You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by srinivas thallapalli <sr...@gmail.com> on 2011/07/01 13:10:07 UTC
WS-Security Issue with upgrading from CXF 2.3.3. to CXF 2.4.1
Hi All
I am trying to upgrade CXF 2.3.3 to CXF 2.4.1, I am facing some WS-Security
issues with my application which worked fine with 2.3.3. I am using
wss4j-1.6.1.jar which is distributed with CXF 2.4.1. The following is the
exception stack trace.
/Caused by: java.lang.NoSuchMethodError:
org.apache.ws.security.util.WSSecurityUtil.decodeAction(Ljava/lang/String;Ljava/util/List;Lorg/apache/ws/security/WSSConfig;)I
at
org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor$WSS4JOutInterceptorInternal.handleMessage(WSS4JOutInterceptor.java:195)
at
org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor$WSS4JOutInterceptorInternal.handleMessage(WSS4JOutInterceptor.java:136)
at
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:263)
at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:510)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:440)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:343)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:295)
/
can anybody help me.
Thanks
--
View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Issue-with-upgrading-from-CXF-2-3-3-to-CXF-2-4-1-tp4541788p4541788.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: WS-Security Issue with upgrading from CXF 2.3.3. to CXF 2.4.1
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi Srinivas,
You must use the USER property to configure the keystore alias when
you are only doing signature. SIGNATURE_USER comes in to play in the
scenario of (e.g.) a UsernameToken and a Signature, when you specify
the username of the UsernameToken via USER, and the keystore alias via
SIGNATURE_USER. I've tested this in a unit test on trunk and it works
fine:
http://svn.apache.org/viewvc?view=revision&revision=1142961
Could you take a look at the test-case and see if anything jumps out
at you. Failing that, you'll need to supply a test-case to show the
problem.
Colm.
On Mon, Jul 4, 2011 at 12:20 PM, srinivas thallapalli
<sr...@gmail.com> wrote:
> Hi Colm,
>
> Actually I am configuring UsernameToken, Encrypt and Signature standards for
> my cxf webservice.
> With 2.3.7 version of CXF everything working fine. Upgrading to 2.4.1
> causing this issue, the keystores and configurations files are same.
>
> With my investigation, I suspect there is conflict is happening with USER
> and SIGNATURE_USER.
> I am
>
> Tested in following scenarios:
>
> case 1: If I use only Signature standard by passing alias name to
> SIGNATURE_USER, exception coming up
> as *org.apache.cxf.binding.soap.SoapFault: Empty username for
> specified action*. If I
> pass same alias name with USER property, it works fine.
>
> case 2: If I use UsernameToken and Signature by passing USERNAMETOKEN
> username to USER property
> and SIGNATURE aliasname to SIGNATURE_USER. then the original
> issue is reproducible.
>
> So my conclusion is, some how signature alias also reffering to USER
> property, hence there is no private key for usernametoken user in keystore
> and fails.
>
> Please let me know, if any further information is required.
>
> Thanks and Regards
> Srini
>
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Issue-with-upgrading-from-CXF-2-3-3-to-CXF-2-4-1-tp4541788p4549716.html
> Sent from the cxf-user mailing list archive at Nabble.com.
>
--
Colm O hEigeartaigh
http://coheigea.blogspot.com/
Talend - http://www.talend.com
Re: WS-Security Issue with upgrading from CXF 2.3.3. to CXF 2.4.1
Posted by srinivas thallapalli <sr...@gmail.com>.
Hi Colm,
Actually I am configuring UsernameToken, Encrypt and Signature standards for
my cxf webservice.
With 2.3.7 version of CXF everything working fine. Upgrading to 2.4.1
causing this issue, the keystores and configurations files are same.
With my investigation, I suspect there is conflict is happening with USER
and SIGNATURE_USER.
I am
Tested in following scenarios:
case 1: If I use only Signature standard by passing alias name to
SIGNATURE_USER, exception coming up
as *org.apache.cxf.binding.soap.SoapFault: Empty username for
specified action*. If I
pass same alias name with USER property, it works fine.
case 2: If I use UsernameToken and Signature by passing USERNAMETOKEN
username to USER property
and SIGNATURE aliasname to SIGNATURE_USER. then the original
issue is reproducible.
So my conclusion is, some how signature alias also reffering to USER
property, hence there is no private key for usernametoken user in keystore
and fails.
Please let me know, if any further information is required.
Thanks and Regards
Srini
--
View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Issue-with-upgrading-from-CXF-2-3-3-to-CXF-2-4-1-tp4541788p4549716.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: WS-Security Issue with upgrading from CXF 2.3.3. to CXF 2.4.1
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi Srinivas,
It's most probably one of the following scenarios:
1) The keystore alias you have specified is incorrect. Try checking
your keystore, i.e. keytool -list -keystore sws-client-keystore.jks,
and see if the alias you have configured in the properties file is
shown.
2) Check the keystore password is the same as in your properties file
3) Check that you have a CallbackHandler implementation that sets the
password used to access the private key in the keystore.
Failing that, please supply a test-case that reproduces the problem.
Colm.
On Mon, Jul 4, 2011 at 4:55 AM, srinivas thallapalli
<sr...@gmail.com> wrote:
> Hi All,
>
> Any sugesstions on this issue.
>
>
> Thanks
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Issue-with-upgrading-from-CXF-2-3-3-to-CXF-2-4-1-tp4541788p4548938.html
> Sent from the cxf-user mailing list archive at Nabble.com.
>
--
Colm O hEigeartaigh
http://coheigea.blogspot.com/
Talend - http://www.talend.com
Re: WS-Security Issue with upgrading from CXF 2.3.3. to CXF 2.4.1
Posted by srinivas thallapalli <sr...@gmail.com>.
Hi All,
Any sugesstions on this issue.
Thanks
--
View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Issue-with-upgrading-from-CXF-2-3-3-to-CXF-2-4-1-tp4541788p4548938.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: WS-Security Issue with upgrading from CXF 2.3.3. to CXF 2.4.1
Posted by srinivas thallapalli <sr...@gmail.com>.
Hi Colm,
Please have a look at my properties again, I do not have any slashes.
Thanks
--
View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Issue-with-upgrading-from-CXF-2-3-3-to-CXF-2-4-1-tp4541788p4542720.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: WS-Security Issue with upgrading from CXF 2.3.3. to CXF 2.4.1
Posted by Colm O hEigeartaigh <co...@apache.org>.
This looks suspect:
> org.apache.ws.security.crypto.merlin.keystore.alias=/sws-client-privatekey/
Try removing the forward slashes.
Colm.
On Fri, Jul 1, 2011 at 1:16 PM, srinivas thallapalli
<sr...@gmail.com> wrote:
> Hi Colm,
>
> Sincere apologies. I have duplicate classpath entry for wss4j 1.5.10, that
> is the issue.
> On removal of that duplicate entry. I am getting problem with Signature
> while getting private for my alias. This alias is mentioned in configuration
> property file and keystore contains key for this alias.
>
> Here is my property file:
>
> *org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
> org.apache.ws.security.crypto.merlin.keystore.type=jks
> org.apache.ws.security.crypto.merlin.keystore.password=sws-client-storepassword
> org.apache.ws.security.crypto.merlin.keystore.alias=/sws-client-privatekey/
> org.apache.ws.security.crypto.merlin.file=sws-client-keystore.jks*
>
> I heard that there are some changes in properties with wss4j1.6+, please let
> me know whether the above properties are valid or not?
>
> And exception stack trace:
>
>
> /Caused by: org.apache.ws.security.WSSecurityException: Error during
> Signature: ; nested exception is:
> org.apache.ws.security.WSSecurityException: Signature creation failed;
> nested exception is:
> org.apache.ws.security.WSSecurityException: General security error (The
> private key for the supplied alias does not exist in the keystore); nested
> exception is:
> java.security.UnrecoverableKeyException: Cannot recover key
> at
> org.apache.ws.security.action.SignatureAction.execute(SignatureAction.java:64)
> at
> org.apache.ws.security.handler.WSHandler.doSenderAction(WSHandler.java:202)
> at
> org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor.access$200(WSS4JOutInterceptor.java:52)
> at
> org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor$WSS4JOutInterceptorInternal.handleMessage(WSS4JOutInterceptor.java:260)
> ... 10 more
> Caused by: org.apache.ws.security.WSSecurityException: Signature creation
> failed; nested exception is:
> org.apache.ws.security.WSSecurityException: General security error (The
> private key for the supplied alias does not exist in the keystore); nested
> exception is:
> java.security.UnrecoverableKeyException: Cannot recover key
> at
> org.apache.ws.security.message.WSSecSignature.computeSignature(WSSecSignature.java:524)
> at
> org.apache.ws.security.message.WSSecSignature.computeSignature(WSSecSignature.java:447)
> at
> org.apache.ws.security.message.WSSecSignature.build(WSSecSignature.java:353)
> at
> org.apache.ws.security.action.SignatureAction.execute(SignatureAction.java:61)
> ... 13 more
> Caused by: org.apache.ws.security.WSSecurityException: General security
> error (The private key for the supplied alias does not exist in the
> keystore); nested exception is:
> java.security.UnrecoverableKeyException: Cannot recover key
> at
> org.apache.ws.security.components.crypto.Merlin.getPrivateKey(Merlin.java:706)
> at
> org.apache.ws.security.message.WSSecSignature.computeSignature(WSSecSignature.java:470)
> ... 16 more
> Caused by: java.security.UnrecoverableKeyException: Cannot recover key
> at sun.security.provider.KeyProtector.recover(Unknown Source)
> at sun.security.provider.JavaKeyStore.engineGetKey(Unknown Source)
> at java.security.KeyStore.getKey(Unknown Source)
> at
> org.apache.ws.security.components.crypto.Merlin.getPrivateKey(Merlin.java:692)
> ... 17 more
>
> /
>
>
> But Encryption works fine with same kind of properties.
>
>
> Thanks and Regards
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Issue-with-upgrading-from-CXF-2-3-3-to-CXF-2-4-1-tp4541788p4541965.html
> Sent from the cxf-user mailing list archive at Nabble.com.
>
--
Colm O hEigeartaigh
http://coheigea.blogspot.com/
Talend - http://www.talend.com
Re: WS-Security Issue with upgrading from CXF 2.3.3. to CXF 2.4.1
Posted by srinivas thallapalli <sr...@gmail.com>.
Hi Colm,
Sincere apologies. I have duplicate classpath entry for wss4j 1.5.10, that
is the issue.
On removal of that duplicate entry. I am getting problem with Signature
while getting private for my alias. This alias is mentioned in configuration
property file and keystore contains key for this alias.
Here is my property file:
*org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
org.apache.ws.security.crypto.merlin.keystore.type=jks
org.apache.ws.security.crypto.merlin.keystore.password=sws-client-storepassword
org.apache.ws.security.crypto.merlin.keystore.alias=/sws-client-privatekey/
org.apache.ws.security.crypto.merlin.file=sws-client-keystore.jks*
I heard that there are some changes in properties with wss4j1.6+, please let
me know whether the above properties are valid or not?
And exception stack trace:
/Caused by: org.apache.ws.security.WSSecurityException: Error during
Signature: ; nested exception is:
org.apache.ws.security.WSSecurityException: Signature creation failed;
nested exception is:
org.apache.ws.security.WSSecurityException: General security error (The
private key for the supplied alias does not exist in the keystore); nested
exception is:
java.security.UnrecoverableKeyException: Cannot recover key
at
org.apache.ws.security.action.SignatureAction.execute(SignatureAction.java:64)
at
org.apache.ws.security.handler.WSHandler.doSenderAction(WSHandler.java:202)
at
org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor.access$200(WSS4JOutInterceptor.java:52)
at
org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor$WSS4JOutInterceptorInternal.handleMessage(WSS4JOutInterceptor.java:260)
... 10 more
Caused by: org.apache.ws.security.WSSecurityException: Signature creation
failed; nested exception is:
org.apache.ws.security.WSSecurityException: General security error (The
private key for the supplied alias does not exist in the keystore); nested
exception is:
java.security.UnrecoverableKeyException: Cannot recover key
at
org.apache.ws.security.message.WSSecSignature.computeSignature(WSSecSignature.java:524)
at
org.apache.ws.security.message.WSSecSignature.computeSignature(WSSecSignature.java:447)
at
org.apache.ws.security.message.WSSecSignature.build(WSSecSignature.java:353)
at
org.apache.ws.security.action.SignatureAction.execute(SignatureAction.java:61)
... 13 more
Caused by: org.apache.ws.security.WSSecurityException: General security
error (The private key for the supplied alias does not exist in the
keystore); nested exception is:
java.security.UnrecoverableKeyException: Cannot recover key
at
org.apache.ws.security.components.crypto.Merlin.getPrivateKey(Merlin.java:706)
at
org.apache.ws.security.message.WSSecSignature.computeSignature(WSSecSignature.java:470)
... 16 more
Caused by: java.security.UnrecoverableKeyException: Cannot recover key
at sun.security.provider.KeyProtector.recover(Unknown Source)
at sun.security.provider.JavaKeyStore.engineGetKey(Unknown Source)
at java.security.KeyStore.getKey(Unknown Source)
at
org.apache.ws.security.components.crypto.Merlin.getPrivateKey(Merlin.java:692)
... 17 more
/
But Encryption works fine with same kind of properties.
Thanks and Regards
--
View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Issue-with-upgrading-from-CXF-2-3-3-to-CXF-2-4-1-tp4541788p4541965.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: WS-Security Issue with upgrading from CXF 2.3.3. to CXF 2.4.1
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi,
Could you check your classpath again - WSSecurityUtil has the
following method in WSS4J 1.6:
static int decodeAction(java.lang.String action,
java.util.List<java.lang.Integer> actions, WSSConfig wssConfig)
http://ws.apache.org/wss4j/apidocs/org/apache/ws/security/util/WSSecurityUtil.html
Colm.
On Fri, Jul 1, 2011 at 12:10 PM, srinivas thallapalli
<sr...@gmail.com> wrote:
> Hi All
>
> I am trying to upgrade CXF 2.3.3 to CXF 2.4.1, I am facing some WS-Security
> issues with my application which worked fine with 2.3.3. I am using
> wss4j-1.6.1.jar which is distributed with CXF 2.4.1. The following is the
> exception stack trace.
>
> /Caused by: java.lang.NoSuchMethodError:
> org.apache.ws.security.util.WSSecurityUtil.decodeAction(Ljava/lang/String;Ljava/util/List;Lorg/apache/ws/security/WSSConfig;)I
> at
> org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor$WSS4JOutInterceptorInternal.handleMessage(WSS4JOutInterceptor.java:195)
> at
> org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor$WSS4JOutInterceptorInternal.handleMessage(WSS4JOutInterceptor.java:136)
> at
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:263)
> at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:510)
> at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:440)
> at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:343)
> at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:295)
> /
>
> can anybody help me.
>
> Thanks
>
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/WS-Security-Issue-with-upgrading-from-CXF-2-3-3-to-CXF-2-4-1-tp4541788p4541788.html
> Sent from the cxf-user mailing list archive at Nabble.com.
>
--
Colm O hEigeartaigh
http://coheigea.blogspot.com/
Talend - http://www.talend.com