Crypting the webservice responses in AXIS

[ffellico]

Hi.

I have a webservice in tomcat/axis with a method that send back a
byte[] response.

I have seen that to send back the array of bytes, AXIS trasform it in
a BASE64 String (i think only to trasport it); the client retreive the
original array without problems because on the client side the BASE64
String is automatically reconverted in the original array of bytes.

Before the BASE64 String is sended back, I am interested to encrypt it
(with a my routine) and naturally at the client side I need to decrypt
it, so the application can receive the correct file.

Can anyone suggest me a way to insert in suitable places the crypt/
decript code?

Alternatively, it is possible in some way to ask AXIS to crypt/decrypt
the responses automatically?

Thank you from Franco in Italy.

 

[Lew]

Alternatively, it is possible in some way to ask AXIS to crypt/decrypt
the responses automatically?

<http://ws.apache.org/wss4j/>
<http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0.pdf>
<http://java.sun.com/webservices/xwss/>
<http://xml.apache.org/security/>

GIYF.
"XML Security"
"Web Services Security"
"SAML"

 

[=?ISO-8859-1?Q?Arne_Vajh=F8j?=]

I have a webservice in tomcat/axis with a method that send back a
byte[] response.

I have seen that to send back the array of bytes, AXIS trasform it in
a BASE64 String (i think only to trasport it); the client retreive the
original array without problems because on the client side the BASE64
String is automatically reconverted in the original array of bytes.

Before the BASE64 String is sended back, I am interested to encrypt it
(with a my routine) and naturally at the client side I need to decrypt
it, so the application can receive the correct file.

Can anyone suggest me a way to insert in suitable places the crypt/
decript code?

Alternatively, it is possible in some way to ask AXIS to crypt/decrypt
the responses automatically?

Have the web service transform it:
unencrypted byte[] -> encrypted byte[]

And the client:
encrypted byte[] -> unencrypted byte[]

If you use a standard algorithm like 3DES or AES, then
it is even portable.

You can also look at using WSS (WS-Security), but at least in Axis 1
that was a pretty complex task.

Say if you want to go that route - I do have some working code on
the shelf.

I have not used WSS with Axis2 yet, so I can not say how difficult
that is.

Arne