Sécurité en ingénierie du Logiciel

Le cadre des Web Services Partie 7 : Introduction à SOAP

Alexandre Dulaunoy

adulau@foo.be

Agenda

• Introduction

• SOAP format (par l’exemple)

• SOAP format des erreurs

• SOAP format et transport HTTP

Introduction

SOAP is a lightweight protocol for exchange of information in a decentralized, distributed environment. It is an XML based protocol that consists of three parts: an envelope that defines a framework for describing what is in a message and how to process it, a set of encoding rules for expressing instances of application-defined datatypes, and a convention for representing remote procedure calls and responses. SOAP can potentially be used in combination with a variety of other protocols; however, the only bindings defined in this document describe how to use SOAP in combination with HTTP and HTTP Extension Framework.

Simple Object Access Protocol (SOAP) 1.1 - Document

W3C

SOAP format (par l’exemple)

public interface Hello { public String sayHelloTo(String name); }

• La méthode sayHelloTo pourrait être *,

• Pour interfacer sayHelloTo (client/serveur),

• Pas limité à Java (uniquement pour l’exemple), <?xml version="1.0"?> <Hello> <sayHelloTo> <name>John</name> </sayHelloTo> </Hello>

• Requête vers l’interface Hello définie,

• Définition de la méthode,

• Paramètres de la méthode, <?xml version="1.0"?> <Hello> <sayHelloToResponse> <message>Hello John, How are you?</message> </sayHelloToResponse> </Hello>

• Réponse à la requête (vers l’interface Hello),

• Methode + "Response",

• Un "message" de retour.

SOAP format (requête)

<SOAP-ENV:Envelope xmlns:SOAP-ENV=" http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi=" http://www.w3.org/1999/XMLSchema-instance" xmlns:xsd="http://www.w3.org/1999/XMLSchema"> <SOAP-ENV:Header> </SOAP-ENV:Header> <SOAP-ENV:Body> <ns1:sayHelloTo xmlns:ns1="Hello" SOAP-ENV:encodingStyle=" http://schemas.xmlsoap.org/soap/encoding/"> <name xsi:type="xsd:string">John</name> </ns1:sayHelloTo> </SOAP-ENV:Body> </SOAP-ENV:Envelope>

Sécurité en ingénierie du Logiciel – p.7/16

SOAP format (retour)

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance" xmlns:xsd="http://www.w3.org/1999/XMLSchema"> <SOAP-ENV:Body> <ns1:sayHelloToResponse xmlns:ns1="Hello" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <return xsi:type="xsd:string">Hello John, How are you doing?</return> </ns1:sayHelloToResponse> </SOAP-ENV:Body> </SOAP-ENV:Envelope>

Sécurité en ingénierie du Logiciel – p.8/16

SOAP format (header)

<SOAP-ENV:Header> <t:Transaction xmlns:t="some-URI" SOAP-ENV:mustUnderstand="1"> 5 </t:Transaction> </SOAP-ENV:Header>

SOAP format (erreur)

<SOAP-ENV:Envelope xmlns:SOAP-ENV=" http://schemas.xmlsoap.org/soap/envelope/"> <SOAP-ENV:Body> <SOAP-ENV:Fault> <faultcode>SOAP-ENV:Server</faultcode> <faultstring>Server Error</faultstring> <detail> <e:myfaultdetails xmlns:e="Hello"> <message> Sorry, my silly constraint says that I cannot say hello on Friday. </message> <errorcode> 1001 </errorcode> </e:myfaultdetails> </detail> </SOAP-ENV:Fault> </SOAP-ENV:Body> </SOAP-ENV:Envelope>

Sécurité en ingénierie du Logiciel – p.10/16

SOAP format (+header)

<SOAP-ENV:Envelope xmlns:SOAP-ENV=" http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi=" http://www.w3.org/1999/XMLSchema-instance" xmlns:xsd="http://www.w3.org/1999/XMLSchema"> <SOAP-ENV:Header> <t:Transaction xmlns:t="some-URI" SOAP-ENV:mustUnderstand="1"> 5 </t:Transaction> </SOAP-ENV:Header> <SOAP-ENV:Body> <ns1:sayHelloTo xmlns:ns1="Hello" SOAP-ENV:encodingStyle=" http://schemas.xmlsoap.org/soap/encoding/"> <name xsi:type="xsd:string">Alex</name> </ns1:sayHelloTo> </SOAP-ENV:Body> </SOAP-ENV:Envelope>

Sécurité en ingénierie du Logiciel – p.11/16

SOAP format (erreur sur header)

<SOAP-ENV:Envelope xmlns:SOAP-ENV=" http://schemas.xmlsoap.org/soap/envelope/"> <SOAP-ENV:Body> <SOAP-ENV:Fault> <faultcode>SOAP-ENV:MustUnderstand</faultcode> <faultstring>SOAP Must Understand Error</faultstring> </SOAP-ENV:Fault> </SOAP-ENV:Body> </SOAP-ENV:Envelope>

SOAP via HTTP

POST http://www.SmartHello.com/HelloApplication HTTP/1.0 Content-Type: text/xml; charset="utf-8" Content-Length: 587 SOAPAction: "http://www.SmartHello.com/HelloApplication#sayHelloTo" <SOAP-ENV:Envelope xmlns:SOAP-ENV=" http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi=" http://www.w3.org/1999/XMLSchema-instance" xmlns:xsd="http://www.w3.org/1999/XMLSchema"> <SOAP-ENV:Header> </SOAP-ENV:Header> <SOAP-ENV:Body> <ns1:sayHelloTo xmlns:ns1="Hello" SOAP-ENV:encodingStyle="

http://schemas.xmlsoap.org/soap/encoding/">  <name  xsi:type="xsd:string">John</name>

</ns1:sayHelloTo> </SOAP-ENV:Body> </SOAP-ENV:Envelope>

SOAP via HTTP (retour)

HTTP/1.0 200 OK Content-Type: text/xml; charset="utf-8" Content-Length: 615 <SOAP-ENV:Envelope xmlns:SOAP-ENV=" http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi=" http://www.w3.org/1999/XMLSchema-instance" xmlns:xsd="http://www.w3.org/1999/XMLSchema"> <SOAP-ENV:Body> <ns1:sayHelloToResponse xmlns:ns1="Hello" SOAP-ENV:encodingStyle=" http://schemas.xmlsoap.org/soap/encoding/"> <return xsi:type="xsd:string">Hello John, How are you doing?</return> </ns1:sayHelloToResponse> </SOAP-ENV:Body> </SOAP-ENV:Envelope>

SOAP : plusieurs transports

• via HTTP / TLS,

• via les extensions HTTP,

• via SMTP,

• via "Batch processing",

• via ...

Q&R

• adulau@foo.be

• http://www.foo.be/cours/securite-webservices/

• 3B12 DCC2 82FA 2931 2F5B 709A 09E2 CD49 44E6 CBCD