Using the Database To Do Too Much - Implementing Database Security and Auditing - page 225

Figure 7.3
SOAP callout
architecture in
Oracle 9i.
stored procedure to metadata that can be used to create the Web services
wrapper. This is not very different from DADX for DB2. You should, how-
ever, be aware of a vulnerability in the SOAP processing layer for Oracle 9i
versions 9.2.0.1 and later. This is documented in Oracle Security Alert #65.
If you don't use SOAP within the database, you should disable this feature
by removing $ORACLE_HOME/soap/lib/soap.jar .
In addition to calling stored procedures within your database through
SOAP, Oracle also supports SOAP callouts, as shown in Figure 7.3. This
means that you can call a Web service from within the database (e.g., from a
stored procedure). This is possible because Oracle runs a Java virtual
machine within the database, and you can load a Web services client stack
into the database. The package will even create a PL/SQL wrapper for you,
making the callout look like a call to a PL/SQL stored procedure.
You can use the Oracle SOAP classes available in the OC4J download.
You can load the classes to the SYS schema using:
loadjava -this -user sys/<pwd>@<host>:<port>:<SID> -resolve -
synonym
$OC4J_HOME/soap/lib/soap.jar
$OC4J_HOME/jlib/javax-ssl-1_1.tar
$OC4J_HOME/lib/servlet.jar
You also have to allow outbound sockets to be created for the user who
will be performing the callout: