Sending Encrypted Binary Messages With PHP Web Services

Web services has made the communication between heterogeneous environments (say PHP with .NET or Java) a reality. It has defines standards for communicate not only with texts but also with binaries. And more importantly you can keep these communication confidential using encrypted messages according to your requirement. In the post "Sending Encrypted Binary Messages With PHP Web Services" , we will look at how we can implement such a system with PHP in one side.

Encrypt and Sign your SOAP messages in PHP

I wrote a blog about How to Encrypt and Sign your SOAP Messages in PHP. You can find out the two basic choices you have in securing soap messages + some links on how to develop them.

How to get the service's X509 certificate?

Many PHP developers who are trying to write a secure PHP client using WSF/PHP, find it a bit difficult to understand "How to obtain the certificate of the service". The service certificate is required to encrypt the content and/or verify the service's signature. The X509 certificate used by the service can be hosted somewhere by the service writer, so that it can be easily downloaded. But in some cases it is not. We are supposed to extract it. This will tell you how to do that.

WSF/PHP : Creating Business-Conscious IT Solutions

See how to here...

What is Missing in PHP SOAP Extension?

Couple of days back, I blogged about the features of SOAP extension. Now, are these features good enough. Yes they sure are for simple SOAP services.

However, simple SOAP services draws much criticism, specially form REST fans. If you want to do only simple stuff with SOAP, why not use REST? I see that to be a valid argument, especially in the PHP world, given that HTTP is the dominant transport.

In fact, the real value of SOAP comes, when things get complex, more enterprise in nature. That is where the QoS comes into play. SOAP is not that much useful, when you want to use the Fliker upload images, you of course and use the REST API. SOAP is useful when you want to send an invoice, that contains special discounted rates, securely to one of your customers. You have to be absolutely sure that only that customer sees it. And may be you are using a spread sheet or a PDF file to record the invoice and you want to send it as it is. This requires the need to send binary attachment with security with SOAP. And if you are lucky, your customer's system too would use PHP, however, in this heterogeneous world, it may well be that the customer is on .NET or using J2EE.  In short, you need a interoperable comprehensive SOAP stack.

PHP SOAP extension is good to get started, to play around with. However, it falls much short in meeting the enterprise demands in the SOA era.

Can you improve it, to support security and binary attachments? Of course you can. However, the concern is that the time it would take to make it interop side by side with .NET and Java implementations. They have taken years to come to that stage. I have seen how much effort has been spent on Apache Axis2/Java and Apache Axis2/C. Even if you have people with right expertise, WS-Security alone would take at least two person years to complete.

It is the WSDL mode that most users love to use. And if you ever have worked with a WSDL tool, you know how hectic it is to support all the user scenarios. Specially the schema support is an endless game. Most of the interop issues pop up with WSDLs. WSDL mode in SOAP extension already have enough interop issues. And there are no plans to support WSDL 2.0. Let alone, the most critical feature to support in WSDL is the WS-Policy support. Specially when WS-Security in in use, the security policies are the way of conveying rules of the level of security to be used and the rules to follow. Even if basic WS-Security is implemented based on some library like xmlsec, supporting policies would require a WS-Policy processing engine. That too will require at least one person year of work.

In summary, it would be years before serious Web services could be implemented with PHP SOAP extension. Web services are complex!

Encrypting SOAP messages using PHP

In this blog I've described how to write a PHP script that uses WSO2 WSF/PHP to do secured web services...