Cisco Policy Enforcement Point

Table Of Contents

CEPM JAX-WS Agent Guide

Contents

About This Document

Objective

Audience

CEPM JAX-WS Agent

Steps to Configure CEPM JAX-WS Agent For Web Services

Resource Discovery for creating webservices resources using wsdl in CEPM

Steps to Test Calculator Sample with CEPM JAX-WS Agent

Documentation Updates

Related Documentation

Obtaining Documentation and Submitting a Service Request

CEPM JAX-WS Agent Guide

---

Revised: July 13, 2009, Doc Part No: OL-19654-01

Contents

•About This Document

•CEPM JAX-WS Agent

•Steps to Configure CEPM JAX-WS Agent For Web Services

•Steps to Test Calculator Sample with CEPM JAX-WS Agent

•Documentation Updates

•Related Documentation

•Obtaining Documentation and Submitting a Service Request

About This Document

Objective

This document gives the overview about the Cisco Enterprise Policy Manager (CEPM) JAX-WS Agent and explains the steps for installing the JAX-WS Agent.

Audience

This guide is for administrators who use CEPM and are responsible for resource modelling and entitlement management.

CEPM JAX-WS Agent

In Cisco Enterprise Policy Manager (CEPM), the JAX-WS CEPM Authorization Handler is a message interceptor that can be easily plugged into the JAX-WS runtime to process the messages, and authorize access to the Web Service. This handler is invoked with a MessageContext component that provides access to messages and the ability to manage a set of properties. The Handler examines every incoming SOAP request, extracts the required information from the MessageContext and makes a PEP call, and receives the result of the authorization operation.

•In case of a positive reply (decision is true), the client is served with the requested Web Service.

•In case of a negative reply (decision is false), the handler blocks and terminates the SOAP request.

CEPM's JAX-WS2.0 Agent implements the following interface and method:

•Class: javax.xml.ws.handler.soap.SOAPHandler

•Method: public boolean handleMessage (msgContext context)

Where, msgContext refers to the MessageContext to process with this Handler.

The Handler returns an indication of whether handler processing should continue for the current message, such as

•Returns true to continue processing

•Returns false to block processing

Figure 1 shows the typical rundown of accessing a web service with JAX-WS2.0 CEPM's Handler:

Figure 1 CEPM JAX_WS Agent Deployment Diagram

1. The client requests a Web Service to perform an operation.

2. The client request is passed to the JAX-WS Runtime component.

3. The JAX-WS Runtime makes a call to the configured CEPM Authorization Handler by passing the MessageContext.

4. The CEPM Authorization Handler extracts the required information from the MessageContext and makes a call to the PEP.

5. The PEP makes a call to the PDP or Cache and gets the decision (i.e. true/false).

–If the decision is false, the client request is blocked.

–If the decision is true, the client is served with the requested Web Service to perform the operation.

Steps to Configure CEPM JAX-WS Agent For Web Services

To configure JAX-WS Agent:

---

Step 1 Unzip CEPMJAX-WS_Agent.zip file. The contents of the .zip file are automatically unzipped in the JAX_WS_HOME directory..

Step 2 Copy libraries pep.jar, CEPM_Commons.jar, papclient.jar and cepmhandler.jar from JAX_WS_HOME directory to <PROJECTHOME>\WEB-INF\lib directory where <PROJECTHOME> is the root directory of the webservice.

Step 3 Open pep_config.xml file from JAX_WS_HOME\config\pep folder and update the following elements:

a. Replace the <pdp> URL value with the URL on which PDP Server is running.

b. Replace the URL value of <api> with the url on which PAP is running.

c. Replace the <applicationgroup> tag with the name of the application group under which the protected application is created.

For example, <applicationgroup>Prime group</applicationgroup>

d. Replace the <application> tag with the name of the webservice which is protected by the JAX-WS agent.

For example, <application>Calculator</application>

e. <jax-ws-webservice-config>/<subject> source can be a SOAP-header, a Request-header or a WSSE-header. For example, to read a subject value from a SOAP header, set the <jax-ws-webservice-config>/<subject> tag as:

<jax-ws-webservice-config>

<subject source="soap-header">

    <value key="userid"/>

</subject>

.

.

</jax-ws-webservice-config>

f. <jax-ws-webservice-config>/<message-attributes> source type can be SOAP-header, Request-header, or Arguments (args). This tag passes the attributes as environment attributes to CEPM.

The following ahows a sample <message-attributes> tag input for SOAP-header:

// For all attribute values

<source type="soap-header">*</source>

//For specific attribute values e.g. stockquote, stocklimit:

<source type="soap-header">stockquote</source>

<source type="soap-header">stocklimit</source>

Refer to the CEPM PEP Configuration Guide for more information on updating pep_config.xml file.

Step 4 Add the Java environmental variables CEPM_AGENT_CONFIG, log4j.configuration and CEPM_DECISION_CACHE_CONFIG to the Java property, to specify the directory path of pep_config.xml, logging.xml and jbosscache.xml files.

Following is an example of JAVA_PROPERTIES:

JAVA_PROPERTIES = -DCEPM_AGENT_CONFIG=<JAX_WS_HOME>\config\pep\pep_config.xml 
-Dlog4j.configuration=<JAX_WS_HOME>\config\logging\logging.xml 
-DCEPM_DECISION_CACHE_CONFIG=<JAX_WS_HOME>\config\jbosscache\jbosscache.xml

Step 5 Configure CEPMHandler to the webservice. Update sun-jaxws.xml file in the <PROJECTHOME>\WEB-INF folder by specifying the handler class under <endpoint> as shown below:

<handler-chains xmlns="http://java.sun.com/xml/ns/javaee">

    <handler-chain>

       <handler>

          <handler-class>com.cisco.epm.agent.jaxws.CEPMHandler</handler-class>

       </handler>

    </handler-chain>

</handler-chains>

The WebService is configured with CEPM JAX-WS Agent.

---

Resource Discovery for creating webservices resources using wsdl in CEPM

---

Step 1 Login to CEPM. Select Home > Manage Entities > Resources.

Step 2 Under the configured application:

a. click `Create Resources from External Sources'.

b. Select Source Type as wsdl. Select URL/FileName Type as URL.

c. Enter the value for wsdl running in URL.

For example: http://host:port/CalculatorService/CalculatorService?wsdl.

Step 3 Click on Create.

Step 4 Select all the Operation Name entries and click on Create. This creates all the resources under the specified application.

Refer to the CEPM User Guide for more details on managing entitlement policies.

---

Steps to Test Calculator Sample with CEPM JAX-WS Agent

This distribution (CEPMJAX-WS_Agent.zip file) contains a sample calculator service which runs in Tomcat server.

---

Step 1 Copy CalculatorService.war [Calculator Service] from the JAX_WS_HOME directory and deploy it in the Tomcat server (apache-tomcat-5.5.27).

Step 2 Configure the CEPM JAX-WS Agent by following the steps as mentioned in Steps to Configure CEPM JAX-WS Agent For Web Services.

Step 3 Modify the pep_config.xml file:

<cache 

		.

		.

		<applicationgroup>Prime group</applicationgroup>

		<application>Calculator</application>

</cache>

<jax-ws-webservice-config>

    	<subject source="soap-header">

    		<value key="user"/>

    	</subject>

		<message-attributes>    		

    		<source type="args">*</source>

		</message-attributes>

</jax-ws-webservice-config>

Step 4 Start the Tomcat server.

Step 5 Start CEPM and perform the following tasks:

•Create a PDP.

•Create the application group "Prime group" and application "Calculator" as specified in the pep_config.xml and associate the PDP.

Step 6 Run WSDL Resource Discovery in CEPM under the "Calculator" application.

URL: http://host:port/CalculatorService/CalculatorService?wsdl

Step 7 Open the CalculatorClient {Calculator Service Client} under JAX_WS_HOME, and find the testClient.bat file.

Step 8 To perform some calculator operations, run testClient.bat by passing the following command line arguments.

a. Endpoint

For example: http://host:port/CalculatorService/CalculatorService

b. UserName

c. Operator [add, sub, div or mul]

d. Operand1

e. Operand2

For Example:

testClient.bat http://host:port/CalculatorService/CalculatorService Tom add 3 5

Based on the permissions specified within CEPM:

•If the user 'Tom' is authorized to perform this operation, Result will be displayed.

•If the user 'Tom' is not authorized to perform this operation, a message will be displayed saying 'Tom' is not authorized to perform add operation.

---

Documentation Updates

Table 1 Updates to CEPM JAX-WS Agent Guide

Date	Description
July 7, 2009	Minor edits and template/boilerplate updates for publication to Cisco.com
April 3, 2009	Cisco Enterprise Policy Manager (EPM) Release 3.3.0.0

Related Documentation

CEPM_User_Guide_V3.3.0.0.pdf

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:

http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html

Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.

CCDE, CCSI, CCENT, Cisco Eos, Cisco HealthPresence, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco Stackpower, Cisco StadiumVision, Cisco TelePresence, Cisco WebEx, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn and Cisco Store are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0903R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2009 Cisco Systems, Inc. All rights reserved.