How to work with certificates and web services

[R9N1]

Hi,

Im evaluating Coldfusion MX 7 to start a new "big" project. I've been reading
about using web services and Coldfusion but I have not seen any documentation
on how to add security to these web services calls; I'm talking about
ws-security.

I mean, I can build a web service that asks the consumer for a x.509
certificate or some encryption within the call but Is there any way in
Coldfusion Mx 7 to invoke this web service adding this kind of security :
selecting a certificate from a cert pool, encrypting some parts of the call,
creating custom headers, etc?

Thanks all in advance

R9N1

[aaron_wvr]

Yes, I would very much like to get some info on this as well. Thank you!

Aaron

[Tom Jordahl]

We use Apache Axis, which does have a plugin for WS-Security.

See [url]http://ws.apache.org/ws-fx/wss4j/[/url]

You can find the client deployment file, client-config.wsdd in the WEB-INF
directory.

The web service object returned from CreateObject() is the Axis "Stub"
object, so you can call _setProperty() on it.

--
Tom Jordahl
Macromedia Server Development

[aaron_wvr]

Thanks Tom!

Can you post some sample code?

And can you explain how to this plugin works (at least briefly) with CFMX 7 (JRUN installation)?

tia,

Aaron

[Tom Jordahl]

> Can you post some sample code?

Nope. I have never done it. You may well be the first. :-)
Sorry.

> And can you explain how to this plugin works
> (at least briefly) with CFMX 7 (JRUN installation)?

Well, you can follow the Axis 1.2 tutorial on the WSS4J web site. You
configure Axis to use the handler and since CFMX uses Axis, it will use the
security handler. That handler will intercept the SOAP messages in and out
and 'do the right thing'. You set properties before to invoke an operation
and the handler uses them to (for instance) put the username/password token
in to the request.

Let us know how it goes!
--
Tom Jordahl
Macromedia Server Development