I will dig today into secured Web Service access from ADF Mobile. There are good tutorials how to consume open Web Service in ADF Mobile, but in practice almost every Web Service exposed for the mobile must be secured - who wants to expose open Web Service on the public internet? ADF Mobile doesn't support Web Service Java Proxy, you have an option to use Data Control generated directly from the Web Service - I will explain the steps how to configure such Data Control for secured Web Service access. Thanks to Joe Huang (ADF Mobile Product Manager) - he gave me very useful hints to finalize secured Web Service invocation from ADF Mobile.
In my next post - I will explain how to deploy and test the same application on real iPhone device.
I would recommend to read -
10.5 Accessing Secure Web Services, this is a good guide - but I will try to cover certain gaps. You can download sample application -
mobilesecuredws.zip. This archive is based on previous blog sample application -
ADF Mobile - Login Functionality and contains three applications:
1. ADFBasicAuthApp - typical ADF application with basic ADF security authentication enabled. This application is installed as authentication server.
2. ADFMobileSecuredApp - ADF Mobile application with deployment profile for iOS simulator. Implemented secured home page and configured with login page. Calls secured Web Service.
3. ADFSecuredService - ADF BC application enabled with Web Service from Application Module.
From this diagram you can understand all the relationships implemented in the sample application:
Access to ADF Mobile application is authenticated through WebLogic server security realm. Once initial authentication is completed - user is able to call secured Web Service. ADF Mobile injects user security information into Web Service header, security information is retrieved from security store constructed after login.
We should look now into the service part - where secured Web Service is implemented (ADFSecuredService application). Standard service interface is defined for Application Module and one custom method is exposed:
Custom method is not doing anything fancy, except that it prints success message:
How you can secure such Web Service? Just select implementation class in the structure window:
Locate OWSM Policies section in the Properties window and open property editor. There are different properties available, for this sample application I was using - oracle/wss_username_token_service_policy:
You can double check if security policy is assigned successfully for Web Service implementation class:
This is all with the service part, now we are going to switch to the ADF Mobile part (ADFMobileSecuredApp application). As I have said earlier, ADF Mobile doesn't support Java Web Service proxy, so we are going to use Web Service Data Control directly:
Once Data Control for Web Service is generated (I skip this part, because it is well documented anyway - just Google), you should select it in the Structure window, right click and choose - Define Web Service Security:
In the wizard, for your convenience - check option for
Show only the compatible client policies for selection - this will filter only these security policies applied supported by the Web Service on server side:
Now we are approaching one of the most critical points in this post - connections.xml file configuration in ADF Mobile application:
This file defines two connections:
1. Authentication Server for Login
2. Secured Web Service
Both of these connections must point to the same
adfCredentialStoreKey. There is a bug in current version, when you generated Web Service Data Control for ADF Mobile application - by default it is using different property name -
credentialStoreKey. You should fix this property name manually to be adfCredentialStoreKey (check sample application). This is known issue -
Enabling Credential Injection to Web Services (14726089).
Once again -
adfCredentialStoreKey for authentication server:
Must be the same as for the secured Web Service:
Configuration is completed - now we can test it. Add button on ADF Mobile UI screen to invoke method from secured Web Service data control:
ADF Mobile is using the same bindings concept as regular ADF - action is defined in the page definition file, this action is responsible to call method from secured Web Service:
Run application on iPhone simulator directly from JDeveloper environment:
Few seconds and we are ready to login into ADF Mobile application:
Authentication is successful - press Test Web Service Secured Access button to invoke custom method from remote secured Web Service:
Check server log - method was invoked successfully: