One of the more
complex examples that ship with WLS is a WS-Trust based authentication of a web
service using SAML assertions. This example is quite easy to setup and run and
the example’s documentation gives a basic understanding of what is going on.
But we want to look deeper and shed light on the complexity that is hidden
behind SSL, WS-Trust and SAML authentication. In a first step we separate the
scenario from the example server and integrate it into eclipse, to create an
isolated laboratory environment for further investigation. We will use
Wireshark to analyze the actual flow of messages on the wire. We even look
inside the SSL streams to identify the WS-Trust tokens and SAML assertions as
they are passed between the participants.
This part of the
toolbox series introduces the Mini-IDE project. It is designed to instantly
setup a weblogic server together with a small sample application. It provides everything
to setup and run the example in less than five minutes. Despite its simplicity,
it contains everything to build and deploy a Java EE web application, relying
on not more than a WLS installation. It can easily be modified and used in
analysis situations or as a starting point for proof of concepts. In environments
where access is restricted to shell usage, we provide a distribution method
based on copy and paste via the clipboard. 