To create a simple helloworld RESTful web service using JDeveloper:

For more information, see "Securing RESTful Web Services Using SecurityContext" in Developing and Securing RESTful Web Services for Oracle WebLogic Server.

To get the authenticated user using SecurityContext:

• Access the SecurityContext by injecting an instance into a class field, setter method, or method parameter using the javax.ws.rs.core.Context annotation.

  Update the hello() method, created in the previous step, to print the authenticated user name obtained using the SecurityContext, as follows:

  package examples.wsm.helloworld;
   
  import javax.ws.rs.GET;
  import javax.ws.rs.Path;
  import javax.ws.rs.Produces;
  import javax.ws.rs.core.SecurityContext;
  import javax.ws.rs.core.Context;
  import java.security.Principal;
   
  @Path("helloworld")
  public class HelloWorldIdPropSample {
      public HelloWorldIdPropSample() {
          super();
      }
   
      @GET
      @Produces("text/plain")
      @Path("user")
      public String hello(@Context SecurityContext sc) {
          String user = "No user";
          if (sc != null) {
              Principal p = sc.getUserPrincipal();
              if (p != null) {
                  user = p.getName();
              }
          }
          return "Hello " + user;
      }
  }
  

When you created the RESTful web service using the Create RESTful Service from Java Class wizard, as described in "Creating a RESTful Web Service", JDeveloper automatically changed the project to a web project and added the web.xml file. By default, the servlet name for the web project is jersey.

Edit the web.xml file located in the Web Content/WEB-INF folder to specify a more user-friendly name, such as helloworld. For example:

<?xml version = '1.0' encoding = 'windows-1252'?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
         version="3.0">
  <servlet>
    <servlet-name>helloworld</servlet-name>
    <servlet-class>com.sun.jersey.spi.container.servlet.ServletContainer</servlet-class>
    <load-on-startup>1</load-on-startup>
  </servlet>
  <servlet-mapping>
    <servlet-name>helloworld</servlet-name>
    <url-pattern>/resources/*</url-pattern>
  </servlet-mapping>
</web-app>

To secure RESTful web services, you can attach one of the OWSM predefined security policies described in "OWSM Policies Supported for RESTful Web Services and Clients" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

Secure the RESTful web service by attaching the following policy using the Policy wizard: oracle/multi_token_rest_service_policy

Invoke the Policy wizard by right-clicking on the web.xml file and selecting Secure RESTful Application.

The security policy configuration is saved to the wsm-assembly.xml deployment descriptor file, shown below, in the Web Content/WEB-INF folder. If the wsm-assembly.xml file does not exist, it will be created.

<orawsp:wsm-assembly xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy">
  <sca11:policySet xmlns:sca11="http://docs.oasis-open.org/ns/opencsa/sca/200912" name="policySet"
                 appliesTo="REST-RESOURCE()" attachTo="SERVICE('helloworld')" orawsp:highId="1"
                 xml:id="REST-RESOURCE__SERVICE__helloworld__">
    <wsp:PolicyReference xmlns:wsp="http://www.w3.org/ns/ws-policy"
           DigestAlgorithm="http://www.w3.org/ns/ws-policy/Sha1Exc"
           URI="oracle/multi_token_rest_service_policy" orawsp:status="enabled" orawsp:id="1"/>
  </sca11:policySet>
</orawsp:wsm-assembly>

For the complete procedure, see "Attaching Policies to RESTful Services" in Developing Applications with Oracle JDeveloper.

Deploy the RESTful web service application as a WAR file to WebLogic Server.

To deploy the RESTful web service:

1. Create a deployment profile for the Web application:

   1. Define the profile type and name using the Create Deployment Profile wizard:

      Invoke the Create Deployment Profile wizard by right-clicking on the service project and selecting Deploy > New Deployment Profile.

      Define the following characteristics:

      - Profile Type: WAR File

      - Deployment Profile Name: helloworld

   2. Define the context root for the Web application using the Edit WAR Deployment Profile Properties wizard.

      The Edit WAR Deployment Profile Properties wizard is invoked automatically when you click OK in the Create Deployment Profile wizard.

      Define the following characteristics:

      - Specify Java EE Web Context Root: rest-saml-idprop

2. Deploy the web application using the Deploy <application> wizard.

   Invoke the Deploy <application> wizard by right-clicking the service application and selecting Deploy > helloworld.

   Define the following characteristics:

   • Deployment Action: Deploy to WAR

3. View the WAR file in your configured project directory. For example:

   c:\JDeveloper\mywork\rest-saml-idprop\service\deploy\helloworld.war
   

4. Ensure that you have started WebLogic Server to which you want to deploy the RESTful web service.

   Invoke Fusion Middleware Control and deploy the WAR file.

   http://localhost:7001/em
   

5. Deploy the WAR file using the Deploy Java EE Application Assistant.

   Access the Deploy Java EE Application Assistant, by selecting WebLogic Domain > domainname > AdminServer in the navigation pane, selecting WebLogic Server > Deployments in the content pane, and clicking Deploy.

   For more information, see "Deploying Java EE Applications" in Administering Oracle Fusion Middleware.

Test the RESTful web service application using Fusion Middleware Control.

To test the RESTful web service:

1. Invoke Fusion Middleware Control.

   http://localhost:7001/em
   

2. View the summary page for the RESTful web service application.

   1. In the navigation pane, expand the Application Deployments folder to expose the applications in the domain, expand the application deployment, and select the helloworld (AdminServer) application name.

   2. In the content pane, select Application Deployment, then Web Services.

   3. In the Web Service Details section of the page, click the RESTful Services tab and click the application name helloworld to navigate to the RESTful Service Application page.

   For the complete procedure, see "Viewing the Details for a RESTful Service Application" in Administering Web Services.

3. Click Test RESTful Service.

   The RESTful web service application WADL file is parsed automatically. By default, the GET(hello) method is selected (since this is the only method available in the application).

4. Configure the test client:

   1. On the Request tab, select OWSM Security Policies.

   2. Select oracle/wss_http_token_client_policy in the Client Policies list.

   3. Enter weblogic and password in the Configuration Properties Username and Password field.

5. Click Test Web Service.

The following information is returned on the Response tab:

Hello weblogic

For more information, see "Testing Web Services" in Administering Web Services.

To create a simple RESTful client using JDeveloper:

Modify the HelloWorldServlet HTTP servlet to call the RESTful client, as shown in bold below:

package examples.wsm.helloworld;
...
import com.sun.jersey.api.client.Client;
import examples.wsm.helloworld.HelloWorldRestClient.Helloworld;
...
   public void doGet(HttpServletRequest request, HttpServletResponse response)
          throws ServletException, IOException {
       response.setContentType(CONTENT_TYPE);
       Client client = HelloWorldRestClient.createClient();
       HelloWorldRestClient.Helloworld 
             hello = HelloWorldRestClient.helloworld(client);
       String output = hello.user().getAsTextPlain(String.class);
        PrintWriter out = response.getWriter();
        out.println("<html>");
        out.println("<head><title>HelloWorldServlet</title></head>");
        out.println("<body>");
        out.println("<p>The servlet has received a GET. This is the reply.</p>");
        out.println("<p>Output from RESTful service:" + output + "</p>"); 
        out.println("</body></html>");
       out.close();
   }
}

Secure the servlet web application by editing the web.xml file for the rest-client project, located in the Web Content/WEB-INF folder, as follows:

The web.xml is updated as follows:

<?xml version = '1.0' encoding = 'windows-1252'?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
         version="3.0">
  <servlet>
    <servlet-name>HelloWorldServlet</servlet-name>
    <servlet-class>examples.wsm.helloworld.HelloWorldServlet</servlet-class>
  </servlet>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Success</web-resource-name>
      <url-pattern>/hellorestclient</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>webuser</role-name>
    </auth-constraint>
  </security-constraint>
  <login-config>
    <auth-method>BASIC</auth-method>
  </login-config>
  <security-role>
    <role-name>webuser</role-name>
  </security-role>
</web-app>

To create a weblogic.xml deployment descriptor:

The weblogic.xml file is created, as follows:

<?xml version = '1.0' encoding = 'windows-1252'?>
<weblogic-web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                  xsi:schemaLocation="http://xmlns.oracle.com/weblogic/weblogic-web-app http://xmlns.oracle.com/weblogic/weblogic-web-app/1.5/weblogic-web-app.xsd"
                  xmlns="http://xmlns.oracle.com/weblogic/weblogic-web-app">
  <security-role-assignment>
    <role-name>webuser</role-name>
    <principal-name>weblogic</principal-name>
  </security-role-assignment>
</weblogic-web-app>

Deploy the RESTful client application as a WAR file to WebLogic Server.

To deploy the client:

1. Create a deployment profile for the Web application:

   1. Define the profile type and name using the Create Deployment Profile wizard.

      Invoke the Create Deployment Profile wizard by right-clicking on the rest-client project and selecting Deploy > New Deployment Profile.

      Define the following characteristics:

      - Profile Type: WAR File

      - Deployment Profile Name: helloworld-restclient

   2. Define the context root for the Web application using the Edit WAR Deployment Profile Properties wizard.

      The Edit WAR Deployment Profile Properties wizard is invoked automatically when you click OK in the Create Deployment Profile wizard.

      Define the following characteristics:

      - General: Specify Java EE Web Context Root: rest-saml-idprop-client

2. Deploy the web application using the Deploy <application> wizard:

   Invoke the Deploy <application> wizard by right-clicking the rest-client application and selecting Deploy > helloworld-restclient.

   Define the following characteristics:

   • Deployment Action: Deploy to WAR

3. View the WAR file in your configured project directory. For example:

   c:\JDeveloper\mywork\rest-saml-idprop\rest-client\deploy\helloworld-restclient.war
   

4. Invoke Fusion Middleware Control and deploy the WAR file.

   http://localhost:7001/em
   

   For more information, see "Deploying Java EE Applications" in Administering Oracle Fusion Middleware.

Until the keystore service (KSS) is configured, as described in the next step, "Set Up the Keystore Service (KSS)", access to the RESTful web service client will fail.

To access the RESTful web service client in a browser, enter the following URL in a browser to test the RESTful web service:

http://<host>:<port>/rest-saml-idprop-client/hellorestclient

Enter the WebLogic Server username and password when prompted. For example, weblogic and password.

Note that the following error is returned: Error 500--Internal Server Error.

To set up the KSS keystore:

1. Invoke Fusion Middleware Control.

   http://localhost:7001/em
   

2. Create a keystore from the Keystore page.

   To navigate to the Keystore page, select WebLogic Domain > Security > Keystore.

   1. Click Create Stripe and define the following characteristics:

      - Stripe Name: owsm

   2. Select owsm in the list, and click Create Keystore and define the following characteristics:

      - Keystore Name: keystore

      - Protection: Policy

      - Grant Permission: Disabled

   For the complete procedure, see "Using the OPSS Keystore Service for Message Protection" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

3. Generate a key-pair using the Generate Keypair dialog.

   To navigate to the Generate Keypair dialog, select owsm > keystore on the Keystore page, click Manage, and click Generate Keypair.

   Define the following characteristics:

   • Alias: orakey

   • Common Name: orakey

   • Organization Unit: us

   • Country: United States

   • RSA Key Size: 1024

   For the complete procedure, see "Using the OPSS Keystore Service for Message Protection" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

4. Import the democa CA certificate into the owsm stripe.

   By default, the keypair is signed by the democa CA that ships with KSS.

   To view the certificate in use, select owsm > keystore on the Keystore page, click Manage, and click the orakey alias to display the Certificate Details for Alias: orakey dialog.

   Figure 6-1 Certificate Details for Alias: orakey Dialog

   
   

   
   Description of "Figure 6-1 Certificate Details for Alias: orakey Dialog"

   
   

   Validation of the certificate on the service side will fail until you import the CA into the owsm keystore, as the OWSM Agent is unable to validate the certificate path for the signing certificate.

   Export the democa CA certificate from the castore keystore in the system stripe and import it into the orakey keystore in the owsm stripe.

   1. To export the democa CA certificate, select system > castore on the Keystore page, click Manage, select the democa alias, and click Export.

      In the Certificate dialog, click Export Certificate to save it to a local file (or copy and paste the contents into a file of your choice).

      For the complete procedure, see "Exporting a Certificate or Trusted Certificate with Fusion Middleware Control" in Securing Applications with Oracle Platform Security Services.

   2. To import the democa CA certificate, select owsm > keystore on the Keystore page, click Manage, and click Import.

      Define the following characteristics:

      - Certificate Type: Trusted Certificate

      - Alias: democa

      - Select a file that contains the Certificate or Certificate Chain: Enabled

      Click Choose File, navigate to the exported certificate file, click Open, and click OK to import the certificate.

      For the complete procedure, see "Importing a Certificate or Trusted Certificate with Fusion Middleware Control" in Securing Applications with Oracle Platform Security Services.