Web Services Security with Apache Rampart – Part 2 (Message-Level Security)

Sometime back I blogged about Nandana's article on using transport level security with Apache Rampart policy based configuration. Here's the part two of the article which talks about using WS-SecurityPolicy to apply and enforce message level on SOAP messages using Apache Axis2 and Apache Rampart.

Web Services Security with Apache Rampart – Part 1 ( Transport Level Security )

A tutorial on setting up UsernameToken authentication using Apache Rampart by Nandana.

WSO2 Identity Solution 1.0 is now available

We released the WSO2 Identity Solution last week with an Identity Provider and a set of relying party components.

The identity provider component supports issuance of information cards and tokens defined by Microsoft CardSpace specifications. Some of the main features are :

• Simple management console


• Ability to connect to custom user stores (LDAP/Microsoft ActiveDirectory, JDBC)


• Built in user store


• Support for the CardSpace default claim set


• Support for custom claim dialects and claims types


• Statistics/reporting/audit trail


• Ability to revoke information cards


• Issues information cards based on username-token credential and self issued credential

The relying party components includes an Apache2 HTTPD module (mod_cspace) and a Java servlet filter component. mod_cspace has useful features such as ability to enforce CardSpace authentication on static web content. Extensions for Drupal, MediaWiki are also available that can be easily configured with mod_cspace.

Documentation on setting up and using the identity provider and other relying party components are available at http://wso2.org/project/solutions/identity/1.0/docs/index.html

Apache Rampart 1.3 Released

This is the 1.3 release of Apache Rampart.

Apache Rampart 1.3 is a toolkit that provides implementations of the WS-Sec* specifications for Apache Axis2 1.3, based on Apache WSS4J 1.5.3 and the Apache AXIOM-DOOM 1.2.5 implementations.

You can download the releases from:
http://www.apache.org/dyn/closer.cgi/ws/rampart/1_3

There are two main Apache Axis2 modules provided with this release.

* rampart-1.3.mar
This provides support for WS-Security and WS-SecureConversation
features.
* rahas-1.3.mar
This module provides the necessary components to enable SecurityTokenService functionality on a service.

Apache Rampart 1.3 uses a configuration model based on WS-Policy and WS-Security Policy. It is important to note that the Apache Rampart 1.0 style configuration is also available even though being marked as deprecated.

Apache Rampart 1.3 can be successfully used with the next Apache Sandesha2 release targeted towards Apache Axis2 1.3 to configure WS-SecureConversation + WS-ReliableMessaging scenarios.

The rampart module was successfully tested for interoperability with other WS-Security implementations.

WS - Sec* specifications supported by Apache Rampart are as follows:

* WS - Security 1.0
* WS - Secure Conversation - February 2005
* WS - Security Policy - 1.1 - July 2005
* WS - Trust - February 2005
* WS - Trust - WS-SX spec - EXPERIMENTAL

Thank you for using Apache Rampart.

Apache Rampart team

Apache WSS4J 1.5.3 Released

Apache WSS4J Team is happy to announce the WSS4J-1.5.3 release.

Apache WSS4J is an implementation of the OASIS Web Services Security (WS-Security) from OASIS Web Services Security TC. WSS4J is a Java library that can be used to sign and verify SOAP Messages with WS-Security information.

You can download the releases from:
http://www.apache.org/dyn/closer.cgi/ws/wss4j/1_5_3

Apart from the binary and source distributions, we have an additional ZIP file that contains other required JAR files to install and run WSS4J.

Please refer to the *readme.* files in the distribution for further information regarding implemented features, additional information, links to the Wiki pages, etc.

Enjoy !

The WSS4J team