java - How to enforce Basic Authentication when fetching WSDL (Server side) -
i'm looking way force client side use http basic authentication when attempts retrieve wsdl
file. using jax-ws
created following web service, use glassfish 3:
@webservice(servicename = "hello") @stateless public class helloservice { @webmethod(operationname = "sayhello") @rolesallowed("myrole") public string sayhello(@webparam(name = "name") @xmlelement(required=true) string name){ return "hello "+name; } }
after googling around, seems adding security constraint web.xml
descriptor should take care of this, did
<session-config> <session-timeout> 30 </session-timeout> </session-config> <security-constraint> <display-name>hellosc</display-name> <web-resource-collection> <web-resource-name>hellorc</web-resource-name> <url-pattern>/*</url-pattern> <http-method>get</http-method> <http-method>post</http-method> <http-method>head</http-method> </web-resource-collection> <auth-constraint> <role-name>myrole</role-name> </auth-constraint> <user-data-constraint> <transport-guarantee>none</transport-guarantee> </user-data-constraint> </security-constraint> <login-config> <auth-method>basic</auth-method> <realm-name>file</realm-name> </login-config>
now, when deploy , point browser http://myserver
/hello, browser asks credentials. sayhello
method can consumed right credentials.
question: far if point browser wsdl (http://myserver
/hello/helloservice?wsdl) i'm not asked credentials, loads, , it's requirement should password protected
it's understanding url-pattern should apply wsdl well. request after all...
any pointers?
edit: deployed .war jboss instance , works intended. seems there config missing glassfish.
you configurations correct. suppose if open http://example.org/hello/helloservice?wsdl
in new browser (or close windows of current browser in open again) required perform basic authentication. issue here after first successful authentication browser sends basic authentication header in each request , request authenticated server.
added after comment please try add additional http-method
<http-method>delete</http-method> <http-method>put</http-method> <http-method>head</http-method> <http-method>options</http-method> <http-method>trace</http-method> <http-method>get</http-method> <http-method>post</http-method>
Comments
Post a Comment