Creating Custom Assertions

but whenever I’m trying to import the polcy file(step 6) in enterprise manager, I’m getting error.

Finally I found where the issue is. In their document (step 4) they simply mentioned to create jar file, but the structure of the jar should like below

sampleassertion/IpAssertionExecutor.class
META-INF/MANIFEST.MF
META-INF/policies/
META-INF/policies/oracle/
META-INF/policies/oracle/ip_assertion_policy
META-INF/policy-config.xml

         1) Username (with opt. pwd digest)
         2) X.509 cert
         3) Kerberos ticket
         4) SAML assertion
         5) REL (Rights Expression Language) document

WS-Trust

        > Issuing, renewing, and validating security tokens
                   >STS (Security Token Service)
                   >Tokens are used by WS-Security
        > Brokering trust relationships within different trust domains

WS-SecureConversation

         > The (SCT) element supports the requirements of security contexts

         > Derived keys are used for signing and encrypting messages associated with the security context
         > WS-SecureConversation defines how derived keys are computed and passed

WS-Policy

WS-PolicyAttachment

<definitions>
...
<binding name="StockQuoteWebServiceSoapBinding" ...>
 <wsp:PolicyReference xmlns:… URI="#SecureMessagePolicy"/>
</binding>

<wsp:Policy wsu:Id="SecureMessagePolicy"... >
  <sp:SignedParts>
     <sp:Body/>
  </sp:SignedParts>
  <sp:EncryptedParts>
    <sp:Body/>
  </sp:EncryptedParts>
</wsp:Policy>
...
</definitions>

WS-MetadataExchange

      > A requester sends a GetMetadata request message to an endpoint
      > The endpoint replies with a GetMetadata response message including a reference to the metadata section requested

Apache camel home page:http://camel.apache.org/

EIS Notations

Apache Camel can be used as a routing and mediation engine for the following projects:

Apache ServiceMix which is the most popular and powerful distributed open source ESB and JBI container
Apache ActiveMQ which is the most popular and powerful open source message broker
Apache CXF which is a smart web services suite (JAX-WS)
Apache MINA a networking framework

Introduction

Now I’m clear what is what.

OpenID:
It is only for Identification / Authentication. Here we need to prove oneself to the OpenID providers like who am I.

OAuth:
It is only Authorization; we are authorizing a third party service to access our personal information without providing our password.

Some interesting links:
Link1

Link2

Getting Started with JPA

RPX Basic enables websites to accelerate user registration and login success by allowing visitors to easily sign in with one of their existing third party accounts from AOL, Facebook, Google, MySpace, or Yahoo!.

Home:

http://rpxnow.com/

Steps:

* First we need to be a member of rpxbasic, for that we need to login using any one of our OpenIDs.

* Once we’ve logged in we can create a new application, it acts like a web application.

* Once we’ve created a application go it’s dashboard.

* Click “Quick Start Guide”, there you can get the details related to how to embed the scripts to enable login/signin operation in our web application.

The scripts are like:

Add the following javascript code to the bottom of each page where you’d like users to sign in:

<script src="https://rpxnow.com/openid/v2/widget" type="text/javascript"></script>
<script type="text/javascript">
  RPXNOW.overlay = true;
  RPXNOW.language_preference = 'en';
</script>

Copy the following signin/signup link to your pages:

<a class="rpxnow" onclick="return false;"
   href="https://kathiropenidtest.rpxnow.com/openid/v2/signin?token_url=http://localhost:8080/OpenIDTest/Response.html">
  Sign In
</a>

* Embed the above scripts in our index page; this will create a sign In link in the index page. This link will open a small window which asks the user to select a OpenID provider from a list.

* After successful login the total no of user are listed in rpxnow’s application dashboard.

OpenID is an open, decentralized standard for authenticating users which can be used for access control, allowing users to log on to different services with the same digital identity where these services trust the authentication body. 

Site:
http://openid.net/ 

Getting Started:
http://openid.net/add-openid/add-getting-started/  

Java Library:
I’ve tried out the “JOpenID” library.  

JOpenID Project Home:
http://code.google.com/p/jopenid/  

Requirements:
JDK 1.6 , Tomcat6  

Sample Servlet code:
I’ve changed the sample servlet which present in the JOpenID site

package openidtest;

import java.io.IOException;
import java.io.PrintWriter;
import java.text.ParseException;
import java.text.SimpleDateFormat;
import javax.servlet.ServletConfig;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.expressme.openid.Association;
import org.expressme.openid.Authentication;
import org.expressme.openid.Endpoint;
import org.expressme.openid.OpenIdException;
import org.expressme.openid.OpenIdManager;
 

public class MainServlet extends HttpServlet {
 

    static final long ONE_HOUR = 3600000L;
    static final long TWO_HOUR = ONE_HOUR * 2L;
    static final String ATTR_MAC = "openid_mac";
    static final String ATTR_ALIAS = "openid_alias";
 

    OpenIdManager manager;
 

    @Override
    public void init(ServletConfig config) throws ServletException {
        super.init(config);
 

        //IF proxy
        java.util.Properties props = System.getProperties();
        props.put("proxySet", "true");
        props.put("proxyHost", "PROXY_IPADDRESS");
        props.put("proxyPort", "PROXY_PORT");
 

        manager = new OpenIdManager();
    }
 

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {   
     String op = request.getParameter("op");   
     if (op==null) {       
      // check nonce:
      System.out.println(">>>>>>>> openid.response_nonce==>"+request.getParameter("openid.response_nonce"));
      checkNonce(request.getParameter("openid.response_nonce"));       
      // get authentication:       
      HttpSession session = request.getSession();       
      byte[] mac_key = (byte[]) session.getAttribute(ATTR_MAC);       
      String alias = (String) session.getAttribute(ATTR_ALIAS);       
      Authentication authentication = manager.getAuthentication(request, mac_key, alias);       
      String identity = authentication.getIdentity();       
      String email = authentication.getEmail();       
      // TODO: create user if not exist in database:       
       showAuthentication(response.getWriter(), authentication);   
     }   
     else if ("Google".equals(op) || "Yahoo".equals(op)) {
      manager.setReturnTo("http://"+request.getServerName()+":"+request.getServerPort()+"/OpenIDTest/openidtester");
      
      // redirect to Google/Yahoo sign on page:       
      String alias = manager.lookupExtNsAlias(op);      
      Endpoint endpoint = manager.lookupEndpoint(op);
      System.out.println(">>>>>>>> endpoint.getUrl()==>"+endpoint.getUrl());
      Association association = manager.lookupAssociation(endpoint);       
      HttpSession session = request.getSession();       
      session.setAttribute(ATTR_MAC, association.getRawMacKey());       
      session.setAttribute(ATTR_ALIAS, alias);       
      String url = manager.getAuthenticationUrl(endpoint, association);       
      response.sendRedirect(url);   
     }   
     else {       
      throw new ServletException("Bad parameter op=" + op);   
     }
    }
 

    void showAuthentication(PrintWriter pw, Authentication user) {   
     pw.print("<html><body>");   
     pw.print(" <h2>Hi "+user.getFullname()+"!</h2><p>Congratulations, you have successfully logged-in!</p>");   
     pw.print("<p><b>Indentity:</b> "+user.getIdentity()+"<br>");   
     pw.print("<b>Email:</b> "+user.getEmail()+"<br>");   
     pw.print("<b>Gender:</b> "+user.getGender()+"<br>");   
     pw.print("<b>Firstname:</b> "+user.getFirstname()+"<br>");   
     pw.print("<b>Lastname:</b> "+user.getLastname()+"<br>");   
     pw.print("<b>Language:</b> "+user.getLanguage()+"</p>");   
     pw.print("</body></html>");   
     pw.flush();
    }
 

    void checkNonce(String nonce) {
        // check response_nonce to prevent replay-attack:
        if (nonce==null || nonce.length()<20)
            throw new OpenIdException("Verify failed.");
        long nonceTime = getNonceTime(nonce);
        long diff = System.currentTimeMillis() - nonceTime;
        if (diff < 0)
            diff = (-diff);
        if (diff > ONE_HOUR)
            throw new OpenIdException("Bad nonce time.");
        if (isNonceExist(nonce))
            throw new OpenIdException("Verify nonce failed.");
        storeNonce(nonce, nonceTime + TWO_HOUR);
    }
 

    boolean isNonceExist(String nonce) {
        // TODO: check if nonce is exist in database:
        return false;
    }
 

    void storeNonce(String nonce, long expires) {
        // TODO: store nonce in database:
    }
 

    long getNonceTime(String nonce) {
        try {
            return new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssZ")
                    .parse(nonce.substring(0, 19) + "+0000")
                    .getTime();
        }
        catch(ParseException e) {
            throw new OpenIdException("Bad nonce time.");
        }
    }
}

Web.xml

<?xml version="1.0" encoding="ISO-8859-1"?>

<web-app xmlns="http://java.sun.com/xml/ns/javaee"
       version="2.5"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">

	<servlet>
		<servlet-name>MainServlet</servlet-name>
		<servlet-class>openidtest.MainServlet</servlet-class>
	</servlet>

	<servlet-mapping>
		<servlet-name>MainServlet</servlet-name>
		<url-pattern>/openidtester</url-pattern>
	</servlet-mapping>

</web-app>

How to call:- 

http://<HOSTNAME>:<PORT>/OpenIDTest/openidtester?op=Yahoo

http://<HOSTNAME>:<PORT>/OpenIDTest/openidtester?op=Google 

For Additional OpenID Provider:
 As of now the sample servlet allows Google and yahoo as a OpenID Provider (OP), if we need more extract the “openid-providers.properties” from “jopenid-1.05.jar” file and add additional OP and its url. The file looks like 

 
Google = https://www.google.com/accounts/o8/id
Yahoo = http://open.login.yahooapis.com/openid20/www.yahoo.com/xrds