Automate adding security policy file to META-INF directory for Gen 8.6 EJB Web Service

Products

• Gen

Issue/Introduction

Using Gen 8.6 EJB Web Services under IBM WebSphere Liberty.
Implementing WS-Security deployment and need to be able to automate the adding of a security policy policy-attachments-server.xml file to the directory "model.ief\java\SERVER_MANAGER\META_INF". Also require:

• The content of that file to be updated for the Server PStep name inside the Server Manager (only 1 PStep per Server Manager) 
  
  
• The file should also be incorporated into the SERVER_MANAGER.jar file inside the assembled .ear file.

Already using a customised Build Tool deploy_ear.scr file BT script and customisation scripts from article 387712 Customize the content of a Gen EJB/EJB Web Service ejb-jar.xml file.

The policy-attachments-server.xml file has this content for a PStep with name ABCD_EFGH_IJKL.
Note the 2 different types of PStep name format in bold:

<attachments xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:sp13="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200802" xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">

<wsp:PolicyAttachment wsdlNamespace="http://tempuri.org/AbcdEfghIjkl/">

<wsp:AppliesTo>

<wsp:URI>http://tempuri.org/AbcdEfghIjkl/#wsdl11.service(ABCD_EFGH_IJKL)</wsp:URI>

</wsp:AppliesTo>

<wsp:Policy wsu:Id="UsernameTokenwithPassword">

<wsp:ExactlyOne>

<wsp:All>

<sp:SupportingTokens>

<wsp:Policy>

<sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">

<wsp:Policy>

<sp:WssUsernameToken11/>

</wsp:Policy>

</sp:UsernameToken>

</wsp:Policy>

</sp:SupportingTokens>

</wsp:All>

</wsp:ExactlyOne>

</wsp:Policy>

</wsp:PolicyAttachment>

</attachments>

 

The Build Tool Assemble allows additional files to be manually added to the root of the .ear file or in /lib or a created folder. However that will not satisfy this requirement.

Environment

Gen 8.6 EJB Web Services
WS-Security deployment on IBM WebSphere Liberty 

Resolution

Gen L1 Support provided the following:

1. Template file policy-attachments-server_template.xml.
   The 2 types of PStep name format are converted to dummy values pstepname1 and pstepname2.
   
   
   <attachments xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:sp13="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200802" xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
   <wsp:PolicyAttachment wsdlNamespace="http://tempuri.org/pstepname1/">

   <wsp:AppliesTo>

   <wsp:URI>http://tempuri.org/pstepnam1/#wsdl11.service(pstepname2)</wsp:URI>

   </wsp:AppliesTo>

   <wsp:Policy wsu:Id="UsernameTokenwithPassword">

   <wsp:ExactlyOne>

   <wsp:All>

   <sp:SupportingTokens>

   <wsp:Policy>

   <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">

   <wsp:Policy>

   <sp:WssUsernameToken11/>

   </wsp:Policy>

   </sp:UsernameToken>

   </wsp:Policy>

   </sp:SupportingTokens>

   </wsp:All>

   </wsp:ExactlyOne>

   </wsp:Policy>

   </wsp:PolicyAttachment>
   </attachments>
   
   
   
   
2. New PowerShell script file policy_file_updates.ps1 that should also be deployed to directory "%GEN86%\Gen\bt\scripts".
   The script copies the file policy-attachments-server_template.xml to policy-attachments-server.xml and updates it with the correct PStep names for each format.
   
   
   
3. Additional script updates to these 2 files customised in the original article:
   
   • get_pstepname_from_ejb_jar_xml.ps1
     Additionally calls new script policy_file_updates.ps1 and fixes problem with getting the pstepname correctly after ejb-jar.xml file has Security Role information added. 
     
     
   • deploy_ear.scr
     Search for string "policy" to find 3 sections where changes are required to first add the file policy-attachments-server.xml to the directory "model.ief\java\SERVER_MANAGER\META_INF" and then include it in the SERVER_MANAGER.jar file inside the assembled .ear file.
     NOTE: Please take a backup copy of the existing deploy_ear.scr file before making any changes.
     

See attached zip file for all 4 files.