Webservice Security

package org.superbiz.calculator;

import jakarta.annotation.security.DeclareRoles;
import jakarta.annotation.security.RolesAllowed;
import jakarta.ejb.Stateless;
import jakarta.jws.WebService;

/**
 * This is an EJB 3 style pojo stateless session bean
 * Every stateless session bean implementation must be annotated
 * using the annotation @Stateless
 * This EJB has a single interface: CalculatorWs a webservice interface.
 */
//START SNIPPET: code
@DeclareRoles(value = {"Administrator"})
@Stateless
@WebService(
        portName = "CalculatorPort",
        serviceName = "CalculatorWsService",
        targetNamespace = "http://superbiz.org/wsdl",
        endpointInterface = "org.superbiz.calculator.CalculatorWs")
public class CalculatorImpl implements CalculatorWs, CalculatorRemote {

    @RolesAllowed(value = {"Administrator"})
    public int sum(int add1, int add2) {
        return add1 + add2;
    }

    @RolesAllowed(value = {"Administrator"})
    public int multiply(int mul1, int mul2) {
        return mul1 * mul2;
    }
}

package org.superbiz.calculator;

import jakarta.ejb.Remote;

@Remote
public interface CalculatorRemote {

    public int sum(int add1, int add2);

    public int multiply(int mul1, int mul2);
}

package org.superbiz.calculator;

import jakarta.jws.WebService;

//END SNIPPET: code

/**
 * This is an EJB 3 webservice interface
 * A webservice interface must be annotated with the @Local
 * annotation.
 */
//START SNIPPET: code
@WebService(targetNamespace = "http://superbiz.org/wsdl")
public interface CalculatorWs {

    public int sum(int add1, int add2);

    public int multiply(int mul1, int mul2);
}

<ejb-jar/>

<openejb-jar xmlns="http://tomee.apache.org/xml/ns/openejb-jar-2.2">
  <enterprise-beans>
    <session>
      <ejb-name>CalculatorImpl</ejb-name>
      <web-service-security>
        <security-realm-name/>
        <transport-guarantee>NONE</transport-guarantee>
        <auth-method>BASIC</auth-method>
      </web-service-security>
    </session>
  </enterprise-beans>
</openejb-jar>

package org.superbiz.calculator;

import org.jboss.arquillian.container.test.api.Deployment;
import org.jboss.arquillian.junit.Arquillian;
import org.jboss.arquillian.test.api.ArquillianResource;
import org.jboss.shrinkwrap.api.ShrinkWrap;
import org.jboss.shrinkwrap.api.spec.JavaArchive;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
import org.junit.runner.RunWith;

import javax.xml.namespace.QName;
import jakarta.xml.ws.BindingProvider;
import jakarta.xml.ws.Service;
import java.net.Authenticator;
import java.net.PasswordAuthentication;
import java.net.URL;

import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;

@RunWith(Arquillian.class)
public class CalculatorTest {

    //START SNIPPET: setup
    @ArquillianResource
    private URL base;

    @Deployment(testable = false)
    public static JavaArchive jar() {
        return ShrinkWrap.create(JavaArchive.class, "webservice-security.jar")
                .addClasses(CalculatorImpl.class, CalculatorRemote.class, CalculatorWs.class)
                .addAsManifestResource("META-INF/ejb-jar.xml", "ejb-jar.xml")
                .addAsManifestResource("META-INF/openejb-jar.xml", "openejb-jar.xml");
    }

    // the WSDL is protected by the same BASIC auth as the endpoint
    @Before
    public void wsdlCredentials() {
        Authenticator.setDefault(new Authenticator() {
            @Override
            protected PasswordAuthentication getPasswordAuthentication() {
                return new PasswordAuthentication("jane", "waterfall".toCharArray());
            }
        });
    }

    @After
    public void resetWsdlCredentials() {
        Authenticator.setDefault(null);
    }
    //END SNIPPET: setup

    /**
     * Create a webservice client using wsdl url
     *
     * @throws Exception
     */
    //START SNIPPET: webservice
    @Test
    public void testCalculatorViaWsInterface() throws Exception {
        URL url = new URL(base.toExternalForm() + "CalculatorImpl?wsdl");
        QName calcServiceQName = new QName("http://superbiz.org/wsdl", "CalculatorWsService");
        Service calcService = Service.create(url, calcServiceQName);
        assertNotNull(calcService);

        CalculatorWs calc = calcService.getPort(CalculatorWs.class);
        ((BindingProvider) calc).getRequestContext().put(BindingProvider.USERNAME_PROPERTY, "jane");
        ((BindingProvider) calc).getRequestContext().put(BindingProvider.PASSWORD_PROPERTY, "waterfall");
        assertEquals(10, calc.sum(4, 6));
        assertEquals(12, calc.multiply(3, 4));
    }
    //END SNIPPET: webservice

}

<arquillian
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    >
  <container qualifier="tomee" default="true">
    <configuration>
      <property name="httpPort">-1</property>
      <property name="stopPort">-1</property>
      <property name="appWorkingDir">target/tomee-embedded</property>
      <property name="properties">
        # role required by the BASIC auth constraint of the webservice-security module endpoints
        tomee.jaxws.security-role.webservice-security = Administrator
      </property>
      <!-- <user>=<password> -->
      <property name="users">
        jane=waterfall
        joe=cool
      </property>
      <!-- <user>=<role>[,<role>] -->
      <property name="roles">
        jane=Administrator
        joe=Administrator
      </property>
    </configuration>
  </container>
</arquillian>

-------------------------------------------------------
 T E S T S
-------------------------------------------------------
Running org.superbiz.calculator.CalculatorTest
INFO: Starting Servlet engine: [Apache Tomcat/11.0.25]
INFO: Version: 10.3.0-SNAPSHOT
INFO: Configuring enterprise application: /path/to/examples/webservice-security/target/tomee-embedded/0/webservice-security.jar
INFO: Auto-deploying ejb CalculatorImpl: EjbDeployment(deployment-id=CalculatorImpl)
INFO: Created Ejb(deployment-id=CalculatorImpl, ejb-name=CalculatorImpl, container=Default Stateless Container)
INFO: Started Ejb(deployment-id=CalculatorImpl, ejb-name=CalculatorImpl, container=Default Stateless Container)
INFO: Webservice(wsdl=http://localhost:53487/webservice-security/CalculatorImpl, qname={http://superbiz.org/wsdl}CalculatorWsService) --> Ejb(id=CalculatorImpl)
INFO: Deployed Application(path=/path/to/examples/webservice-security/target/tomee-embedded/0/webservice-security.jar)
INFO: Creating Service {http://superbiz.org/wsdl}CalculatorWsService from WSDL: http://localhost:53487/webservice-security/CalculatorImpl?wsdl
INFO: Undeploying app: /path/to/examples/webservice-security/target/tomee-embedded/0/webservice-security.jar
Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 1.925 s -- in org.superbiz.calculator.CalculatorTest

Results :

Tests run: 1, Failures: 0, Errors: 0, Skipped: 0