OWSM Client Policies and SAML - Simpler is Better

Classic example of me being "too clever by half".

From the OWSM Documentation

Looks like you can just set the username as a property

URL localURL =
    new URL("https://.../MyWebServicePort?WSDL");

    QName name = new QName("http://view.team2.oracle.com/","MyWebServiceService");
  
  myWebServiceService =
    new MyWebServiceService(localURL,name);

  final weblogic.wsee.jws.jaxws.owsm.SecurityPolicyFeature securityFeature =
        new weblogic.wsee.jws.jaxws.owsm.SecurityPolicyFeature("policy:oracle/wss_saml_token_bearer_over_ssl_client_policy");

  WebServiceFeature[] features =
    new WebServiceFeature[] {securityFeature};

  MyWebService myWebService =
    myWebServiceService.getMyWebServicePort(features);

  
  Map<String,Object>  reqContext = ((BindingProvider) myWebService).getRequestContext();
  reqContext.put( BindingProvider.USERNAME_PROPERTY, "jdoe");
  

  // Add your code to call the desired methods.
  System.out.println(myWebService.helloThere("From a Java client - JDOE"));

This "AH HA" eliminates the need for the code to get the JAAS Subject and the configuration of the jps-config.xml and system-jazn-data.xml. Much better.

Just to round out, here is the client for SAML sender-vouches.

URL localURL = new  URL("http://oamwindows:7001/Team2-ViewController-context-root/MyWebServicePort?WSDL");

    QName name = new QName("http://view.team2.oracle.com/","MyWebServiceService");
  
  myWebServiceService =
    new MyWebServiceService(localURL,name);

  final weblogic.wsee.jws.jaxws.owsm.SecurityPolicyFeature securityFeature =
        new weblogic.wsee.jws.jaxws.owsm.SecurityPolicyFeature("policy:oracle/wss10_saml_token_with_message_integrity_client_policy");

  WebServiceFeature[] features =
    new WebServiceFeature[] {securityFeature};

  MyWebService myWebService =
    myWebServiceService.getMyWebServicePort(features);

  Map<String,Object>  reqContext = ((BindingProvider) myWebService).getRequestContext();
  reqContext.put( BindingProvider.USERNAME_PROPERTY, "jdoe");


  reqContext.put(ClientConstants.WSSEC_KEYSTORE_LOCATION, "c:/wstest/alice.jks");
  reqContext.put(ClientConstants.WSSEC_KEYSTORE_PASSWORD, "password" );
  reqContext.put(ClientConstants.WSSEC_SIG_KEY_ALIAS, "alice" );
  reqContext.put(ClientConstants.WSSEC_KEYSTORE_TYPE, "JKS" );
  reqContext.put(ClientConstants.WSSEC_SIG_KEY_PASSWORD, "password" );
  reqContext.put(ClientConstants.WSSEC_ENC_KEY_ALIAS, "alice" );
  reqContext.put(ClientConstants.WSSEC_ENC_KEY_PASSWORD, "password" );
  reqContext.put(ClientConstants.WSSEC_RECIPIENT_KEY_ALIAS,"bob");

  System.out.println(myWebService.helloThere("From a Java client"));

I did all of my testing with the demo CA that ships with WebLogic Server. I find the CertGen and the ImportPrivateKey
tools to be really useful in building small samples. I created two keystores - alice.jks and bob.jks. Alice for the client and Bob for the server. This is all standard stuff, but one thing to remember that OWSM has only a single identity and trust store...not separate stores as in J2SE or WLS, so I had to add the CertGenCA.der to both keystores.

Beyond on that, really pretty simple. I configured the bob.jks keystore for the WebLogic Server Domain from EM - Domain (Right Click) -> Security -> Security Provider Configuration. Scroll down to Keystore...configure bob.jks as the store. Restart the server. Send the message and it just works!

OWSM stand-alone Client to OWSM Server doing SAML Bearer and SAML Sender-Vouches - check!