Tomcat Configuration
$CATALINA_HOME/conf
- server.xml - defines standalone Tomcat server - service name is
Catalina
- the connector elements define the port(s) on which tomcat
will
listen the protocol (http or https), and the location of the keystore
for
https connectors.
- define a dumper valve here
- define remoteAddrValve here to limit the sites that can
access the connector
- web.xml- defines default values for servlets for static
resources, jsp, server-side-includes we just used the sample in the
distribution.
- context.xml - used distribution sample
- logging.properties - can be edited to change some logging levels
- tomcat-users.xml - user names and passwords for access to the
Tomcat administrative web pages
$CATALINA_HOME/common
Classes and libraries shared by the Tomcat server and all the
webapps.
We added common/classes/log4j.properties and common/lib/log4j.jar in
order to get Tomcat to do log4j. By default it just uses commons
logging. The logging by the oscars.war and oscars.aar pick up defaults from this
file, e.g the root.catagory log.
$CATALINA_HOME/shared
Contains classes and libraries shared by all the webapps but not the
Tomcat server. This has been where we have put files that can't seem to
be found from the axis2.war or the OSCARS.aar. Currently the contents
are:
- classes/repo - files that need to be on the classpath as repo/<filename>
- sec-client.jks
- sec-client.properties - says the keystore file is in repo/sec-client.jks
- classes/net/es/oscars/client/security/PWCallback.class - used by
the OSCARS when forwarding a request.
- oscars.conf
- axis2.repo (used when
OSCARS is forwarding a request, see below)
- axis2.xml - says the signaturePropFile is in repo/sec-client.properties
- ssl-keystore.jks
- modules
- server
- oscars.key
- oscars.properties
- oscars_juniper_lsp_teardown.xml
- oscars_juniper_lsp_setup.xml
- pss.key
- test.properties
- lib contains the axis2 and rampart jars.
$CATALINA_HOME/webapps
Contains all the user provided war files. In our case this is
OSCARS.war and
axis2.war. When a war file is put in this directory it will be
automatically deployed by the Tomcat server and its contents will be
extracted into a directory with the name of the war.
Every tomcat webapp has a WEB-INF/web.xml that defines the service name
and methods.
$CATALINA_HOME/bin - startup scripts
- startup.sh - we edited to set OSCARS_HOME
and JAVA_OPTS="-Djava.net.preferIPv4Stack=true" to get around a FreeBSD 6.0 / ipv6/ jdk1.5 bug
- catalina.sh - starts the comand with output sent to $CATALINA_HOME/logs/catalina.out
Axis2 Configuration
- $CATALINA_HOME/webapps/axis2/WEB-INF/web.xml
- defines servlets, e.g SOAPMonitor. AdminServlet,Axis2Servlet
- maps urls to servlet names, and servlet names to class
- $CATALINA_HOME/webapps/axis2/WEB-INF/conf/axis2.xml
- Defines parameters like enableMTOM, username, password (for
axis admin)
- defines messageRecievers, transportReceivers(http, tcp, smtp
- Engage global modules like SOAPMonitor and rampart
- defines phase order (added soapMonitor phase)
OSCARS Configuration
Server
- OSCARS.jar/META-INF/services.xml
is generated by WSDL2Java and specifies all the methods and parameters.
The security inFlow and outFlow parameters need to be added to this
file. The name of the sec-properties file is given here.
- classes/sec-server.properties
names the keystore file and has its
password
- classes/sec-server.jks
has
the keystore that is used by rampart to
verify signed messages. It only needs to contain the trustedCaCerts for
the issuers of any user who will submit a signed message.
- Files copied from OSCARS to axis2
- need the oscars version of log4j.properties to be in
webapps/axis2/classes
- need to copy wss4j.jar, xalan.jar and xmlsec.jar to
webapps/axis2/lib,
- wss4j.jar must not be in OSCARS.war or OSCARS.aar, or it causes
class conflicts.
When the server forwards a request to another domain, it acts as a
OSCARS/axis2 client and thus needs to include te client-side
configuration files. These files are put into
$CATALINA_HOME/shared/oscars.conf/axis2.repo.
The location of the axis2.xml file and
the repository in which the modules are found are set in Forwarder.setup.
Forwarder.setup calls KeyMangement.setKeyStore which sets the ssl keystore to the
file "ssl-keystore.jks" in the repository directory.
axis2.xml defines the names of the signatureProperty file and the keystore.
The files sec-client.properties, sec-client.jks and ssl-keystore.jks are also
copied to $CATALINA_HOME/shared/classes/repo so that they will be on
the server's classpath.
Client
See Security Reference for more
details about these files.
- axis2.xml - needed when
signing messages. It contains:
- InFlow and OutFlow parameters
- Name of the client-properties file
The axis2.xml file can be found by the client code from a
javavm flag -daxis2.xml=<filename>
or can be set programatically by
ConfigurationContext configContext =
ConfigurationContextFactory.createConfigurationContextFromFileSystem(repo, null);
ServiceClient serviceClient = new ServiceClient(configContext, null)
Where repo is a directory on the classpath that contains a
conf/axis2.xml file.
The repo directory also conatins: sec-client.properties
contains:
- org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
- org.apache.ws.security.crypto.merlin.keystore.type=jks
- org.apache.ws.security.crypto.merlin.keystore.password=password
- .apache.ws.security.crypto.merlin.file=sec-client.jks (name
of keystore file)
sec-client-key.jks
contains
- keyentry for the user specified in axis2.xml to be signing
the outgoing messages
- trustedCaCerts for the issuer of this user's certificate
ssl-keystore.jks - has
the certificate and issuer for the ssl
certificate of the oscars services to which the client will be
connecting