RSS

How to Invoke the “echo service” secured with Kerberos in WSO2 ESB

13 Dec

This is most useful sample to verify the echo service secured with “kerberos”

First you have to download the WSO2-ESB 4.5.0 and WSO2-IS 4.0.0
In this example IS(Identity Server) act as KDC(key distribution center) so first of all we have to configure the IS

Open the bellow mentioned files and do the required changes

1. $IS_HOME/repository/conf/embedded-ldap.xml

Download Sample embedded-ldap.xml here
under <KDCServer> and  make the property “enable” = true as follows
<Property name=”enabled”>true</Property>

add this property under <KDCServer>
<Property name=”preAuthenticationTimeStampEnabled”>false</Property>

2. $IS_HOME/repository/conf/user-mgt.xml

Download Sample user-mgt.xml here
under <ApacheDSUserStoreManager>
<Property name=”kdcEnabled”>true</Property>

3. $IS_HOME/repository/conf/security/krb5.conf

Download Sample krb5.conf here

[libdefaults]
default_realm = WSO2.ORG
default_tkt_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
default_tgs_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
permitted_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
allow_weak_crypto = true

[realms]
WSO2.ORG = {
kdc = 127.0.0.1:8000
}

[domain_realm]
.wso2.org = WSO2.ORG
wso2.org = WSO2.ORG

[login]
krb4_convert = true
krb4_get_tickets = false

4. $IS_HOME/repository/conf/security/jaas.conf

Download Sample jaas.conf here

Server {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=false
storeKey=true
useTicketCache=false
isInitiator=false
principal=”esb/localhost@WSO2.ORG“;
};

Client {
com.sun.security.auth.module.Krb5LoginModule required
useTicketCache=false;
};

Now IS is configured successfully
Go to $IS_HOME/bin and run the wso2serever.sh

If IS configured properly, when your stating the IS you can see this log in command line
“[2012-12-13 14:40:32,426] INFO {org.apache.directory.server.kerberos.kdc.KdcServer} – Kerberos service started.”

Now you have to create the Server principle that we mention in “jass.conf”

Login to IS buy using username – “admin” password -”admin” and go to configure->Service Principle and create   It

is

Register the Server Principle
Service Name : esb/localhost
Description : Test
Password : dinuka
Re Password : dinuka

Next we have to create Client Principle that means “User”

Username : dinuka
Password : dinuka
User Role : admin
is

Lets move to configure the ESB

First go to $ESB_HOME/repository/conf/security/
and place the same krb5.conf and jaas.conf files in $IS_HOME/repository/conf/security/

Open $IS_HOME/repository/conf/carbon.xml and change the offset 0 to 1 and start the ESB
Download sample carbon.xml here

Go to ESB and secure the “echo” service with kerboros

is1

Service Principle Name : esb/localhost
Service Principle Password : dinuka

is2

We are done with the configuration now we have to invoke the echo service so you can download the Java Client from here

You have to set the project dependencies for above client so point the all jars in $ESB_HOME/repository/components/plugins 

If you change username and password at the configuration time you have to make those changes on the above client also Go to policy.xml in the above client and change the following details according to your setting

<rampart:property name=”client.principal.name”>dinuka</rampart:property>
<!– Authenticating user password –>
<rampart:property name=”client.principal.password”>dinuka</rampart:property>
<!– To which service client needs to talk to –>
<rampart:property name=”service.principal.name”>esb/localhost@WSO2.ORG</rampart:property>

Finally change the ECHO_SERVICE_EPR  relevant to the your ESB and run the KerberosClient.java

Results should be

Calling Echo service with parameter – Hello World
Response : <ns:echoStringResponse xmlns:ns=”http://echo.services.core.carbon.wso2.org”><return>Hello World</return></ns:echoStringResponse>

About these ads
 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
Follow

Get every new post delivered to your Inbox.

%d bloggers like this: