Review Oracle WSM: Securing Your Web Services

Pascal Alma — Sat, 24 Jan 2009 13:51:25 +0000

As you might have noticed by my last posts I am currently investigating the posiblities of Oracle’s Web Service Manager. I do this investigation by reading the Packtpub book ‘Oracle Web Services Manager – Securing Your Web Services‘, written by Sitaraman Lakshminarayanan. As the back-cover says this book mainly targets developers and architects with expertise in developing and deploying web services. And I want to add that it is most interesting if you are going to use or are currently using Oracle WSM, of course.
One thing I do not really understand is that the author describes how to use .Net clients to test the setup (besides the test facility in OWSM itself). Hasn’t Oracle been busy for almost 10 years now to become a important player in the J2EE market. So why not some examples how to test the setup with Java clients? But well, I have described how to test the examples with SoapUI, so I will consider this issue as solved ;-)
Besides this .Net thing there are some other (small) issues in the example descriptions:

In chapter 4 you will start with using Oracle WSM by registering your first service in it. But you can only do that after you have registered the gateway first (I would suggest to start with the Oracle WSM Starters guide of Oracle first).
The description of testing the setup in chapter 6 is not correct. The test as described sends an unsigned request and checks if the response is signed. But in the configuration of the web service in this chapter the incoming request must be signed, so the test will always fail. The quick workaround is of course to disable the checking of incoming request. But a nicer solution would be to send in a signed request. To do this I used SoapUI as described here.

One thing I miss in the book is (high level) information about keystores and how to create these, but this might be caused by the fact that I am not using .Net so I don’t have the default keystore they use in the book. But with this addition you make the examples better accessible for others like me who don’t have .Net available.
Overall it is a nice books with lots of screenshots showing you how to deal with Oracle WSM and it gives you a good insight in how you can secure your web services.

Using Commons Logging with OC4J

Pascal Alma — Mon, 14 Jul 2008 19:23:04 +0000

For my current project I am migrating several projects from JDeveloper 10.1.3.1 to JDeveloper 10.1.3.3. After migrating my WebService project I deployed the application to my local Standalone OC4J instance and ran my test suite in SoapUI to test the migrated services. But to my surpise, all requests failed! They all gave the same response:

PLAIN TEXT

XML:

>
>
>500 Internal Server Error>
>
>
>500 Internal Server Error>
>Servlet error: An exception occurred. The current application deployment descriptors do not allow for including it in this response. Please consult the application log for details.>
>
>

Although the web services were generated with JDeveloper's Web Service 'wizard' (one way to create a web service which I definitely don't like), it just could be that I had to recreate them with the newer JDev version.

But before I took that approach, I had a look in the 'application.log' file to see if there was some more info there. And yep, there was:

08/06/27 12:40:02.547 MyWS: Servlet error
java.lang.ExceptionInInitializerError
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
....
....
Caused by: org.apache.commons.logging.LogConfigurationException: org.apache.commons.logging.LogConfigurationException: No suitable Log constructor [Ljava.lang.Class;@dc5c99 for org.apache.commons.logging.impl.Log4JLogger (Caused by java.lang.NoClassDefFoundError: org/apache/log4j/Category) (Caused by org.apache.commons.logging.LogConfigurationException: No suitable Log constructor [Ljava.lang.Class;@dc5c99 for org.apache.commons.logging.impl.Log4JLogger (Caused by java.lang.NoClassDefFoundError: org/apache/log4j/Category))
at org.apache.commons.logging.impl.LogFactoryImpl.newInstance(LogFactoryImpl.java:543)
at org.apache.commons.logging.impl.LogFactoryImpl.getInstance(LogFactoryImpl.java:235)
at org.apache.commons.logging.impl.LogFactoryImpl.getInstance(LogFactoryImpl.java:209)
at org.apache.commons.logging.LogFactory.getLog(LogFactory.java:351)
at net.pascalmalma.ws.base.BaseService.(BaseService.java:26)
... 34 more
Caused by: org.apache.commons.logging.LogConfigurationException: No suitable Log constructor [Ljava.lang.Class;@dc5c99 for org.apache.commons.logging.impl.Log4JLogger (Caused by java.lang.NoClassDefFoundError: org/apache/log4j/Category)
at org.apache.commons.logging.impl.LogFactoryImpl.getLogConstructor(LogFactoryImpl.java:413)
at org.apache.commons.logging.impl.LogFactoryImpl.newInstance(LogFactoryImpl.java:529)
... 38 more
Caused by: java.lang.NoClassDefFoundError: org/apache/log4j/Category
at java.lang.Class.getDeclaredConstructors0(Native Method)
at java.lang.Class.privateGetDeclaredConstructors(Class.java:2328)
at java.lang.Class.getConstructor0(Class.java:2640)
at java.lang.Class.getConstructor(Class.java:1629)
at org.apache.commons.logging.impl.LogFactoryImpl.getLogConstructor(LogFactoryImpl.java:410)
... 39 more

It seemed I (suddenly??) had some conflicting issues with commons-logging. So now I only needed to solve this issue... One hour later and having shifted the libraries throughout almost every directory in OC4J, I just gave up to look for a 'nice' shared configuration (as is described here).
I went for the quick (and dirty??) solution which means disabling the use of the shared libraries for log4j and supply the necessary libraries (commons-logging and log4j) with each web application deployment. You can set the option in the OC4J Enterprise Manager, like this:

and

Only disadvantage is that if you deploy your application directly from JDeveloper this property is overwritten and the issue is back again.... Luckily I found this entry of the JHeadstart team. It appears they had the same problem, but this makes my life somewhat easier :-)

Redstream Blog » Oracle iAS

Review Oracle WSM: Securing Your Web Services

Using Commons Logging with OC4J