Secure OMII services from Taverna

These instructions have been tested on linux.

Method 1: link to OMIICLIENT

1. Download the omii-client (2.3.3) from:

• http://www.omii.ac.uk/downloads/release.jsp?releaseid=124

2. Run ./OMIIclientInstall.sh

This will create OMIICLIENT, with a keystore omii.ks valid for one month.

3. Copy to TAVERNA_HOME/lib the following jars

• OMIICLIENT/lib/bouncycastle-jce-jdk13-119.jar
• OMIICLIENT/lib/castor-0.9.5.jar
• OMIICLIENT/lib/itinnov-grid-utils-1.2.jar
• OMIICLIENT/lib/opensaml-1.0.1.jar
• OMIICLIENT/lib/wss4j-gria-patched-6.jar
• OMIICLIENT/lib/xmlsec-1.2.1.jar

(Simply adding them to your classpath does not work - at least not in the various orders I tried.)

4. Go to OMIICLIENT/conf

• remove all typeMapping elements from client-config.wsdd
• if you have an http proxy configure HTTP-proxy.properties
• edit the crypto.properties so that the following two properties point to the right files:
  • org.apache.ws.security.crypto.merlin.file
  • org.apache.ws.security.crypto.merlin.crldir

Here are the modified files:

• client-config.wsdd

• crypto.properties

• HTTP-proxy.properties

You can take these instead of using OMIICLIENT and just drop them in your Taverna's conf directory after editing crypto.properties so that it points to the correct keystore.

5. Edit runme.sh as follows (similar instructions should work for runme.bat):

...

TAVERNA_HOME=`cd "$TAVERNA_HOME" && pwd`

OMII=your/path/to/OMIICLIENT

CLASSP=

CLASSP=$CLASSP:$OMII/conf:OMIICLIENT/endorsed

CLASSP=$CLASSP:$TAVERNA_HOME/resources:$TAVERNA_HOME/conf:$TAVERNA_HOME/taverna-1.3.1-launcher.jar

...

java -classpath $CLASSP -Djava.endorsed.dirs=$OMII/endorsed -Djava.protocol.handler.pkgs=uk.ac.rdg.resc.jstyx.client -Dtaverna.home=$TAVERNA_HOME -ea org.embl.ebi.escience.scuflui.workbench.WorkbenchLauncher

6. Launch Taverna and load the following test workflow (by Steve) which replicates the standard OMII client test:

• omii-test.xml

You will get some error messages when you start Taverna, but the workflow should complete successfully.

Method 2: no link to OMIICLIENT

Note that step 2 is needed only for creating an OMII keystore - you should not need that step if you already have such store.

1. Download the omii-client (2.3.3) from:

• http://www.omii.ac.uk/downloads/release.jsp?releaseid=124

2. Run ./OMIIclientInstall.sh

This will create OMIICLIENT, with a keystore omii.ks valid for one month.

3. Copy to TAVERNA_HOME/lib the following jars

• OMIICLIENT/lib/bouncycastle-jce-jdk13-119.jar
• OMIICLIENT/lib/castor-0.9.5.jar
• OMIICLIENT/lib/itinnov-grid-utils-1.2.jar
• OMIICLIENT/lib/opensaml-1.0.1.jar
• OMIICLIENT/lib/wss4j-gria-patched-6.jar
• OMIICLIENT/lib/xmlsec-1.2.1.jar

(Simply adding them to your classpath does not work - at least not in the various orders I tried.)

4. Put the following files in TAVERNA_HOME/conf:

• client-config.wsdd
• crypto.properties
  • edit it so that the following two properties point to the right files:
    • org.apache.ws.security.crypto.merlin.file
    • org.apache.ws.security.crypto.merlin.crldir
• HTTP-proxy.properties
  • if you have an http proxy configure this file

5. Add OMIICLIENT/lib/xalan-2.5.1.jar to JAVA_HOME/lib/endorsed/ or, better, pass the extra argument

• -Djava.endorsed.dirs=/your/path/to/OMIICLIENT/endorsed

to the JVM when launching taverna.

6. Launch Taverna and load the following test workflow (by Steve) which replicates the standard OMII client test:

• omii-test.xml

You will get some error messages when you start Taverna, but the workflow should complete successfully.

Dynamic Client Handler Configuration

Notes by Stephen Crouch.

When invoking a service through Axis, you can dynamically configure the client handler configuration. e.g. when invoking through Axis client stubs to obtain a binding to the service:

GraphSoapBindingStub binding;
try {
   EngineConfiguration config =
           new FileProvider("client-config.wsdd");
   GraphServiceLocator gsl =
           new GraphServiceLocator(config);

   java.net.URL u = new java.net.URL();
   binding = (GraphSoapBindingStub) gsl.getGraph(u);

} catch (javax.xml.rpc.ServiceException jre) {
   if (jre.getLinkedCause() != null)
      jre.getLinkedCause().printStackTrace();
   throw new RuntimeException("JAX-RPC ServiceException caught: " + jre);
}
binding.() ...

The above used client config wsdd (found in the OMIICLIENT/conf/ directory) is configured to be nonsecure, but by using client-config.wsdd (in same directory) instead it becomes a secure invocation.

Not quite as useful but perhaps interesting: you can also configure a global nonsecure Axis invocation policy using one of the following:

• When invoking the JVM setting a property:
  • -Daxis.clientConfigFile="/OMIICLIENT/conf/default-client-config.wsdd"

• The same but from within Java:
  • AxisProperties.setProperty("axis.ClientConfigFile", "default-client-config.wsdd");

So you could set the default using one of the above methods, and then optionally access secure services using a FileProvider. Alternatively, you could associate and use a suitable client-config.wsdd for each invocation (more general approach).