Oracle Web Service Manager 11g Field level Encryption (in SOA, WLS) March, 2012

Transcription

1 Oracle Web Service Manager 11g Field level Encryption (in SOA, WLS) March, 2012 Step-by-Step Instruction Guide Author: Prakash Yamuna Senior Development Manager Oracle Corporation

2 Table of Contents Use Case... 3 Description... 3 Objective... 3 Scenario... 4 Software Requirements... 5 Prerequisites... 5 Verified Product Version... 5 Potentially Applies to Product Version(s)... 5 Download Main Page... 5 Product URLs... 5 Step by Step Instructions... 6 Create Purchase Order WLS JAX-WS POJO Web Service... 6 Create Custom Policy for Field level Encryption Attach Custom Policy created previously to the Purchase Order WLS JAX-WS Web Service Create Purchase Order Composite App Attach Custom Policy created previously to the Purchase Order Composite App Reference Create Keystore and Credentials in Credential Store Oracle Corporation Field level Encryption Version 1.0 2

3 Use Case Description In this How-To I will demonstrate how one can do field level encryption. By default all the message protection related policies that ship out of the box with OWSM encrypt the entire body of the SOAP message. However in many cases customer s may want to encrypt only certain fields in the SOAP message that are sensitive rather than the entire body of the SOAP message. Ex: a) Customer wants to encrypt the SSN in the SOAP message. b) Customer wants to encrypt the credit card number in the SOAP message. For the purposes of this How To we will build a SOA Composite app which will act as a web service client and a WLS JAX-WS which will act as the backend web service. Objective Show How to create OWSM custom policies in that will encrypt certain fields in a SOAP message and use these custom policies to secure a web service client and web service. Oracle Corporation Field level Encryption Version 1.0 3

4 Scenario Field level Encryption in WLS, SOA using Oracle Web Services Manager 11g Policy Attachment Override Config Find Matching Policy JDeveloper Purchase Order SOA Composite App OWSM Agent SOAP HTTP Purchase Order WLS JAX-WS Service OWSM Agent sample/field_level_encryption_service_policy sample/field_level_encryption_client_policy Policy Manager Policy Authoring Versioning Usage Tracking Violation Metrics Migration Enterprise Manager CRUD OWSM Policy Store This How-To will demonstrate: 1. We will use a simple PurcahseOrder WLS POJO JAX-WS. 2. A PurchaseOrder SOA Composite calling the PurchaseOrder WLS JAX-WS Web Service. 3. Create Field level encryption client and service policy Oracle Corporation Field level Encryption Version 1.0 4

5 4. Secure the PurchaseOrder WLS POJO JAX-WS with OWSM field level encryption service policy 5. Secure the PurchaseOrder SOA Composite Reference with the OWSM field level encryption client policy 6. Set up the Keystore and Credential Store required for encryption. Software Requirements Prerequisites # Product Download URL 1 Install SOA Suite with JDeveloper Verified Product Version # Product Release Version 1 WebLogic SOA JDeveloper Potentially Applies to Product Version(s) # Product Release Version 1 WebLogic , , , SOA , , Download Main Page Product URLs Product URL Login/Password EM Fusion Middle Control User: weblogic Password: welcome1 Oracle Corporation Field level Encryption Version 1.0 5

6 Step by Step Instructions Create Purchase Order WLS JAX-WS POJO Web Service POJO based WLS JAX-WS PurchaseOrder Web Service. Oracle Corporation Field level Encryption Version 1.0 6

7 package sample.purchaseorder; import java.util.date; import public class PurchaseOrder { public PurchaseOrder() { super(); } public int createpurchaseorder(string creditcardnumber, int orderquantity, int orderprice, String itemtype) { int discount = 5; if (itemtype.startswith("book")) { discount = 10; } int purchaseamount = orderprice * orderquantity; if (purchaseamount < 0) { purchaseamount = 0; } if (!creditcardnumber.startswith("1111")) { throw new RuntimeException("Illegal Credit Card Number"); } return purchaseamount; } } The PurchaseOrder sample takes 4 parameters: 1. creditcardnumber this is a sensitive field which we want to encrypt. Oracle Corporation Field level Encryption Version 1.0 7

8 2. orderquantity 3. orderprice 4. itemtype Field level Encryption in WLS, SOA using Oracle Web Services Manager 11g itemtype is used to calculate discount. The createpurchaseoder method basically returns the total amount of the purchased order. Figure 1 shows the Schema for the JAX-WS Web Service. Figure 1. Schema for PurchaseOrder Sample Oracle Corporation Field level Encryption Version 1.0 8

9 Here is a sample message for testing with this Web Service: Field level Encryption in WLS, SOA using Oracle Web Services Manager 11g <soap:envelope xmlns:soap=" <soap:body xmlns:ns1=" <ns1:createpurchaseorder> <arg0> </arg0> <arg1>100</arg1> <arg2>90</arg2> <arg3>book</arg3> </ns1:createpurchaseorder> </soap:body> </soap:envelope> Figure 2. Sample Request Message for PurchaseOrder POJO WLS JAX-WS Web Service You can test the Web Service via the FMWCTL Test page as shown in Figure 3. Oracle Corporation Field level Encryption Version 1.0 9

10 Figure 3. Testing the POJO PurchaseOrder WLS JAX-WS Oracle Corporation Field level Encryption Version

11 Create Custom Policy for Field level Encryption Field level Encryption in WLS, SOA using Oracle Web Services Manager 11g The next step is creating a Policy in OWSM to handle field level encryption/decryption. For this sample we will start with the wss11_message_protection_[client service]_policy. First we will create a field level decryption policy from the wss11_message_protection_service_policy. 1. Search for wss11_message_protection_service_policy and Click on Create Like in FMWCTL as shown in Figure 4. Oracle Corporation Field level Encryption Version

12 Figure 4. Creating a Field level Decryption Policy from wss11_message_protection_service_policy 2. Give the new policy a name we will call it sample/field_level_decryption_service_policy as shown in Figure 5. Oracle Corporation Field level Encryption Version

13 Figure 5. New sample/field_level_decryption_service_policy Oracle Corporation Field level Encryption Version

14 3. Turn off Body Signing and Body Encryption for Request as show in Figure 6. Field level Encryption in WLS, SOA using Oracle Web Services Manager 11g Figure 6. Turn off Body Signing/Encryption for Request Oracle Corporation Field level Encryption Version

15 4. Turn off Body Signing and Body Encryption for Response as show in Figure 7. Field level Encryption in WLS, SOA using Oracle Web Services Manager 11g Figure 7 Turn off Body Signing/Encryption for Response Oracle Corporation Field level Encryption Version

16 5. Specify the Xpath expression in Request tab for the field to be decrypted in the payload as shown in Figure 8. This is done by clicking on the Add Button. This will launch a pop-up as shown Figure 8. Enter the namespace for the element and the element name that needs to be decrypted. In this case we want to decrypt the credit card number. This is arg0 in the sample message posted earlier in this document. See Figure 2. Figure 8. Adding specific fields to be decrypted Oracle Corporation Field level Encryption Version

17 6. Figure 9 Shows the end result of adding the XML Element to be decrypted. Field level Encryption in WLS, SOA using Oracle Web Services Manager 11g Figure 9. Policy after adding Xpath Expression for field level encryption Oracle Corporation Field level Encryption Version

18 Next we will create create a field level encryption policy from the wss11_messsage_protection_client_policy. 7. Search for wss11_message_protection_client_policy and Click on Create Like in FMWCTL as shown in Figure 10. Figure 10. Creating a Field level Encryption Policy from wss11_message_protection_client_policy Oracle Corporation Field level Encryption Version

19 8. Give the new policy a name we will call it sample/field_level_encryption_client_policy as shown in Figure 11. Figure 11 Provide a name for the new policy "sample/field_level_encryption_client_policy" Oracle Corporation Field level Encryption Version

20 9. Turn off Body Signing and Body Encryption for Request as show in Figure 12 Field level Encryption in WLS, SOA using Oracle Web Services Manager 11g Figure 12. Turn off Body Signing and Body Encryption for Request Oracle Corporation Field level Encryption Version

21 10. Specify the Xpath expression in Request tab for the field to be decrypted in the payload as shown in Figure 13. This is done by clicking on the Add Button. This will launch a pop-up as shownfigure 13. Enter the namespace for the element and the element name that needs to be decrypted. In this case we want to decrypt the credit card number. This is arg0 in the sample message posted earlier in this document. See Figure 2. Figure 13. Add specific elements to encrypt. Oracle Corporation Field level Encryption Version

22 Attach Custom Policy created previously to the Purchase Order WLS JAX-WS Web Service 11. Attach the new created sample/field_level_decryption_service_policy to the PurchaseOder WLS JAX-WS Web Service. This is shown in Figure 14 - Figure 19. Figure 14. Click on FieldLevelEncryption-Project1-context-root Application Oracle Corporation Field level Encryption Version

23 Figure 15 Navigate to the Web Services in the Application via the Application Deployment Menu Oracle Corporation Field level Encryption Version

24 Figure 16 Click on PurchaseOrderPort to navigate to the Web Service Port Oracle Corporation Field level Encryption Version

25 Figure 17. Click on OWSM Policies tab. Click on Attach/Detach Button to launch the OWSM Policy Attachment Wizard Oracle Corporation Field level Encryption Version

26 Figure 18. Attach "sample/field_level_decryption_service_policy" to PurchaseOrder POJO WLS JAX-WS Web Service Oracle Corporation Field level Encryption Version

27 Figure 19. The PurchaseOrderPort after completion of the OWSM Policy Attachment Check the WSDL of the Service: Oracle Corporation Field level Encryption Version

28 <wsp:policy xmlns:wsp=" xmlns:wsu=" 1.0.xsd" wsu:id="purchaseorderport_input_policy"> <sp:signedparts xmlns:sp=" <sp:header Name="fmw-context" Namespace=" <sp:header Name="" Namespace=" <sp:header Name="" Namespace=" </sp:signedparts> <sp:signedelements xmlns:sp=" <sp:encryptedparts xmlns:sp=" <sp:header Name="fmw-context" Namespace=" </sp:encryptedparts> <sp:encryptedelements xmlns:sp=" <sp:xpath>descendant-or-self::*[namespace-uri()=' and local-name()='arg0']</sp:xpath> </sp:encryptedelements> </wsp:policy> Figure 20. WSDL of the PurchaseOrder POJO WLS JAX-WS after attaching the "sample/field_level_decryption_service_policy" The part highlighted in bold indicates that the service expects arg0 to be encrypted. Now the Purchase Order POJO WLS JAX-WS is secured with sample/field_level_decryption_service_policy Create Purchase Order Composite App Now we will create the PurchaseOrderComposite App. Figure 21 - Figure 32 shows the steps for creating the PurchaseOderComposite app. Oracle Corporation Field level Encryption Version

29 Figure 21. Insert a BPEL Process into an Empty Composite App. Oracle Corporation Field level Encryption Version

30 Figure 22. Create the BPEL Process by choosing the "Base on a WSDL" option. Provide the WSDL of the PurchaseOrder POJO WLS JAX-WS Oracle Corporation Field level Encryption Version

31 Figure 23. Result of creating a BPEL Process using the "Base on a WSDL" option Oracle Corporation Field level Encryption Version

32 Figure 24 In the BPEL Process create a PartnerLink. Again Provide the WSDL of the PurchaseOrder POJO WLS JAX-WS as the WSDL URL Oracle Corporation Field level Encryption Version

33 Figure 25. Walkthrough the PartnerLink creation process Oracle Corporation Field level Encryption Version

34 Figure 26. Completion of the Partner Link creation process Oracle Corporation Field level Encryption Version

35 Figure 27. Add an "Invoke" activity in the BPEL Process and wite it to the PurchaseOrderRefrence PartnerLink created previously Oracle Corporation Field level Encryption Version

36 Figure 28 The Invoke is now wired to the PartnerLink "PurchaseOrderReference" Oracle Corporation Field level Encryption Version

37 Figure 29 Add an Assign activity after the receiveinput and before the Invoke activity. Wire the variables to copy the input on the receive to the input of the Invoke Oracle Corporation Field level Encryption Version

38 Figure 30. Add another assign activity after the "Invoke" to copy the output of the invoke to the output of the replyoutput Oracle Corporation Field level Encryption Version

39 Figure 31. BPEL Process after adding the Assign, Invoke, Assign activities Oracle Corporation Field level Encryption Version

40 Figure 32. Completed PurchaseOrderComposite App Oracle Corporation Field level Encryption Version

41 Attach Custom Policy created previously to the Purchase Order Composite App Reference The next step is to now attach the sample/field_level_encryption_client_policy to the PurchaseOrderReference of PurchaseOrderComposite App. These steps are shown in Figure 33 - Figure 38. Figure 33. Click on the PurchaseOrderComposite App on the left hand side. Oracle Corporation Field level Encryption Version

42 Figure 34. Click on the PurchaseOrderReference shown in the Dashboard of the PurchaseOrderComposite Oracle Corporation Field level Encryption Version

43 Figure 35. On the PurchaseOrderReferece - click on the "Policies" tab Oracle Corporation Field level Encryption Version

44 Figure 36. Click on the "Attach/Detach" Button Oracle Corporation Field level Encryption Version

45 Figure 37. Attach the "sample/field_level_encryption_client_policy" Oracle Corporation Field level Encryption Version

46 Figure 38. The Policy is now attached to the PurchaseOrderReference Oracle Corporation Field level Encryption Version

47 Create Keystore and Credentials in Credential Store Field level Encryption in WLS, SOA using Oracle Web Services Manager 11g Create a Keystore called default-keystore.jks using keytool: $>keytool -genkeypair -keyalg RSA -alias orakey -keypass welcome1 -keystore default-keystore.jks -storepass welcome1 -validity 3600 For complete details on keytool commands please refer to Copy the keystore created into: $FMW_DOMAIN_HOME/config/fmwconfig/ Add the following credentials into the credential store either via EM or using WLST. wls:/defaultdomain/serverconfig> createcred(map="oracle.wsm.security", key="keystore-csf-key", user="owsm", password="welcome1", desc="keystore key") wls:/defaultdomain/serverconfig> createcred(map="oracle.wsm.security", key="enc-csf-key", user="orakey", password="welcome1", desc="encryption key") wls:/defaultdomain/serverconfig> createcred(map="oracle.wsm.security", key="sign-csf-key", user="orakey", password="welcome1", desc="signing key") This assumes that the keystore password is welcome1. Oracle Corporation Field level Encryption Version

48 This will, add a key namely enc-csf-key to map oracle.wsm.security with username as orakey and password as welcome1. This alias should exist in your configured keystore. This will, add a key namely sign-csf-key to map oracle.wsm.security with username as orakey and password as welcome1. This alias should exist in your configured keystore. You can verify the contents of the credential store in FMWCTL as show in Figure 39 and Figure 40. Oracle Corporation Field level Encryption Version

49 Figure 39. View the Credential Store from the Weblogic Domain menu Oracle Corporation Field level Encryption Version

50 Figure 40 Contents of the "oracle.wsm.security" Credential Map Oracle Corporation Field level Encryption Version

51 Oracle Web Services Manager March 2012 Author: Prakash Yamuna Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores, CA U.S.A. Worldwide Inquiries: Phone: Fax: oracle.com Copyright 2011, Oracle and/or its affiliates. All rights reserved. This document is provided for information purposes only and the contents hereof are subject to change without notice. This document is not warranted to be error-free, nor subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or fitness for a particular purpose. We specifically disclaim any liability with respect to this document and no contractual obligations are formed either directly or indirectly by this document. This document may not be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without our prior written permission. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners Oracle Corporation Field level Encryption Version