The configuration of messaging security on the server side is based on the client-side configuration, in that a service can also be a client to another service. The server-side configuration adds to the information in the client configuration, by specifying:

It is possible to specify many default accepting authentication providers, and one initiating provider for a Web service. Accepting providers are used to express requirements for authentication of Web service clients. The default accepting authentication providers are used for all services that do not use their own custom configuration. The initiating provider is used in the case that a service is a client of another service. These providers can be set using ProvidersManager. For more information, please see Providers Manager.

The ProvidersManager tool facilitates the specification of different accepting and initiating providers for a particular Web service endpoint, thus overriding the defaults.

This tool can also associate identities with a Web service and turn on access control, or authorization checks, for clients invoking a Web service. These features are also available on the WSO2 SOA Enablement Server Administration Console. For more information, please see WSO2 SOA Enablement Server Management Console.

The server-side code can contain the same code lines used on the client side. There is no difference in the usage, but the semantics differ slightly. First, the Current instances are scoped to the Web service endpoints. In each Web service instance, its particular endpoint receives a different Current instance. The initiating provider on the server side is the same as the current provider on the client side. Also, the server and client side Current instances are more tightly coupled together.

Settings of credentials on the server Current causes the setting of credentials on the client Current. Only the server Current can be used to associate an identity for both incoming and outgoing communication. If you set credentials through the client Current, they are not used for server side Current.

The server getAuthenticator() method without parameters also works only if there is exactly one accepting security provider configured. You can also check the invoking client identity using getReceivedCredentials() method.

Particular Web service endpoints can be configured to perform authorization checks before the invocation of a Web service method. Authorization requirements can be toggled on or off using the WSO2 SOA Enablement Server Server Administration Console or the Providers Manager.

Authorization checks are performed by the WSO2 SOA Enablement Server mediator named AZServiceMediator.

If no received credentials are found, the only possible way to invoke the service is if the WSO2 SOA Enablement Server is configured to allow access to non-authenticated users.

An important part of securing a Web service is limiting access to it. One way to do this, suitable for some environments, is limiting access based on the client's IP address. WSO2 SOA Enablement Server includes a transport interceptor which can provide such filtering: the class com.idoox.wasp.interceptor.IPFilterInterceptor.

This interceptor acts according to a set of very simple rules. The interceptor has a list of ranges of IP addresses (see the section Specifying ranges for details) and a flag for each range that indicates whether IP addresses falling into this range are to be allowed or blocked. The list is traversed sequentially and the first matching range determines the action. If no range matches the client's IP address, the interceptor's default is used. When the interceptor is created, this default is set to blocking, but it can be changed.

// Copyright 2001-2003 Systinet Corp. All rights reserved.
// Use is subject to license terms.
package example.security;

import com.idoox.wasp.interceptor.IPFilterInterceptor;

import example.basics.webservices.HelloServiceImpl;

import org.systinet.wasp.Wasp;
import org.systinet.wasp.webservice.Interceptors;
import org.systinet.wasp.webservice.Registry;
import org.systinet.wasp.webservice.ServiceEndpoint;


public class IPFiltering {
    public static void main(String[] args) throws Exception {
        // booting server
        System.out.println("Starting server");
        Wasp.init("http://localhost:8090/");

        try {
            // adding a sample int storage service
            System.out.println("Adding the sample service");

            ServiceEndpoint serviceEndpoint =
                Registry.publish("/HelloWorldService/", HelloServiceImpl.class);

            IPFilterInterceptor interceptor = new IPFilterInterceptor();

            // disallowing requests from everywhere
            interceptor.setAllowedByDefault(false);

            // allow the addresses 192.168.x.x only
            interceptor.addRule("192.168.0.0", "255.255.0.0", true);

            // register interceptor
            serviceEndpoint.getInterceptors()
                           .insert(interceptor, Interceptors.DIRECTION_IN);

            System.out.println("Lookup the service");

            example.basics.invocation.HelloService svc =
                (example.basics.invocation.HelloService) Registry.lookup(
                    "http://localhost:8090/HelloWorldService/wsdl",
                    example.basics.invocation.HelloService.class);

            // call the service, should fail
            System.out.println("Returned: " + svc.hello("hi"));
        } catch (Exception e) {
            e.printStackTrace();
        } finally {
            // shutting the server down
            System.out.println("Shutting the server down");
            Wasp.destroy();
        }
    }
}

<?xml version="1.0" encoding="UTF-8"?>
<package name="IPFilteredService"
    targetNamespace="http://systinet.com/examples/security/ipFiltering"
    version="1.0" xmlns="http://systinet.com/wasp/package/1.1" 
    xmlns:tns="http://systinet.com/examples/security/ipFiltering">
    <license>http://systinet.com</license>
    <service-instance
        implementation-class="example.basics.webservices.HelloService" 
        name="HelloServiceInstance"/>
    <processing name="IPFilterProcessing">
        <interceptor direction="in"
           implementation-class="com.idoox.wasp.interceptor.IPFilterInterceptor"
            name="IPFilterInterceptor">
            <configuration>
                <config allowedByDefault="false">
                    <!-- the following allows connections from localhost -->
                    <range address="127.0.0.1" allowed="true" 
                    netmask="255.255.255.255"/>
                    <!-- the following allows connections from the usual
                         intranet IP address range: 10.x.y.z -->
                    <range address="10.0.0.0" allowed="true" 
                        netmask="255.0.0.0"/>
                </config>
            </configuration>
        </interceptor>
    </processing>
    <service-endpoint name="FilteredHelloServiceService" 
    path="/HelloService"
    processing="tns:IPFilterProcessing" 
    service-instance="tns:HelloServiceInstance"/>
</package>

WaspPackager -o hello.jar --dd ipFilteringDD.xml -g -s. 
                    
deploy --target http://localhost:6060/ -j hello.jar 

java examples.HelloService.HelloServiceClient

Undeploy -t http://localhost:6060/ 
    -p http://systinet.com/examples/security/ipFiltering:IPFilteredService

 netaddr & netmask == actual & netmask