOAPTransport(soaptransport);Save the proxy class and restart the test environment server. Now, when you testyour Web Service again, if you use TCP/IP Server to check the SOAP request,the SOAP header will consist of user credentials. However, this information is bydefault encrypted using Base64 encryption algorithm, so you won’t be able toread the user name and password.HTTP Basic Authentication with SSLIt is very easy to use these Web Services we developed using SSL. Make sureyou have the HTTPS port enabled for your test environment in WebSphereStudio by selecting it on server configuration page.We know the URL for our test Web Service sample is:http://localhost:9080/itsobank/sample/ConsultationHelper/TestClient.jspTo use SSL, you just need to change the port number from 9080 to 9443 in theabove URL and checkhttp://localhost:9443/itsobank/sample/ConsultationHelper/TestClient.jspin the browser; you should see the certificate appear.Secured and non-secured services togetherIt is possible that we need to secure some services and not others. Even for theservices we do secure, it is true that if all those services are accessed using thesame URL and if a user supplies the credentials for one service, the user canaccess any service with this URL. For protection, we need to create differentURLs for each secured service and allow them for different users, groups androles.For example, create two servlet URLs; one is protected and one is not. If youlook at the web.xml sample below, you will find that this is very simple, as youonly have to create another URL for services.This security configuration isdiscussed in the above sections.Chapter 7. Securing Enterprise Integration components 145