How to apply security policies with WSO2 ESB 4.9.0

Hi All,

Here is a quick tutorial on how to create a secured service in WSO2 ESB 4.9.0. As QoS is removed from the admin console, now you will have to use WSO2 Developer Studio to apply the relevant security policies for the proxy services.

1) Download WSO2 ESB 4.9.0 and WSO2 Developer Studio 3.8.0
2) Extract these into folders
3) First we need to create a policy using the developer studio
Please refer following URL on creating a new policy - here we can use UsernamToken Policy
policy https://docs.wso2.com/display/DVS380/Applying+Security+for+a+Service#ApplyingSecurityforaService-Creatingthesecuritypolicy

4) Then you need to create the proxy service - for this first create an ESB Config Project from the Developer Studio Dashboard - then right click on the project name and add a proxy service

5) For this scenario lets create a simple Pass through proxy- lets use StockQuote Sample as the sample endpoint

Please follow the following link on how to startup the sample services https://docs.wso2.com/display/ESB490/Setting+Up+the+ESB+Samples#SettingUptheESBSamples-StartingtheAxis2server

6) After creating the proxy , you need to add the previously created security policy to the proxy service

Please refer the following guide on how to do that  https://docs.wso2.com/display/DVS380/Applying+Security+for+a+Service#ApplyingSecurityforaService-Applyingsecurityforaproxyservice

7) After creating both proxy service and the policy , you need to deploy this into the ESB. For this purpose lets create a composite application First

8) Go to the Developer studio dashboard and Click on Composite Application Project - there give a name to the project and select both the proxy service project and the policy project you have created and click on Finish

9) Now right click on the created composite application project and click on Export Composite Application Project

10) Now startup the ESB server and Login - then go to Carbon Applications from the right side menu and upload the car file by clicking on Add

11) After the successful deployment of the .car file when you go to list the proxy services you can see the created Proxy Service with Security Applied

12) Click on Try this Service and the following window will be opened

Note :- please enter the username and password and select the https endpoint as shown above and invoke the service with a parameter ex:- IBM

You will get the relevant response :)

Cheers...!!

Run Time Governance Use Case with WSO2 GREG and ESB - 1

Hi Ya''ll,

Long time ...How are you all doing? It is Christmas time again....Lets try to learn a run time governance scenario with WSO2 Governance Registry today.....:)

Lets start understanding the scenario with a diagram....

We can describe the above diagram as follows :-

1. Custom security policy is uploaded via GREG.
2. GREG is mounted with ESB.
3. Security proxy is created applying the custom policy in the registry (referring the policy in the GREG)
4. Proxy is created for the service hosted in the application server.

Once the service is invoked via SoapUI, since the security policy is applied at ESB , it will refer to the policy in the Governance Registry at the rum-time. Once the security policy is properly validated, the response will be passed back to the invoking party.

In the next post lets talk about how to simply build up the above scenario......

Bye bye for now...:)

Mutual SSL with WSO2 Enterprise Service Bus

Lets try to simply understand what is this Mutual SSL

I hope the following diagram will draw a good image in your brain to understand this

-------------------------------------------------------------------------------------------------------

Okay, lets see what happens in each step of the SSL handshake :-

(1) Client says hello and request for the Server certificate
(2) Server says hello with the certificate

That is the first handshake that happens , but when you enable mutual SSL there is a another handshake happens.

(3) Server says hello with requesting for the client certificate
(4) Client says hello back with the certificate

ONCE BOTH THE PARTIES TRUST EACH OTHER THEY ESTABLISH THE CONNECTION FOR FURTHER ACTIONS BETWEEN CLIENT AND THE SERVER.

Now lets look at what requirements should be completed into order for this to happen :)

(1) Client trust store should have the CA certificate / server certificate - signed by CA of the server - 

FOR THE CLIENT TO TRUST THE SERVER

(2) Server trust store should contain the CA certificate / client certificate - signed by CA of the client - 

FOR SERVER TO TRUST THE CLIENT

(3) The Certificate Authority who have signed the certificate should be trusted by both the parties


Now that you have an understanding of what is mutual SSL and what are the requirements needed, please have a look at the following important blog post by Asela in order to how to check the mutual SSL capability of the WSO2 ESB with an example java client :-

Enable Mutual SSL for Proxy services in WSO2ESB - I

Mutual SSL also called as two way SSL :)

THANKS !