You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by Gina Choi <gi...@gmail.com> on 2012/06/26 00:18:27 UTC
Configuring Fediz IDP with OpenLDAP
Hi All,
I have an OpenLDAP in the cloud and try to configure it with Fediz IDP. I
am following directions in the link http://cxf.apache.org/fediz-idp.html. I
created jaas.config file and set JAVA_OPTS as directed. I updated
cxf-transport.xml file in STS accordingly as directed. I also added
dependencies to STS pom for ldap, but I am getting "The security token
could not be authenticated or authorized" exception. Have anyone configured
Fediz IDP with LDAP directory before? I am going to take a look further
tomorrow, but if anyone have any ideas, please let me know. I don't know if
query request has been sent to LDAP directory yet.
INFO: Inbound Message
----------------------------
ID: 1
Address: https://localhost:9443/fedizidpsts/STSService?wsdl
Http-Method: GET
Content-Type: text/xml
Headers: {Accept=[*/*], cache-control=[no-cache], connection=[keep-alive],
content-type=[text/xml], host=[localhost:9443], pragma=[no-cache], user-age
nt=[Apache CXF 2.6.2-SNAPSHOT]}
--------------------------------------
Jun 25, 2012 5:29:54 PM
org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
INFO: Inbound Message
----------------------------
ID: 2
Address:
https://localhost:9443/fedizidpsts/STSService?wsdl=ws-trust-1.4.wsdl
Http-Method: GET
Content-Type: text/xml
Headers: {Accept=[*/*], cache-control=[no-cache], connection=[keep-alive],
content-type=[text/xml], host=[localhost:9443], pragma=[no-cache], user-age
nt=[Apache CXF 2.6.2-SNAPSHOT]}
--------------------------------------
Jun 25, 2012 5:29:54 PM
org.apache.cxf.ws.policy.AssertionBuilderRegistryImpl
handleNoRegisteredBuilder
WARNING: No assertion builder for type {
http://www.w3.org/2006/05/addressing/wsdl}UsingAddressing registered.
Jun 25, 2012 5:29:55 PM
org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
INFO: Outbound Message
---------------------------
ID: 1
Address: https://localhost:9443/fedizidpsts/STSService
Encoding: UTF-8
Content-Type: text/xml
Headers: {Accept=[*/*], SOAPAction=["
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"]}
Payload: <soap:Envelope xmlns:soap="
http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><wsse:Securityxmlns:wsse="
http://docs.oasis-open.org/wss/
2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
soa
p:mustUnderstand="1"><wsse:UsernameToken
wsu:Id="UsernameToken-1"><wsse:Username>gchoi</wsse:Username><wsse:Password
Type="http://docs.oasis-open.org/
wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">gchoi</wsse:Password></wsse:UsernameToken></wsse:Security></soap:Header><soap:Bo
dy><wst:RequestSecurityToken xmlns:wst="
http://docs.oasis-open.org/ws-sx/ws-trust/200512"><wst:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/2
00512/Issue</wst:RequestType><wsp:AppliesTo xmlns:wsp="
http://schemas.xmlsoap.org/ws/2004/09/policy"><wsa:EndpointReferencexmlns:wsa="
http://www.w3.o
rg/2005/08/addressing"><wsa:Address>
https://wkengchoi.global.sdl.corp:8443/fedizhelloworld/
</wsa:Address></wsa:EndpointReference></wsp:AppliesTo><wst:
TokenType>
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
</wst:TokenType><wst:KeyType>http://docs.oasis-open.org/ws-sx/ws-tru
st/200512/Bearer</wst:KeyType></wst:RequestSecurityToken></soap:Body></soap:Envelope>
--------------------------------------
Jun 25, 2012 5:29:55 PM
org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
INFO: Inbound Message
----------------------------
ID: 3
Address: https://localhost:9443/fedizidpsts/STSService
Encoding: UTF-8
Http-Method: POST
Content-Type: text/xml; charset=UTF-8
Headers: {Accept=[*/*], cache-control=[no-cache], connection=[keep-alive],
Content-Length=[1276], content-type=[text/xml; charset=UTF-8], host=[localh
ost:9443], pragma=[no-cache], SOAPAction=["
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"],
user-agent=[Apache CXF 2.6.2-SNAPSHOT]}
Payload: <soap:Envelope xmlns:soap="
http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><wsse:Securityxmlns:wsse="
http://docs.oasis-open.org/wss/
2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
soa
p:mustUnderstand="1"><wsse:UsernameToken
wsu:Id="UsernameToken-1"><wsse:Username>gchoi</wsse:Username><wsse:Password
Type="http://docs.oasis-open.org/
wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">gchoi</wsse:Password></wsse:UsernameToken></wsse:Security></soap:Header><soap:Bo
dy><wst:RequestSecurityToken xmlns:wst="
http://docs.oasis-open.org/ws-sx/ws-trust/200512"><wst:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/2
00512/Issue</wst:RequestType><wsp:AppliesTo xmlns:wsp="
http://schemas.xmlsoap.org/ws/2004/09/policy"><wsa:EndpointReferencexmlns:wsa="
http://www.w3.o
rg/2005/08/addressing"><wsa:Address>
https://wkengchoi.global.sdl.corp:8443/fedizhelloworld/
</wsa:Address></wsa:EndpointReference></wsp:AppliesTo><wst:
TokenType>
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
</wst:TokenType><wst:KeyType>http://docs.oasis-open.org/ws-sx/ws-tru
st/200512/Bearer</wst:KeyType></wst:RequestSecurityToken></soap:Body></soap:Envelope>
--------------------------------------
SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further
details.
Jun 25, 2012 5:29:55 PM org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
handleMessage
WARNING:
org.apache.ws.security.WSSecurityException: The security token could not be
authenticated or authorized
at
org.apache.ws.security.validate.UsernameTokenValidator.verifyDigestPassword(UsernameTokenValidator.java:189)
at
org.apache.ws.security.validate.UsernameTokenValidator.verifyPlaintextPassword(UsernameTokenValidator.java:142)
at
org.apache.ws.security.validate.UsernameTokenValidator.validate(UsernameTokenValidator.java:100)
at
org.apache.ws.security.processor.UsernameTokenProcessor.handleUsernameToken(UsernameTokenProcessor.java:152)
at
org.apache.ws.security.processor.UsernameTokenProcessor.handleToken(UsernameTokenProcessor.java:66)
at
org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396)
at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:289)
at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:97)
at
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
at
org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:122)
at
org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:211)
at
org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:213)
at
org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:193)
at
org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:129)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:187)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:110)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:641)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:166)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
at
org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
at
org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:307)
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)
Jun 25, 2012 5:29:55 PM org.apache.cxf.phase.PhaseInterceptorChain
doDefaultLogging
WARNING: Interceptor for {
http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService#{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}Is
sue has thrown exception, unwinding now
org.apache.cxf.binding.soap.SoapFault: The security token could not be
authenticated or authorized
at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.createSoapFault(WSS4JInInterceptor.java:780)
at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:357)
at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:97)
at
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
at
org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:122)
at
org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:211)
at
org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:213)
at
org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:193)
at
org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:129)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:187)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:110)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:641)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:166)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
at
org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
at
org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:307)
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)
Caused by: org.apache.ws.security.WSSecurityException: The security token
could not be authenticated or authorized
at
org.apache.ws.security.validate.UsernameTokenValidator.verifyDigestPassword(UsernameTokenValidator.java:189)
at
org.apache.ws.security.validate.UsernameTokenValidator.verifyPlaintextPassword(UsernameTokenValidator.java:142)
at
org.apache.ws.security.validate.UsernameTokenValidator.validate(UsernameTokenValidator.java:100)
at
org.apache.ws.security.processor.UsernameTokenProcessor.handleUsernameToken(UsernameTokenProcessor.java:152)
at
org.apache.ws.security.processor.UsernameTokenProcessor.handleToken(UsernameTokenProcessor.java:66)
at
org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396)
at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:289)
... 27 more
Jun 25, 2012 5:29:55 PM
org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
INFO: Outbound Message
---------------------------
ID: 3
Response-Code: 500
Encoding: UTF-8
Content-Type: text/xml
Headers: {}
Payload: <soap:Envelope xmlns:soap="
http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcodexmlns:ns1="
http://docs.oasis-open.org
/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">ns1:FailedAuthentication</faultcode><faultstring>The
security token could not be authenticate
d or authorized</faultstring></soap:Fault></soap:Body></soap:Envelope>
--------------------------------------
Jun 25, 2012 5:29:55 PM
org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
INFO: Inbound Message
----------------------------
ID: 1
Response-Code: 500
Encoding: UTF-8
Content-Type: text/xml;charset=UTF-8
Headers: {connection=[close], content-type=[text/xml;charset=UTF-8],
Date=[Mon, 25 Jun 2012 21:29:55 GMT], Server=[Apache-Coyote/1.1],
transfer-encodi
ng=[chunked]}
Payload: <soap:Envelope xmlns:soap="
http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcodexmlns:ns1="
http://docs.oasis-open.org
/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">ns1:FailedAuthentication</faultcode><faultstring>The
security token could not be authenticate
d or authorized</faultstring></soap:Fault></soap:Body></soap:Envelope>
--------------------------------------
Jun 25, 2012 5:29:55 PM org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
handleMessage
WARNING: Request does not contain Security header, but it's a fault.
Jun 25, 2012 5:29:55 PM org.apache.cxf.fediz.service.idp.IdpServlet doGet
INFO: Requesting security token failed
org.apache.cxf.binding.soap.SoapFault: The security token could not be
authenticated or authorized
at
org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.unmarshalFault(Soap11FaultInInterceptor.java:75)
at
org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.handleMessage(Soap11FaultInInterceptor.java:46)
at
org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.handleMessage(Soap11FaultInInterceptor.java:35)
at
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
at
org.apache.cxf.interceptor.AbstractFaultChainInitiatorObserver.onMessage(AbstractFaultChainInitiatorObserver.java:113)
at
org.apache.cxf.binding.soap.interceptor.CheckFaultInterceptor.handleMessage(CheckFaultInterceptor.java:69)
at
org.apache.cxf.binding.soap.interceptor.CheckFaultInterceptor.handleMessage(CheckFaultInterceptor.java:34)
at
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
at org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:798)
at
org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:1673)
at
org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponse(HTTPConduit.java:1526)
at
org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1434)
at
org.apache.cxf.io.CacheAndWriteOutputStream.postClose(CacheAndWriteOutputStream.java:47)
at
org.apache.cxf.io.CachedOutputStream.close(CachedOutputStream.java:187)
at
org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)
at
org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:658)
at
org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62)
at
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:532)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:464)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:367)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:320)
at
org.apache.cxf.fediz.service.idp.IdpSTSClient.requestSecurityTokenResponse(IdpSTSClient.java:176)
at
org.apache.cxf.fediz.service.idp.IdpSTSClient.requestSecurityTokenResponse(IdpSTSClient.java:64)
at
org.apache.cxf.fediz.service.idp.IdpServlet.requestSecurityToken(IdpServlet.java:259)
at
org.apache.cxf.fediz.service.idp.IdpServlet.doGet(IdpServlet.java:160)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:621)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
at
org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
at
org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:309)
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)
Re: Configuring Fediz IDP with OpenLDAP
Posted by Gina Choi <gi...@gmail.com>.
Hi Colum/Oliver,
Finally I was able to get attributes from OpenLDAP. My issue was that I
used wkengchoi.global.sdl.corp in fediz_config.xml, but I used localhost in
RPClaims.xml. So, requestedClaims was null since it compares String values.
Some of our products are built in Java and some are .NET. We try to provide
two solutions to our clients. First is ADFS + Active Directory which we
have done with prototype(both .NET and Java). Next is Apache CXF+ Fediz +
OpenLDAP. I am setting up this environment for .NET developer to test
prototype. He will be use WIF to access this environment. From Java point,
I don't see problem.
Anyway, thanks for both of your assistance.
Oliver, to connect to OpenLDAP, I added following jar files. If you update
your Fediz OpenLDAP configuration document, that would be great.
lang-2.1.0.jar
ldapbp-1.0.jar
spring-ldap-1.2.jar
Gina Choi
On Fri, Jun 29, 2012 at 7:35 AM, Gina Choi <gi...@gmail.com> wrote:
> Hmm.. I already have following content in my cxf-transport.xml file.
> Please see attached full version that I have.
>
> <bean id="transportSamlTokenProvider"
> class="org.apache.cxf.sts.token.provider.SAMLTokenProvider">
> <property name="attributeStatementProviders"
> ref="attributeStatementProvidersList" />
> <property name="conditionsProvider" ref="conditionsProvider" />
>
> </bean>
> <util:list id="attributeStatementProvidersList">
> <ref bean="claimsAttributeProvider" />
> </util:list>
> <bean id="claimsAttributeProvider"
> class="org.apache.cxf.sts.claims.ClaimsAttributeStatementProvider" />
>
>
>
> On Thu, Jun 28, 2012 at 6:30 PM, Oliver Wulff <ow...@talend.com> wrote:
>
>> Hi Gina
>>
>> Please ensure to configure the ClaimsAttributeStatementProvider as
>> illustrated in this example:
>>
>> <bean id="transportSamlTokenProvider"
>> class="org.apache.cxf.sts.token.provider.SAMLTokenProvider">
>> <property name="attributeStatementProviders"
>> ref="attributeStatementProvidersList" />
>> </bean>
>> <util:list id="attributeStatementProvidersList">
>> <ref bean="claimAttributeProvider" />
>> </util:list>
>> <bean id="claimAttributeProvider"
>>
>> class="org.apache.cxf.sts.claims.ClaimsAttributeStatementProvider">
>> </bean>
>>
>> I have to add this to the wiki.
>>
>> Thanks
>>
>>
>>
>> ------
>>
>> Oliver Wulff
>>
>> Blog: http://owulff.blogspot.com
>> Solution Architect
>> http://coders.talend.com
>>
>> Talend Application Integration Division http://www.talend.com
>
>
Re: Configuring Fediz IDP with OpenLDAP
Posted by Gina Choi <gi...@gmail.com>.
Hmm.. I already have following content in my cxf-transport.xml file. Please
see attached full version that I have.
<bean id="transportSamlTokenProvider"
class="org.apache.cxf.sts.token.provider.SAMLTokenProvider">
<property name="attributeStatementProviders"
ref="attributeStatementProvidersList" />
<property name="conditionsProvider" ref="conditionsProvider" />
</bean>
<util:list id="attributeStatementProvidersList">
<ref bean="claimsAttributeProvider" />
</util:list>
<bean id="claimsAttributeProvider"
class="org.apache.cxf.sts.claims.ClaimsAttributeStatementProvider" />
On Thu, Jun 28, 2012 at 6:30 PM, Oliver Wulff <ow...@talend.com> wrote:
> Hi Gina
>
> Please ensure to configure the ClaimsAttributeStatementProvider as
> illustrated in this example:
>
> <bean id="transportSamlTokenProvider"
> class="org.apache.cxf.sts.token.provider.SAMLTokenProvider">
> <property name="attributeStatementProviders"
> ref="attributeStatementProvidersList" />
> </bean>
> <util:list id="attributeStatementProvidersList">
> <ref bean="claimAttributeProvider" />
> </util:list>
> <bean id="claimAttributeProvider"
>
> class="org.apache.cxf.sts.claims.ClaimsAttributeStatementProvider">
> </bean>
>
> I have to add this to the wiki.
>
> Thanks
>
>
>
> ------
>
> Oliver Wulff
>
> Blog: http://owulff.blogspot.com
> Solution Architect
> http://coders.talend.com
>
> Talend Application Integration Division http://www.talend.com
RE: Configuring Fediz IDP with OpenLDAP
Posted by Oliver Wulff <ow...@talend.com>.
Hi Gina
Please ensure to configure the ClaimsAttributeStatementProvider as illustrated in this example:
<bean id="transportSamlTokenProvider" class="org.apache.cxf.sts.token.provider.SAMLTokenProvider">
<property name="attributeStatementProviders" ref="attributeStatementProvidersList" />
</bean>
<util:list id="attributeStatementProvidersList">
<ref bean="claimAttributeProvider" />
</util:list>
<bean id="claimAttributeProvider"
class="org.apache.cxf.sts.claims.ClaimsAttributeStatementProvider">
</bean>
I have to add this to the wiki.
Thanks
------
Oliver Wulff
Blog: http://owulff.blogspot.com
Solution Architect
http://coders.talend.com
Talend Application Integration Division http://www.talend.com
________________________________________
From: Gina Choi [ginachoi88@gmail.com]
Sent: 28 June 2012 23:27
To: coheigea@apache.org
Cc: users@cxf.apache.org
Subject: Re: Configuring Fediz IDP with OpenLDAP
So, I got OpenLDAP working and user is authenticated an got back RSTR. Only
problem is that I don't see expected Attributes in the AttributeStatement
of the RSTR.
1. Following is part of my RSTR token which contains AttributeStatement. I
supposed to have First Name, Last Name, Email and Role instead of
'authenticated'.
<saml2:AudienceRestriction>
<saml2:Audience>
https://wkengchoi.global.sdl.corp:8443/fedizhelloworld/</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AttributeStatement>
<saml2:Attribute Name="token-requestor"
NameFormat="http://cxf.apache.org/sts">
<saml2:AttributeValue xsi:type="xs:string">
authenticated</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
</RequestedSecurityToken>
2. I have following configured in RPClaims.xml on IDP.
<util:map id="realm2ClaimsMap">
<entry key=http://localhost:8080/fedizhelloworldother/
value-ref="claimsWsfedhelloworld" />
<entry key=http://localhost:8080/fedizhelloworld/
value-ref="claimsWsfedhelloworld2" />
<entry key="*https://localhost:8443/fedizhelloworld*/"
value-ref="*claimsWsfedhelloworld2*" />
</util:map>
<util:list id="claimsWsfedhelloworld"> <value>
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname</value>
<value>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname</value>
</util:list>
<util:list id="*claimsWsfedhelloworld2*"> <value>
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname</value>
<value>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname</value>
<value>
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress</value>
<value>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role
</value>
</util:list>
3. And I have following content in cxf-transport.xml
<util:map id="claimsToLdapAttributeMapping">
<entry key="
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
value="givenName" />
<entry key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
value="sn" />
<entry key="
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
value="mail" />
<entry key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role"
value="title" />
</util:map>
<bean id="ldapClaimsHandler"
class="org.apache.cxf.sts.claims.LdapClaimsHandler">
<property name="ldapTemplate" ref="ldapTemplate" />
<property name="claimsLdapAttributeMapping"
ref="claimsToLdapAttributeMapping" />
<property name="userBaseDN" value="ou=People,dc=maxcrc,dc=com" />
</bean>
4. And I was able to get back attributes using following test code.
NamingEnumeration srchResponse = ctx.search(base, searchFilter, controls);
if (srchResponse != null) {
SearchResult searchResult = (SearchResult) srchResponse.next();
if (searchResult != null) {
String distName = (String) searchResult.getAttributes().get("mail").get();
String email = (String) searchResult.getAttributes().get("cn").get();
String lastName = (String) searchResult.getAttributes().get("sn").get();
String firstName = (String)
searchResult.getAttributes().get("givenName").get();
String title = (String) searchResult.getAttributes().get("title").get();
}
}
Am I missing any configuration steps?
Thanks.
Gina Choi
On Thu, Jun 28, 2012 at 9:03 AM, Gina Choi <gi...@gmail.com> wrote:
> You are right. In test code, I used root level user and password and I
> thought if root level binding works, regular user login wouldn't be a
> problem.
> I found following from Internet.
> *********
> Any LDAP authentication -routine typically contain *two* binds, not just
> one. The first bind
> should be as a service account (probably better not to use the directory
> Manager account) which does the search for the user's DN.
> The second bind actually binds as the user with the password given, so
> you don't need to compare anything. The directory simply returns
> authentication success or failure.
> ************
> So, I used attached code tested user "gchoi" and I got [LDAP: error code
> 49 - Invalid Credentials]. I even changed password for user "gchoi" and
> tried with other user credentials, but it is still the same. So, I have to
> fix this issue first. This must be something to do with OpenLDAP
> installation.
> On Wed, Jun 27, 2012 at 5:19 AM, Colm O hEigeartaigh <co...@apache.org>wrote:
>
>>
>> You don't appear to be using the username "gchoi" in the java test code?
>> Are you sure this username/password is correct?
>>
>> Colm.
>
>
Re: Configuring Fediz IDP with OpenLDAP
Posted by Gina Choi <gi...@gmail.com>.
So, I got OpenLDAP working and user is authenticated an got back RSTR. Only
problem is that I don't see expected Attributes in the AttributeStatement
of the RSTR.
1. Following is part of my RSTR token which contains AttributeStatement. I
supposed to have First Name, Last Name, Email and Role instead of
'authenticated'.
<saml2:AudienceRestriction>
<saml2:Audience>
https://wkengchoi.global.sdl.corp:8443/fedizhelloworld/</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AttributeStatement>
<saml2:Attribute Name="token-requestor"
NameFormat="http://cxf.apache.org/sts">
<saml2:AttributeValue xsi:type="xs:string">
authenticated</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
</RequestedSecurityToken>
2. I have following configured in RPClaims.xml on IDP.
<util:map id="realm2ClaimsMap">
<entry key=http://localhost:8080/fedizhelloworldother/
value-ref="claimsWsfedhelloworld" />
<entry key=http://localhost:8080/fedizhelloworld/
value-ref="claimsWsfedhelloworld2" />
<entry key="*https://localhost:8443/fedizhelloworld*/"
value-ref="*claimsWsfedhelloworld2*" />
</util:map>
<util:list id="claimsWsfedhelloworld"> <value>
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname</value>
<value>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname</value>
</util:list>
<util:list id="*claimsWsfedhelloworld2*"> <value>
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname</value>
<value>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname</value>
<value>
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress</value>
<value>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role
</value>
</util:list>
3. And I have following content in cxf-transport.xml
<util:map id="claimsToLdapAttributeMapping">
<entry key="
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
value="givenName" />
<entry key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
value="sn" />
<entry key="
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
value="mail" />
<entry key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role"
value="title" />
</util:map>
<bean id="ldapClaimsHandler"
class="org.apache.cxf.sts.claims.LdapClaimsHandler">
<property name="ldapTemplate" ref="ldapTemplate" />
<property name="claimsLdapAttributeMapping"
ref="claimsToLdapAttributeMapping" />
<property name="userBaseDN" value="ou=People,dc=maxcrc,dc=com" />
</bean>
4. And I was able to get back attributes using following test code.
NamingEnumeration srchResponse = ctx.search(base, searchFilter, controls);
if (srchResponse != null) {
SearchResult searchResult = (SearchResult) srchResponse.next();
if (searchResult != null) {
String distName = (String) searchResult.getAttributes().get("mail").get();
String email = (String) searchResult.getAttributes().get("cn").get();
String lastName = (String) searchResult.getAttributes().get("sn").get();
String firstName = (String)
searchResult.getAttributes().get("givenName").get();
String title = (String) searchResult.getAttributes().get("title").get();
}
}
Am I missing any configuration steps?
Thanks.
Gina Choi
On Thu, Jun 28, 2012 at 9:03 AM, Gina Choi <gi...@gmail.com> wrote:
> You are right. In test code, I used root level user and password and I
> thought if root level binding works, regular user login wouldn't be a
> problem.
> I found following from Internet.
> *********
> Any LDAP authentication -routine typically contain *two* binds, not just
> one. The first bind
> should be as a service account (probably better not to use the directory
> Manager account) which does the search for the user's DN.
> The second bind actually binds as the user with the password given, so
> you don't need to compare anything. The directory simply returns
> authentication success or failure.
> ************
> So, I used attached code tested user "gchoi" and I got [LDAP: error code
> 49 - Invalid Credentials]. I even changed password for user "gchoi" and
> tried with other user credentials, but it is still the same. So, I have to
> fix this issue first. This must be something to do with OpenLDAP
> installation.
> On Wed, Jun 27, 2012 at 5:19 AM, Colm O hEigeartaigh <co...@apache.org>wrote:
>
>>
>> You don't appear to be using the username "gchoi" in the java test code?
>> Are you sure this username/password is correct?
>>
>> Colm.
>
>
Re: Configuring Fediz IDP with OpenLDAP
Posted by Gina Choi <gi...@gmail.com>.
You are right. In test code, I used root level user and password and I
thought if root level binding works, regular user login wouldn't be a
problem.
I found following from Internet.
*********
Any LDAP authentication -routine typically contain *two* binds, not just
one. The first bind
should be as a service account (probably better not to use the directory
Manager account) which does the search for the user's DN.
The second bind actually binds as the user with the password given, so you
don't need to compare anything. The directory simply returns authentication
success or failure.
************
So, I used attached code tested user "gchoi" and I got [LDAP: error code 49
- Invalid Credentials]. I even changed password for user "gchoi" and tried
with other user credentials, but it is still the same. So, I have to fix
this issue first. This must be something to do with OpenLDAP installation.
On Wed, Jun 27, 2012 at 5:19 AM, Colm O hEigeartaigh <co...@apache.org>wrote:
>
> You don't appear to be using the username "gchoi" in the java test code?
> Are you sure this username/password is correct?
>
> Colm.
Re: Configuring Fediz IDP with OpenLDAP
Posted by Colm O hEigeartaigh <co...@apache.org>.
You don't appear to be using the username "gchoi" in the java test code?
Are you sure this username/password is correct?
Colm.
On Tue, Jun 26, 2012 at 10:27 PM, Gina Choi <gi...@gmail.com> wrote:
> <<<
> You're missing a quotation mark in your jaas configuration in the
> userProvider value.
> >>>
> Nice catch! Thanks. I passed previous exception. I wasn't sure if OpenLDAP
> in the cloud working properly, so used attached Java code tested it, but I
> was getting connection timeout. So, I switched to OpenLDAP installed in
> internal network and I was able to list people in the directory using same
> java code. So, this internal OpenDirectory is working, but when I try with
> Fediz IDP, I am getting "LDAP: error code 49 - Invalid Credentials" error.
> It looks like that arguments aren't passed correctly when get Directory
> Context. I couldn't get source code for JRE rt.jar for debugging. I may
> need to enable logging for OpenLDAP.
>
> Following is error message that I received.
>
> ----------- Error Message -----------------
>
> SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further
> details.
> [LdapLoginModule] authentication-only mode; SSL disabled
> [LdapLoginModule] user provider:
> ldap://wkqasv0805.global.sdl.corp:389/ou=people,dc=sct,dc=sdl,dc=corp
> [LdapLoginModule] attempting to authenticate user: gchoi
> [LdapLoginModule] authentication failed
> [LdapLoginModule] aborted authentication
> Jun 26, 2012 3:52:24 PM
> org.apache.ws.security.validate.JAASUsernameTokenValidator validate
> INFO: Authentication failed
> javax.security.auth.login.FailedLoginException: Cannot bind to LDAP server
> at
>
> com.sun.security.auth.module.LdapLoginModule.attemptAuthentication(LdapLoginModule.java:756)
> at
>
> com.sun.security.auth.module.LdapLoginModule.login(LdapLoginModule.java:551)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at
>
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
> at
>
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
> at java.lang.reflect.Method.invoke(Method.java:597)
> at
> javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
> at
> javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
> at
> javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
> at java.security.AccessController.doPrivileged(Native Method)
> at
> javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
> at
> javax.security.auth.login.LoginContext.login(LoginContext.java:579)
> at
>
> org.apache.ws.security.validate.JAASUsernameTokenValidator.validate(JAASUsernameTokenValidator.java:104)
> at
>
> org.apache.ws.security.processor.UsernameTokenProcessor.handleUsernameToken(UsernameTokenProcessor.java:152)
> at
>
> org.apache.ws.security.processor.UsernameTokenProcessor.handleToken(UsernameTokenProcessor.java:66)
> at
>
> org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396)
> at
>
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:289)
> at
>
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:97)
> at
>
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
> at
>
> org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:122)
> at
>
> org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:211)
> at
>
> org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:213)
> at
>
> org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:193)
> at
>
> org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:129)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:187)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:110)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:641)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:166)
> at
>
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
> at
>
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> at
>
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
> at
>
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
> at
>
> org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
> at
>
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
> at
>
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
> at
> org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
> at
>
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
> at
>
> org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
> at
>
> org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
> at
>
> org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:307)
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
> at java.lang.Thread.run(Thread.java:662)
> Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 -
> Invalid Credentials]
> at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3041)
> at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987)
> at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2789)
> at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2703)
> at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:293)
> at
> com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
> at
> com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
> at
>
> com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
> at
> com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
> at
> javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
> at
> javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
> at javax.naming.InitialContext.init(InitialContext.java:223)
> at
> javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:134)
> at
>
> com.sun.security.auth.module.LdapLoginModule.attemptAuthentication(LdapLoginModule.java:753)
> ... 43 more
> Jun 26, 2012 3:52:24 PM org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
> handleMessage
> WARNING:
> org.apache.ws.security.WSSecurityException: The security token could not be
> authenticated or authorized
> at
>
> org.apache.ws.security.validate.JAASUsernameTokenValidator.validate(JAASUsernameTokenValidator.java:109)
> at
>
> org.apache.ws.security.processor.UsernameTokenProcessor.handleUsernameToken(UsernameTokenProcessor.java:152)
> at
>
> org.apache.ws.security.processor.UsernameTokenProcessor.handleToken(UsernameTokenProcessor.java:66)
> at
>
> org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396)
> at
>
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:289)
> at
>
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:97)
> at
>
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
> at
>
> org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:122)
> at
>
> org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:211)
> at
>
> org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:213)
> at
>
> org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:193)
> at
>
> org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:129)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:187)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:110)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:641)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:166)
> at
>
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
> at
>
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> at
>
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
> at
>
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
> at
>
> org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
> at
>
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
> at
>
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
> at
> org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
> at
>
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
> at
>
> org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
> at
>
> org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
> at
>
> org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:307)
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
> at java.lang.Thread.run(Thread.java:662)
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: Configuring Fediz IDP with OpenLDAP
Posted by Gina Choi <gi...@gmail.com>.
<<<
You're missing a quotation mark in your jaas configuration in the
userProvider value.
>>>
Nice catch! Thanks. I passed previous exception. I wasn't sure if OpenLDAP
in the cloud working properly, so used attached Java code tested it, but I
was getting connection timeout. So, I switched to OpenLDAP installed in
internal network and I was able to list people in the directory using same
java code. So, this internal OpenDirectory is working, but when I try with
Fediz IDP, I am getting "LDAP: error code 49 - Invalid Credentials" error.
It looks like that arguments aren't passed correctly when get Directory
Context. I couldn't get source code for JRE rt.jar for debugging. I may
need to enable logging for OpenLDAP.
Following is error message that I received.
----------- Error Message -----------------
SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further
details.
[LdapLoginModule] authentication-only mode; SSL disabled
[LdapLoginModule] user provider:
ldap://wkqasv0805.global.sdl.corp:389/ou=people,dc=sct,dc=sdl,dc=corp
[LdapLoginModule] attempting to authenticate user: gchoi
[LdapLoginModule] authentication failed
[LdapLoginModule] aborted authentication
Jun 26, 2012 3:52:24 PM
org.apache.ws.security.validate.JAASUsernameTokenValidator validate
INFO: Authentication failed
javax.security.auth.login.FailedLoginException: Cannot bind to LDAP server
at
com.sun.security.auth.module.LdapLoginModule.attemptAuthentication(LdapLoginModule.java:756)
at
com.sun.security.auth.module.LdapLoginModule.login(LdapLoginModule.java:551)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at
javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
at
javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
at
javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
at java.security.AccessController.doPrivileged(Native Method)
at
javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
at
javax.security.auth.login.LoginContext.login(LoginContext.java:579)
at
org.apache.ws.security.validate.JAASUsernameTokenValidator.validate(JAASUsernameTokenValidator.java:104)
at
org.apache.ws.security.processor.UsernameTokenProcessor.handleUsernameToken(UsernameTokenProcessor.java:152)
at
org.apache.ws.security.processor.UsernameTokenProcessor.handleToken(UsernameTokenProcessor.java:66)
at
org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396)
at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:289)
at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:97)
at
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
at
org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:122)
at
org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:211)
at
org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:213)
at
org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:193)
at
org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:129)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:187)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:110)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:641)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:166)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
at
org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
at
org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:307)
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)
Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 -
Invalid Credentials]
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3041)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2789)
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2703)
at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:293)
at
com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
at
com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
at
com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
at
com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
at
javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
at
javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
at javax.naming.InitialContext.init(InitialContext.java:223)
at
javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:134)
at
com.sun.security.auth.module.LdapLoginModule.attemptAuthentication(LdapLoginModule.java:753)
... 43 more
Jun 26, 2012 3:52:24 PM org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
handleMessage
WARNING:
org.apache.ws.security.WSSecurityException: The security token could not be
authenticated or authorized
at
org.apache.ws.security.validate.JAASUsernameTokenValidator.validate(JAASUsernameTokenValidator.java:109)
at
org.apache.ws.security.processor.UsernameTokenProcessor.handleUsernameToken(UsernameTokenProcessor.java:152)
at
org.apache.ws.security.processor.UsernameTokenProcessor.handleToken(UsernameTokenProcessor.java:66)
at
org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396)
at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:289)
at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:97)
at
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
at
org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:122)
at
org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:211)
at
org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:213)
at
org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:193)
at
org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:129)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:187)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:110)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:641)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:166)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
at
org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
at
org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:307)
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)
Re: Configuring Fediz IDP with OpenLDAP
Posted by Colm O hEigeartaigh <co...@apache.org>.
You're missing a quotation mark in your jaas configuration in the
userProvider value.
Colm.
On Tue, Jun 26, 2012 at 2:12 PM, Gina Choi <gi...@gmail.com> wrote:
> Hi Colum,
>
> Thanks for your response.
> <<<<
> It doesn't look like you followed the steps correctly, as the WSS4J
> UsernameTokenValidator is throwing the exception. You need to replace this
> (default) Validator with the JAAS one, as per the configuration give in
> http://cxf.apache.org/fediz-idp.html:
> >>>>
> Actually I have jaasUTValidator in my configuration file as follow.
> However, I got hint from your "need to replace" words and commented
> out original jaxws:endpoint(id="transportSTS1).
>
> <!--jaxws:endpoint id="transportSTS1"
> implementor="#transportSTSProviderBean"
> address="/STSService"
> wsdlLocation="/WEB-INF/wsdl/ws-trust-1.4-service.wsdl"
> xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/"
> serviceName="ns1:SecurityTokenService"
> endpointName="ns1:TransportUT_Port">
> <jaxws:properties>
> <entry key="ws-security.callback-handler" value-ref="upCallBackHandler"
> />
> </jaxws:properties>
> </jaxws:endpoint-->
>
> <jaxws:endpoint id="transportSTSUT"
> endpointName="ns1:TransportUT_Port"
> serviceName="ns1:SecurityTokenService"
> xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/"
> wsdlLocation="/WEB-INF/wsdl/ws-trust-1.4-service.wsdl"
> address="/STSService"
> implementor="#transportSTSProviderBean">
> <jaxws:properties>
> <entry key="ws-security.ut.validator"
> value-ref="jaasUTValidator"/>
> </jaxws:properties>
> </jaxws:endpoint>
> Now, at least it try to use JAASUsernameTokenValidator.
>
> ID: 1
> Address: https://localhost:9443/fedizidpsts/STSService?wsdl
> Http-Method: GET
> Content-Type: text/xml
> Headers: {Accept=[*/*], cache-control=[no-cache], connection=[keep-alive],
> content-type=[text/xml], host=[localhost:9443], pragma=[no-cache], user-age
> nt=[Apache CXF 2.6.2-SNAPSHOT]}
> --------------------------------------
> Jun 26, 2012 8:44:30 AM
> org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
> INFO: Inbound Message
> ----------------------------
> ID: 2
> Address:
> https://localhost:9443/fedizidpsts/STSService?wsdl=ws-trust-1.4.wsdl
> Http-Method: GET
> Content-Type: text/xml
> Headers: {Accept=[*/*], cache-control=[no-cache], connection=[keep-alive],
> content-type=[text/xml], host=[localhost:9443], pragma=[no-cache], user-age
> nt=[Apache CXF 2.6.2-SNAPSHOT]}
> --------------------------------------
> Jun 26, 2012 8:44:30 AM
> org.apache.cxf.ws.policy.AssertionBuilderRegistryImpl
> handleNoRegisteredBuilder
> WARNING: No assertion builder for type {
> http://www.w3.org/2006/05/addressing/wsdl}UsingAddressing registered.
> Jun 26, 2012 8:44:30 AM
> org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
> INFO: Outbound Message
> ---------------------------
> ID: 1
> Address: https://localhost:9443/fedizidpsts/STSService
> Encoding: UTF-8
> Content-Type: text/xml
> Headers: {Accept=[*/*], SOAPAction=["
> http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"]}
> Payload: <soap:Envelope xmlns:soap="
> http://schemas.xmlsoap.org/soap/envelope/
> "><soap:Header><wsse:Securityxmlns:wsse="
> http://docs.oasis-open.org/wss/
> 2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="
>
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> "
> soa
> p:mustUnderstand="1"><wsse:UsernameToken
> wsu:Id="UsernameToken-1"><wsse:Username>gchoi</wsse:Username><wsse:Password
> Type="http://docs.oasis-open.org/
>
> wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">gchoi</wsse:Password></wsse:UsernameToken></wsse:Security></soap:Header><soap:Bo
> dy><wst:RequestSecurityToken xmlns:wst="
> http://docs.oasis-open.org/ws-sx/ws-trust/200512"><wst:RequestType>
> http://docs.oasis-open.org/ws-sx/ws-trust/2
> 00512/Issue</wst:RequestType><wsp:AppliesTo xmlns:wsp="
> http://schemas.xmlsoap.org/ws/2004/09/policy
> "><wsa:EndpointReferencexmlns:wsa="
> http://www.w3.o
> rg/2005/08/addressing"><wsa:Address>
> https://wkengchoi.global.sdl.corp:8443/fedizhelloworld/
> </wsa:Address></wsa:EndpointReference></wsp:AppliesTo><wst:
> TokenType>
> http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
> </wst:TokenType><wst:KeyType>http://docs.oasis-open.org/ws-sx/ws-tru
> st/200512/Bearer
> </wst:KeyType></wst:RequestSecurityToken></soap:Body></soap:Envelope>
> --------------------------------------
> Jun 26, 2012 8:44:30 AM
> org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
> INFO: Inbound Message
> ----------------------------
> ID: 3
> Address: https://localhost:9443/fedizidpsts/STSService
> Encoding: UTF-8
> Http-Method: POST
> Content-Type: text/xml; charset=UTF-8
> Headers: {Accept=[*/*], cache-control=[no-cache], connection=[keep-alive],
> Content-Length=[1276], content-type=[text/xml; charset=UTF-8], host=[localh
> ost:9443], pragma=[no-cache], SOAPAction=["
> http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"],
> user-agent=[Apache CXF 2.6.2-SNAPSHOT]}
> Payload: <soap:Envelope xmlns:soap="
> http://schemas.xmlsoap.org/soap/envelope/
> "><soap:Header><wsse:Securityxmlns:wsse="
> http://docs.oasis-open.org/wss/
> 2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="
>
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> "
> soa
> p:mustUnderstand="1"><wsse:UsernameToken
> wsu:Id="UsernameToken-1"><wsse:Username>gchoi</wsse:Username><wsse:Password
> Type="http://docs.oasis-open.org/
>
> wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">gchoi</wsse:Password></wsse:UsernameToken></wsse:Security></soap:Header><soap:Bo
> dy><wst:RequestSecurityToken xmlns:wst="
> http://docs.oasis-open.org/ws-sx/ws-trust/200512"><wst:RequestType>
> http://docs.oasis-open.org/ws-sx/ws-trust/2
> 00512/Issue</wst:RequestType><wsp:AppliesTo xmlns:wsp="
> http://schemas.xmlsoap.org/ws/2004/09/policy
> "><wsa:EndpointReferencexmlns:wsa="
> http://www.w3.o
> rg/2005/08/addressing"><wsa:Address>
> https://wkengchoi.global.sdl.corp:8443/fedizhelloworld/
> </wsa:Address></wsa:EndpointReference></wsp:AppliesTo><wst:
> TokenType>
> http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
> </wst:TokenType><wst:KeyType>http://docs.oasis-open.org/ws-sx/ws-tru
> st/200512/Bearer
> </wst:KeyType></wst:RequestSecurityToken></soap:Body></soap:Envelope>
> --------------------------------------
> SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
> SLF4J: Defaulting to no-operation (NOP) logger implementation
> SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further
> details.
> Jun 26, 2012 8:44:31 AM org.apache.cxf.phase.PhaseInterceptorChain
> doDefaultLogging
> WARNING: Interceptor for {
>
> http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService#{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}Is
> sue has thrown exception, unwinding now
> java.lang.SecurityException: Configuration Error:
> Line 2: expected [option key], found [null]
> at com.sun.security.auth.login.ConfigFile.<init>(ConfigFile.java:93)
> at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
> Method)
> at
>
> sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
> at
>
> sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
> at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
> at java.lang.Class.newInstance0(Class.java:355)
> at java.lang.Class.newInstance(Class.java:308)
> at
> javax.security.auth.login.Configuration$3.run(Configuration.java:247)
> at java.security.AccessController.doPrivileged(Native Method)
> at
>
> javax.security.auth.login.Configuration.getConfiguration(Configuration.java:242)
> at
> javax.security.auth.login.LoginContext$1.run(LoginContext.java:237)
> at java.security.AccessController.doPrivileged(Native Method)
> at
> javax.security.auth.login.LoginContext.init(LoginContext.java:234)
> at
> javax.security.auth.login.LoginContext.<init>(LoginContext.java:403)
> at
>
> org.apache.ws.security.validate.JAASUsernameTokenValidator.validate(JAASUsernameTokenValidator.java:103)
> at
>
> org.apache.ws.security.processor.UsernameTokenProcessor.handleUsernameToken(UsernameTokenProcessor.java:152)
> at
>
> org.apache.ws.security.processor.UsernameTokenProcessor.handleToken(UsernameTokenProcessor.java:66)
> at
>
> org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396)
> at
>
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:289)
> at
>
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:97)
> at
>
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
> at
>
> org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:122)
> at
>
> org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:211)
> at
>
> org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:213)
> at
>
> org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:193)
> at
>
> org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:129)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:187)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:110)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:641)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:166)
> at
>
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
> at
>
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> at
>
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
> at
>
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
> at
>
> org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
> at
>
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
> at
>
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
> at
> org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
> at
>
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
> at
>
> org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
> at
>
> org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
> at
>
> org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:307)
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
> at java.lang.Thread.run(Thread.java:662)
> Caused by: java.io.IOException: Configuration Error:
> Line 2: expected [option key], found [null]
> at com.sun.security.auth.login.ConfigFile.match(ConfigFile.java:543)
> at
> com.sun.security.auth.login.ConfigFile.parseLoginEntry(ConfigFile.java:406)
> at
> com.sun.security.auth.login.ConfigFile.readConfig(ConfigFile.java:350)
> at com.sun.security.auth.login.ConfigFile.init(ConfigFile.java:262)
> at com.sun.security.auth.login.ConfigFile.init(ConfigFile.java:202)
> at com.sun.security.auth.login.ConfigFile.<init>(ConfigFile.java:91)
> ... 45 more
> Jun 26, 2012 8:44:31 AM
> org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
> INFO: Outbound Message
> ---------------------------
> ID: 3
> Response-Code: 500
> Encoding: UTF-8
> Content-Type: text/xml
> Headers: {}
> Payload: <soap:Envelope xmlns:soap="
> http://schemas.xmlsoap.org/soap/envelope/
> "><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>C
> onfiguration Error:
> Line 2: expected [option key], found
> [null]</faultstring></soap:Fault></soap:Body></soap:Envelope>
> --------------------------------------
> Jun 26, 2012 8:44:31 AM
> org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
> INFO: Inbound Message
> ----------------------------
> ID: 1
> Response-Code: 500
> Encoding: UTF-8
> Content-Type: text/xml;charset=UTF-8
> Headers: {connection=[close], content-type=[text/xml;charset=UTF-8],
> Date=[Tue, 26 Jun 2012 12:44:31 GMT], Server=[Apache-Coyote/1.1],
> transfer-encodi
> ng=[chunked]}
> Payload: <soap:Envelope xmlns:soap="
> http://schemas.xmlsoap.org/soap/envelope/
> "><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>C
> onfiguration Error:
> Line 2: expected [option key], found
> [null]</faultstring></soap:Fault></soap:Body></soap:Envelope>
> --------------------------------------
> Jun 26, 2012 8:44:31 AM org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
> handleMessage
> WARNING: Request does not contain Security header, but it's a fault.
> Jun 26, 2012 8:44:31 AM org.apache.cxf.fediz.service.idp.IdpServlet doGet
> INFO: Requesting security token failed
> org.apache.cxf.binding.soap.SoapFault: Configuration Error:
> Line 2: expected [option key], found [null]
> at
>
> org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.unmarshalFault(Soap11FaultInInterceptor.java:75)
> at
>
> org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.handleMessage(Soap11FaultInInterceptor.java:46)
> at
>
> org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.handleMessage(Soap11FaultInInterceptor.java:35)
> at
>
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
> at
>
> org.apache.cxf.interceptor.AbstractFaultChainInitiatorObserver.onMessage(AbstractFaultChainInitiatorObserver.java:113)
> at
>
> org.apache.cxf.binding.soap.interceptor.CheckFaultInterceptor.handleMessage(CheckFaultInterceptor.java:69)
> at
>
> org.apache.cxf.binding.soap.interceptor.CheckFaultInterceptor.handleMessage(CheckFaultInterceptor.java:34)
> at
>
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
> at org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:798)
> at
>
> org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:1673)
> at
>
> org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponse(HTTPConduit.java:1526)
> at
>
> org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1434)
> at
>
> org.apache.cxf.io.CacheAndWriteOutputStream.postClose(CacheAndWriteOutputStream.java:47)
> at
> org.apache.cxf.io.CachedOutputStream.close(CachedOutputStream.java:187)
> at
> org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)
> at
> org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:658)
> at
>
> org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62)
> at
>
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
> at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:532)
> at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:464)
> at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:367)
> at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:320)
> at
>
> org.apache.cxf.fediz.service.idp.IdpSTSClient.requestSecurityTokenResponse(IdpSTSClient.java:176)
> at
>
> org.apache.cxf.fediz.service.idp.IdpSTSClient.requestSecurityTokenResponse(IdpSTSClient.java:64)
> at
>
> org.apache.cxf.fediz.service.idp.IdpServlet.requestSecurityToken(IdpServlet.java:259)
> at
> org.apache.cxf.fediz.service.idp.IdpServlet.doGet(IdpServlet.java:160)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:621)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
> at
>
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
> at
>
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> at
>
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
> at
>
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
> at
>
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
> at
>
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
> at
> org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
> at
>
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
> at
>
> org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
> at
>
> org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
> at
>
> org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:309)
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
> at java.lang.Thread.run(Thread.java:662)
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: Configuring Fediz IDP with OpenLDAP
Posted by Gina Choi <gi...@gmail.com>.
Hi Colum,
Thanks for your response.
<<<<
It doesn't look like you followed the steps correctly, as the WSS4J
UsernameTokenValidator is throwing the exception. You need to replace this
(default) Validator with the JAAS one, as per the configuration give in
http://cxf.apache.org/fediz-idp.html:
>>>>
Actually I have jaasUTValidator in my configuration file as follow.
However, I got hint from your "need to replace" words and commented
out original jaxws:endpoint(id="transportSTS1).
<!--jaxws:endpoint id="transportSTS1"
implementor="#transportSTSProviderBean"
address="/STSService"
wsdlLocation="/WEB-INF/wsdl/ws-trust-1.4-service.wsdl"
xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/"
serviceName="ns1:SecurityTokenService"
endpointName="ns1:TransportUT_Port">
<jaxws:properties>
<entry key="ws-security.callback-handler" value-ref="upCallBackHandler"
/>
</jaxws:properties>
</jaxws:endpoint-->
<jaxws:endpoint id="transportSTSUT"
endpointName="ns1:TransportUT_Port"
serviceName="ns1:SecurityTokenService"
xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/"
wsdlLocation="/WEB-INF/wsdl/ws-trust-1.4-service.wsdl"
address="/STSService"
implementor="#transportSTSProviderBean">
<jaxws:properties>
<entry key="ws-security.ut.validator"
value-ref="jaasUTValidator"/>
</jaxws:properties>
</jaxws:endpoint>
Now, at least it try to use JAASUsernameTokenValidator.
ID: 1
Address: https://localhost:9443/fedizidpsts/STSService?wsdl
Http-Method: GET
Content-Type: text/xml
Headers: {Accept=[*/*], cache-control=[no-cache], connection=[keep-alive],
content-type=[text/xml], host=[localhost:9443], pragma=[no-cache], user-age
nt=[Apache CXF 2.6.2-SNAPSHOT]}
--------------------------------------
Jun 26, 2012 8:44:30 AM
org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
INFO: Inbound Message
----------------------------
ID: 2
Address:
https://localhost:9443/fedizidpsts/STSService?wsdl=ws-trust-1.4.wsdl
Http-Method: GET
Content-Type: text/xml
Headers: {Accept=[*/*], cache-control=[no-cache], connection=[keep-alive],
content-type=[text/xml], host=[localhost:9443], pragma=[no-cache], user-age
nt=[Apache CXF 2.6.2-SNAPSHOT]}
--------------------------------------
Jun 26, 2012 8:44:30 AM
org.apache.cxf.ws.policy.AssertionBuilderRegistryImpl
handleNoRegisteredBuilder
WARNING: No assertion builder for type {
http://www.w3.org/2006/05/addressing/wsdl}UsingAddressing registered.
Jun 26, 2012 8:44:30 AM
org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
INFO: Outbound Message
---------------------------
ID: 1
Address: https://localhost:9443/fedizidpsts/STSService
Encoding: UTF-8
Content-Type: text/xml
Headers: {Accept=[*/*], SOAPAction=["
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"]}
Payload: <soap:Envelope xmlns:soap="
http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><wsse:Securityxmlns:wsse="
http://docs.oasis-open.org/wss/
2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
soa
p:mustUnderstand="1"><wsse:UsernameToken
wsu:Id="UsernameToken-1"><wsse:Username>gchoi</wsse:Username><wsse:Password
Type="http://docs.oasis-open.org/
wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">gchoi</wsse:Password></wsse:UsernameToken></wsse:Security></soap:Header><soap:Bo
dy><wst:RequestSecurityToken xmlns:wst="
http://docs.oasis-open.org/ws-sx/ws-trust/200512"><wst:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/2
00512/Issue</wst:RequestType><wsp:AppliesTo xmlns:wsp="
http://schemas.xmlsoap.org/ws/2004/09/policy"><wsa:EndpointReferencexmlns:wsa="
http://www.w3.o
rg/2005/08/addressing"><wsa:Address>
https://wkengchoi.global.sdl.corp:8443/fedizhelloworld/
</wsa:Address></wsa:EndpointReference></wsp:AppliesTo><wst:
TokenType>
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
</wst:TokenType><wst:KeyType>http://docs.oasis-open.org/ws-sx/ws-tru
st/200512/Bearer</wst:KeyType></wst:RequestSecurityToken></soap:Body></soap:Envelope>
--------------------------------------
Jun 26, 2012 8:44:30 AM
org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
INFO: Inbound Message
----------------------------
ID: 3
Address: https://localhost:9443/fedizidpsts/STSService
Encoding: UTF-8
Http-Method: POST
Content-Type: text/xml; charset=UTF-8
Headers: {Accept=[*/*], cache-control=[no-cache], connection=[keep-alive],
Content-Length=[1276], content-type=[text/xml; charset=UTF-8], host=[localh
ost:9443], pragma=[no-cache], SOAPAction=["
http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"],
user-agent=[Apache CXF 2.6.2-SNAPSHOT]}
Payload: <soap:Envelope xmlns:soap="
http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><wsse:Securityxmlns:wsse="
http://docs.oasis-open.org/wss/
2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
soa
p:mustUnderstand="1"><wsse:UsernameToken
wsu:Id="UsernameToken-1"><wsse:Username>gchoi</wsse:Username><wsse:Password
Type="http://docs.oasis-open.org/
wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">gchoi</wsse:Password></wsse:UsernameToken></wsse:Security></soap:Header><soap:Bo
dy><wst:RequestSecurityToken xmlns:wst="
http://docs.oasis-open.org/ws-sx/ws-trust/200512"><wst:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/2
00512/Issue</wst:RequestType><wsp:AppliesTo xmlns:wsp="
http://schemas.xmlsoap.org/ws/2004/09/policy"><wsa:EndpointReferencexmlns:wsa="
http://www.w3.o
rg/2005/08/addressing"><wsa:Address>
https://wkengchoi.global.sdl.corp:8443/fedizhelloworld/
</wsa:Address></wsa:EndpointReference></wsp:AppliesTo><wst:
TokenType>
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
</wst:TokenType><wst:KeyType>http://docs.oasis-open.org/ws-sx/ws-tru
st/200512/Bearer</wst:KeyType></wst:RequestSecurityToken></soap:Body></soap:Envelope>
--------------------------------------
SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further
details.
Jun 26, 2012 8:44:31 AM org.apache.cxf.phase.PhaseInterceptorChain
doDefaultLogging
WARNING: Interceptor for {
http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService#{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}Is
sue has thrown exception, unwinding now
java.lang.SecurityException: Configuration Error:
Line 2: expected [option key], found [null]
at com.sun.security.auth.login.ConfigFile.<init>(ConfigFile.java:93)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
Method)
at
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
at
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
at java.lang.Class.newInstance0(Class.java:355)
at java.lang.Class.newInstance(Class.java:308)
at
javax.security.auth.login.Configuration$3.run(Configuration.java:247)
at java.security.AccessController.doPrivileged(Native Method)
at
javax.security.auth.login.Configuration.getConfiguration(Configuration.java:242)
at
javax.security.auth.login.LoginContext$1.run(LoginContext.java:237)
at java.security.AccessController.doPrivileged(Native Method)
at
javax.security.auth.login.LoginContext.init(LoginContext.java:234)
at
javax.security.auth.login.LoginContext.<init>(LoginContext.java:403)
at
org.apache.ws.security.validate.JAASUsernameTokenValidator.validate(JAASUsernameTokenValidator.java:103)
at
org.apache.ws.security.processor.UsernameTokenProcessor.handleUsernameToken(UsernameTokenProcessor.java:152)
at
org.apache.ws.security.processor.UsernameTokenProcessor.handleToken(UsernameTokenProcessor.java:66)
at
org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396)
at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:289)
at
org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:97)
at
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
at
org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:122)
at
org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:211)
at
org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:213)
at
org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:193)
at
org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:129)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:187)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:110)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:641)
at
org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:166)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
at
org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
at
org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:307)
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)
Caused by: java.io.IOException: Configuration Error:
Line 2: expected [option key], found [null]
at com.sun.security.auth.login.ConfigFile.match(ConfigFile.java:543)
at
com.sun.security.auth.login.ConfigFile.parseLoginEntry(ConfigFile.java:406)
at
com.sun.security.auth.login.ConfigFile.readConfig(ConfigFile.java:350)
at com.sun.security.auth.login.ConfigFile.init(ConfigFile.java:262)
at com.sun.security.auth.login.ConfigFile.init(ConfigFile.java:202)
at com.sun.security.auth.login.ConfigFile.<init>(ConfigFile.java:91)
... 45 more
Jun 26, 2012 8:44:31 AM
org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
INFO: Outbound Message
---------------------------
ID: 3
Response-Code: 500
Encoding: UTF-8
Content-Type: text/xml
Headers: {}
Payload: <soap:Envelope xmlns:soap="
http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>C
onfiguration Error:
Line 2: expected [option key], found
[null]</faultstring></soap:Fault></soap:Body></soap:Envelope>
--------------------------------------
Jun 26, 2012 8:44:31 AM
org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
INFO: Inbound Message
----------------------------
ID: 1
Response-Code: 500
Encoding: UTF-8
Content-Type: text/xml;charset=UTF-8
Headers: {connection=[close], content-type=[text/xml;charset=UTF-8],
Date=[Tue, 26 Jun 2012 12:44:31 GMT], Server=[Apache-Coyote/1.1],
transfer-encodi
ng=[chunked]}
Payload: <soap:Envelope xmlns:soap="
http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>C
onfiguration Error:
Line 2: expected [option key], found
[null]</faultstring></soap:Fault></soap:Body></soap:Envelope>
--------------------------------------
Jun 26, 2012 8:44:31 AM org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
handleMessage
WARNING: Request does not contain Security header, but it's a fault.
Jun 26, 2012 8:44:31 AM org.apache.cxf.fediz.service.idp.IdpServlet doGet
INFO: Requesting security token failed
org.apache.cxf.binding.soap.SoapFault: Configuration Error:
Line 2: expected [option key], found [null]
at
org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.unmarshalFault(Soap11FaultInInterceptor.java:75)
at
org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.handleMessage(Soap11FaultInInterceptor.java:46)
at
org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.handleMessage(Soap11FaultInInterceptor.java:35)
at
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
at
org.apache.cxf.interceptor.AbstractFaultChainInitiatorObserver.onMessage(AbstractFaultChainInitiatorObserver.java:113)
at
org.apache.cxf.binding.soap.interceptor.CheckFaultInterceptor.handleMessage(CheckFaultInterceptor.java:69)
at
org.apache.cxf.binding.soap.interceptor.CheckFaultInterceptor.handleMessage(CheckFaultInterceptor.java:34)
at
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
at org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:798)
at
org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:1673)
at
org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponse(HTTPConduit.java:1526)
at
org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1434)
at
org.apache.cxf.io.CacheAndWriteOutputStream.postClose(CacheAndWriteOutputStream.java:47)
at
org.apache.cxf.io.CachedOutputStream.close(CachedOutputStream.java:187)
at
org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)
at
org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:658)
at
org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62)
at
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:532)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:464)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:367)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:320)
at
org.apache.cxf.fediz.service.idp.IdpSTSClient.requestSecurityTokenResponse(IdpSTSClient.java:176)
at
org.apache.cxf.fediz.service.idp.IdpSTSClient.requestSecurityTokenResponse(IdpSTSClient.java:64)
at
org.apache.cxf.fediz.service.idp.IdpServlet.requestSecurityToken(IdpServlet.java:259)
at
org.apache.cxf.fediz.service.idp.IdpServlet.doGet(IdpServlet.java:160)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:621)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
at
org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
at
org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:309)
at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)
Re: Configuring Fediz IDP with OpenLDAP
Posted by Colm O hEigeartaigh <co...@apache.org>.
> . I updated cxf-transport.xml file in STS accordingly as directed.
It doesn't look like you followed the steps correctly, as the WSS4J
UsernameTokenValidator is throwing the exception. You need to replace this
(default) Validator with the JAAS one, as per the configuration give in
http://cxf.apache.org/fediz-idp.html:
<bean
class="org.apache.ws.security.validate.JAASUsernameTokenValidator"
id="jaasUTValidator">
<property name="contextName" value="myldap"/></bean>
<jaxws:endpoint id="transportSTSUT"
endpointName="ns1:TransportUT_Port"
serviceName="ns1:SecurityTokenService"
xmlns:ns1=http://docs.oasis-open.org/ws-sx/ws-trust/200512/
wsdlLocation="/WEB-INF/wsdl/ws-trust-1.4-service.wsdl"
address="/STSServiceTransportUT"
implementor="#transportSTSProviderBean">
<jaxws:properties>
<entry key="ws-security.ut.validator"
value-ref="jaasUTValidator"/>
</jaxws:properties></jaxws:endpoint>
Colm.
On Mon, Jun 25, 2012 at 11:18 PM, Gina Choi <gi...@gmail.com> wrote:
> Hi All,
>
> I have an OpenLDAP in the cloud and try to configure it with Fediz IDP. I
> am following directions in the link http://cxf.apache.org/fediz-idp.html.
> I
> created jaas.config file and set JAVA_OPTS as directed. I updated
> cxf-transport.xml file in STS accordingly as directed. I also added
> dependencies to STS pom for ldap, but I am getting "The security token
> could not be authenticated or authorized" exception. Have anyone configured
> Fediz IDP with LDAP directory before? I am going to take a look further
> tomorrow, but if anyone have any ideas, please let me know. I don't know if
> query request has been sent to LDAP directory yet.
>
>
> INFO: Inbound Message
> ----------------------------
> ID: 1
> Address: https://localhost:9443/fedizidpsts/STSService?wsdl
> Http-Method: GET
> Content-Type: text/xml
> Headers: {Accept=[*/*], cache-control=[no-cache], connection=[keep-alive],
> content-type=[text/xml], host=[localhost:9443], pragma=[no-cache], user-age
> nt=[Apache CXF 2.6.2-SNAPSHOT]}
> --------------------------------------
> Jun 25, 2012 5:29:54 PM
> org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
> INFO: Inbound Message
> ----------------------------
> ID: 2
> Address:
> https://localhost:9443/fedizidpsts/STSService?wsdl=ws-trust-1.4.wsdl
> Http-Method: GET
> Content-Type: text/xml
> Headers: {Accept=[*/*], cache-control=[no-cache], connection=[keep-alive],
> content-type=[text/xml], host=[localhost:9443], pragma=[no-cache], user-age
> nt=[Apache CXF 2.6.2-SNAPSHOT]}
> --------------------------------------
> Jun 25, 2012 5:29:54 PM
> org.apache.cxf.ws.policy.AssertionBuilderRegistryImpl
> handleNoRegisteredBuilder
> WARNING: No assertion builder for type {
> http://www.w3.org/2006/05/addressing/wsdl}UsingAddressing registered.
> Jun 25, 2012 5:29:55 PM
> org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
> INFO: Outbound Message
> ---------------------------
> ID: 1
> Address: https://localhost:9443/fedizidpsts/STSService
> Encoding: UTF-8
> Content-Type: text/xml
> Headers: {Accept=[*/*], SOAPAction=["
> http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"]}
> Payload: <soap:Envelope xmlns:soap="
> http://schemas.xmlsoap.org/soap/envelope/
> "><soap:Header><wsse:Securityxmlns:wsse="
> http://docs.oasis-open.org/wss/
> 2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="
>
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> "
> soa
> p:mustUnderstand="1"><wsse:UsernameToken
> wsu:Id="UsernameToken-1"><wsse:Username>gchoi</wsse:Username><wsse:Password
> Type="http://docs.oasis-open.org/
>
> wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">gchoi</wsse:Password></wsse:UsernameToken></wsse:Security></soap:Header><soap:Bo
> dy><wst:RequestSecurityToken xmlns:wst="
> http://docs.oasis-open.org/ws-sx/ws-trust/200512"><wst:RequestType>
> http://docs.oasis-open.org/ws-sx/ws-trust/2
> 00512/Issue</wst:RequestType><wsp:AppliesTo xmlns:wsp="
> http://schemas.xmlsoap.org/ws/2004/09/policy
> "><wsa:EndpointReferencexmlns:wsa="
> http://www.w3.o
> rg/2005/08/addressing"><wsa:Address>
> https://wkengchoi.global.sdl.corp:8443/fedizhelloworld/
> </wsa:Address></wsa:EndpointReference></wsp:AppliesTo><wst:
> TokenType>
> http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
> </wst:TokenType><wst:KeyType>http://docs.oasis-open.org/ws-sx/ws-tru
> st/200512/Bearer
> </wst:KeyType></wst:RequestSecurityToken></soap:Body></soap:Envelope>
> --------------------------------------
> Jun 25, 2012 5:29:55 PM
> org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
> INFO: Inbound Message
> ----------------------------
> ID: 3
> Address: https://localhost:9443/fedizidpsts/STSService
> Encoding: UTF-8
> Http-Method: POST
> Content-Type: text/xml; charset=UTF-8
> Headers: {Accept=[*/*], cache-control=[no-cache], connection=[keep-alive],
> Content-Length=[1276], content-type=[text/xml; charset=UTF-8], host=[localh
> ost:9443], pragma=[no-cache], SOAPAction=["
> http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue"],
> user-agent=[Apache CXF 2.6.2-SNAPSHOT]}
> Payload: <soap:Envelope xmlns:soap="
> http://schemas.xmlsoap.org/soap/envelope/
> "><soap:Header><wsse:Securityxmlns:wsse="
> http://docs.oasis-open.org/wss/
> 2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="
>
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
> "
> soa
> p:mustUnderstand="1"><wsse:UsernameToken
> wsu:Id="UsernameToken-1"><wsse:Username>gchoi</wsse:Username><wsse:Password
> Type="http://docs.oasis-open.org/
>
> wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">gchoi</wsse:Password></wsse:UsernameToken></wsse:Security></soap:Header><soap:Bo
> dy><wst:RequestSecurityToken xmlns:wst="
> http://docs.oasis-open.org/ws-sx/ws-trust/200512"><wst:RequestType>
> http://docs.oasis-open.org/ws-sx/ws-trust/2
> 00512/Issue</wst:RequestType><wsp:AppliesTo xmlns:wsp="
> http://schemas.xmlsoap.org/ws/2004/09/policy
> "><wsa:EndpointReferencexmlns:wsa="
> http://www.w3.o
> rg/2005/08/addressing"><wsa:Address>
> https://wkengchoi.global.sdl.corp:8443/fedizhelloworld/
> </wsa:Address></wsa:EndpointReference></wsp:AppliesTo><wst:
> TokenType>
> http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
> </wst:TokenType><wst:KeyType>http://docs.oasis-open.org/ws-sx/ws-tru
> st/200512/Bearer
> </wst:KeyType></wst:RequestSecurityToken></soap:Body></soap:Envelope>
> --------------------------------------
> SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
> SLF4J: Defaulting to no-operation (NOP) logger implementation
> SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further
> details.
> Jun 25, 2012 5:29:55 PM org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
> handleMessage
> WARNING:
> org.apache.ws.security.WSSecurityException: The security token could not be
> authenticated or authorized
> at
>
> org.apache.ws.security.validate.UsernameTokenValidator.verifyDigestPassword(UsernameTokenValidator.java:189)
> at
>
> org.apache.ws.security.validate.UsernameTokenValidator.verifyPlaintextPassword(UsernameTokenValidator.java:142)
> at
>
> org.apache.ws.security.validate.UsernameTokenValidator.validate(UsernameTokenValidator.java:100)
> at
>
> org.apache.ws.security.processor.UsernameTokenProcessor.handleUsernameToken(UsernameTokenProcessor.java:152)
> at
>
> org.apache.ws.security.processor.UsernameTokenProcessor.handleToken(UsernameTokenProcessor.java:66)
> at
>
> org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396)
> at
>
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:289)
> at
>
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:97)
> at
>
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
> at
>
> org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:122)
> at
>
> org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:211)
> at
>
> org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:213)
> at
>
> org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:193)
> at
>
> org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:129)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:187)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:110)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:641)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:166)
> at
>
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
> at
>
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> at
>
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
> at
>
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
> at
>
> org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
> at
>
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
> at
>
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
> at
> org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
> at
>
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
> at
>
> org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
> at
>
> org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
> at
>
> org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:307)
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
> at java.lang.Thread.run(Thread.java:662)
> Jun 25, 2012 5:29:55 PM org.apache.cxf.phase.PhaseInterceptorChain
> doDefaultLogging
> WARNING: Interceptor for {
>
> http://docs.oasis-open.org/ws-sx/ws-trust/200512/}SecurityTokenService#{http://docs.oasis-open.org/ws-sx/ws-trust/200512/}Is
> sue has thrown exception, unwinding now
> org.apache.cxf.binding.soap.SoapFault: The security token could not be
> authenticated or authorized
> at
>
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.createSoapFault(WSS4JInInterceptor.java:780)
> at
>
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:357)
> at
>
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:97)
> at
>
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
> at
>
> org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:122)
> at
>
> org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:211)
> at
>
> org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:213)
> at
>
> org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:193)
> at
>
> org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:129)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:187)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:110)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:641)
> at
>
> org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:166)
> at
>
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
> at
>
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> at
>
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
> at
>
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
> at
>
> org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
> at
>
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
> at
>
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
> at
> org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
> at
>
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
> at
>
> org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
> at
>
> org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
> at
>
> org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:307)
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
> at java.lang.Thread.run(Thread.java:662)
> Caused by: org.apache.ws.security.WSSecurityException: The security token
> could not be authenticated or authorized
> at
>
> org.apache.ws.security.validate.UsernameTokenValidator.verifyDigestPassword(UsernameTokenValidator.java:189)
> at
>
> org.apache.ws.security.validate.UsernameTokenValidator.verifyPlaintextPassword(UsernameTokenValidator.java:142)
> at
>
> org.apache.ws.security.validate.UsernameTokenValidator.validate(UsernameTokenValidator.java:100)
> at
>
> org.apache.ws.security.processor.UsernameTokenProcessor.handleUsernameToken(UsernameTokenProcessor.java:152)
> at
>
> org.apache.ws.security.processor.UsernameTokenProcessor.handleToken(UsernameTokenProcessor.java:66)
> at
>
> org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396)
> at
>
> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:289)
> ... 27 more
> Jun 25, 2012 5:29:55 PM
> org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
> INFO: Outbound Message
> ---------------------------
> ID: 3
> Response-Code: 500
> Encoding: UTF-8
> Content-Type: text/xml
> Headers: {}
> Payload: <soap:Envelope xmlns:soap="
> http://schemas.xmlsoap.org/soap/envelope/
> "><soap:Body><soap:Fault><faultcodexmlns:ns1="
> http://docs.oasis-open.org
>
> /wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">ns1:FailedAuthentication</faultcode><faultstring>The
> security token could not be authenticate
> d or authorized</faultstring></soap:Fault></soap:Body></soap:Envelope>
> --------------------------------------
> Jun 25, 2012 5:29:55 PM
> org.apache.cxf.services.SecurityTokenService.TransportUT_Port.STS
> INFO: Inbound Message
> ----------------------------
> ID: 1
> Response-Code: 500
> Encoding: UTF-8
> Content-Type: text/xml;charset=UTF-8
> Headers: {connection=[close], content-type=[text/xml;charset=UTF-8],
> Date=[Mon, 25 Jun 2012 21:29:55 GMT], Server=[Apache-Coyote/1.1],
> transfer-encodi
> ng=[chunked]}
> Payload: <soap:Envelope xmlns:soap="
> http://schemas.xmlsoap.org/soap/envelope/
> "><soap:Body><soap:Fault><faultcodexmlns:ns1="
> http://docs.oasis-open.org
>
> /wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">ns1:FailedAuthentication</faultcode><faultstring>The
> security token could not be authenticate
> d or authorized</faultstring></soap:Fault></soap:Body></soap:Envelope>
> --------------------------------------
> Jun 25, 2012 5:29:55 PM org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
> handleMessage
> WARNING: Request does not contain Security header, but it's a fault.
> Jun 25, 2012 5:29:55 PM org.apache.cxf.fediz.service.idp.IdpServlet doGet
> INFO: Requesting security token failed
> org.apache.cxf.binding.soap.SoapFault: The security token could not be
> authenticated or authorized
> at
>
> org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.unmarshalFault(Soap11FaultInInterceptor.java:75)
> at
>
> org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.handleMessage(Soap11FaultInInterceptor.java:46)
> at
>
> org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.handleMessage(Soap11FaultInInterceptor.java:35)
> at
>
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
> at
>
> org.apache.cxf.interceptor.AbstractFaultChainInitiatorObserver.onMessage(AbstractFaultChainInitiatorObserver.java:113)
> at
>
> org.apache.cxf.binding.soap.interceptor.CheckFaultInterceptor.handleMessage(CheckFaultInterceptor.java:69)
> at
>
> org.apache.cxf.binding.soap.interceptor.CheckFaultInterceptor.handleMessage(CheckFaultInterceptor.java:34)
> at
>
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
> at org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:798)
> at
>
> org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:1673)
> at
>
> org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponse(HTTPConduit.java:1526)
> at
>
> org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1434)
> at
>
> org.apache.cxf.io.CacheAndWriteOutputStream.postClose(CacheAndWriteOutputStream.java:47)
> at
> org.apache.cxf.io.CachedOutputStream.close(CachedOutputStream.java:187)
> at
> org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)
> at
> org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:658)
> at
>
> org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62)
> at
>
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
> at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:532)
> at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:464)
> at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:367)
> at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:320)
> at
>
> org.apache.cxf.fediz.service.idp.IdpSTSClient.requestSecurityTokenResponse(IdpSTSClient.java:176)
> at
>
> org.apache.cxf.fediz.service.idp.IdpSTSClient.requestSecurityTokenResponse(IdpSTSClient.java:64)
> at
>
> org.apache.cxf.fediz.service.idp.IdpServlet.requestSecurityToken(IdpServlet.java:259)
> at
> org.apache.cxf.fediz.service.idp.IdpServlet.doGet(IdpServlet.java:160)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:621)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
> at
>
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
> at
>
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> at
>
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
> at
>
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
> at
>
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
> at
>
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
> at
> org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
> at
>
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
> at
>
> org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
> at
>
> org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
> at
>
> org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:309)
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
> at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
> at java.lang.Thread.run(Thread.java:662)
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com