Token based authorization for web services provides the ability to securely pass information about an end user between the Identity Provider (Authority) and the Service Provider. The Identity Provider manages identity information that Service Provider use to authorize their services. In most infrastructures the Token based authentication using an Identity Provider is used to implement a single sign on
- Download and unpack:
- Tomcat9: https://tomcat.apache.org/download-90.cgi
- Axis2 (binary distribution): http://www.apache.org/dyn/closer.lua/axis/axis2/java/core/1.7.4/axis2-1.7.4-bin.zip
- Axis2 (WAR distribution): http://www.apache.org/dyn/closer.lua/axis/axis2/java/core/1.7.4/axis2-1.7.4-war.zip
The download page provides md5, sha1 and pgp checksums and signatures to verify the downloaded files.
- Set enviroment variables for Axis2
$ export AXIS2_HOME=/path/to/extracted-binary-distribution
- and/or add the export command to .bashrc or similar
The binary distribution of Axis2 is used for development environment and compiling the service.
Setting up Axis2 in Tomcat 9
Running Apache Axis2 in Tomcat 9 is straight forward and simply requires deploying the Apache Axis2 WAR-File distribution in Tomcats ‘webapps’ folder.
To test the deployment, point the browser to http://localhost:8080/axis2. Navigating to ‘Services’ shows a single service that returns the Axis2 version.
Start with building a service
This article does not cover all steps to create a new webservice nor creating a client. Apache Axis2 has a nice quickstart guide that describes the most important steps necessary to build a new service. A client that should use our secured webservice has to send a SOAP request containing a SAML2 token in its header.
Here I assume you created the StockQuoteService example service as described in
“Deploying POJOs” section of the the quickstart guide. The source code comes
with the binary distribution in
$AXIS2_HOME/samples/quickstart. If so, there
should be the following directory tree:
Source directoy tree
quickstart |- README.txt |- build.xml |- resources | |- META-INF | |- services.xml |- src |- samples |- quickstart |- service |- pojo |- StockQuoteService.java
After building the service
quickstart/build/classes |- META-INF | |- services.xml |- samples |- quickstart |- service |- pojo |- StockQuoteService.class
The next part shows how to extract the SOAP header and describes the basic structure of the token.