You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@servicemix.apache.org by Jens Willhardt <jw...@googlemail.com> on 2008/07/16 16:18:33 UTC
Cxf security problem
Hi,
We have CXF Provider component witch uses Security Interceptor -
WSS4JInInterceptor for the incoming messages(Response) from Axis2 server
The incoming message looks as follows:
Payload: <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xenc="
http://www.w3.org/2001/04/xmlenc#"><soapenv:Header>
<wsse:Security xmlns:wsse="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
soapenv:mustUnderstand="1"><xenc:EncryptedKey Id="EncKeyId-25228613">
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"
/>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<wsse:SecurityTokenReference><wsse:KeyIdentifier EncodingType="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
ValueType="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier
">amyJMqOXoch5Z5N5VuYSWR7ZrWQ=</wsse:KeyIdentifier></wsse:SecurityTokenReference>
</ds:KeyInfo>
……………………………………………...
The WSS4JInInterceptor complains with the following:
16.07.2008 15:57:28 org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
handleMessage
WARNUNG: Request does not contain required Security header
16.07.2008 15:57:28 org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
handleMessage
WARNUNG:
org.apache.ws.security.WSSecurityException: An error was discovered
processing the <wsse:Security> header
It seams that the SAAJInInterceptor does not prepare the wssw:Security
element in the DOM tree !?!
Is there anybody who can help us?
Re: Cxf security problem
Posted by Freeman Fang <fr...@gmail.com>.
Hi Jens,
The problem get resolved, [1] track this issue.
[1]https://issues.apache.org/activemq/browse/SM-1471
Cheers
Freeman
Freeman Fang wrote:
> Hi,
>
> Looks like a bug.
> Would you please fill a jira for this issue.
>
> Thanks
>
> Freeman
>
> Jens Willhardt wrote:
>> Hi,
>>
>> I am using the last version 4.0-SNAPSHOT, wich invokes automaticaly the
>> SAAJInInterceptor.
>> the problem is the same if I have the interceptor in the configuration
>>
>>
>>
>> 2008/7/18 Freeman Fang <fr...@gmail.com>:
>>
>>
>
>>> Hi,
>>> From your xbean configuration, you comment out SAAJInInterceptor.
>>>
>>> Which Servicemix version you are using? Since for servicemix 3.2.2
>>> snapshot
>>> we still use cxf 2.0.x which means SAAJInInterceptor is needed here.
>>>
>>> Could you try with adding SAAJInInterceptor back?
>>>
>>>
>>> Freeman
>>>
>>> Jens Willhardt wrote:
>>>
>>>
>>>> Hi,
>>>> do you have something new about the problem I reported ?
>>>>
>>>>
>>>> 2008/7/17 Jens Willhardt <jw...@googlemail.com>:
>>>>
>>>>
>>>>
>>>>
>>>>> Hi,
>>>>>
>>>>> for cxf bus we don't have cxf.xml (use the deafaults)
>>>>> The xbean.xml and Wsdl without the .xsd are in the attachment
>>>>>
>>>>> 2008/7/16 Freeman Fang <fr...@gmail.com>:
>>>>>
>>>>> Hi,
>>>>>
>>>>>
>>>>>
>>>>>> What's the configuration for the cxf bc provider? If possible please
>>>>>> append the xbean.xml, the configuration for cxf bus and wsdl you are
>>>>>> using.
>>>>>>
>>>>>> Freeman
>>>>>>
>>>>>>
>>>>>> Jens Willhardt wrote:
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>>
>>>>>>> We have CXF Provider component witch uses Security Interceptor -
>>>>>>> WSS4JInInterceptor for the incoming messages(Response) from Axis2
>>>>>>> server
>>>>>>> The incoming message looks as follows:
>>>>>>>
>>>>>>> Payload: <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope
>>>>>>> xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
>>>>>>> xmlns:xenc="
>>>>>>> http://www.w3.org/2001/04/xmlenc#"><soapenv:Header>
>>>>>>> <wsse:Security xmlns:wsse="
>>>>>>>
>>>>>>>
>>>>>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
>>>>>>>
>>>>>>> "
>>>>>>> soapenv:mustUnderstand="1"><xenc:EncryptedKey
>>>>>>> Id="EncKeyId-25228613">
>>>>>>> <xenc:EncryptionMethod Algorithm="
>>>>>>> http://www.w3.org/2001/04/xmlenc#rsa-1_5"
>>>>>>> />
>>>>>>> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>>>>>>> <wsse:SecurityTokenReference><wsse:KeyIdentifier EncodingType="
>>>>>>>
>>>>>>>
>>>>>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
>>>>>>>
>>>>>>> "
>>>>>>> ValueType="
>>>>>>>
>>>>>>>
>>>>>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> ">amyJMqOXoch5Z5N5VuYSWR7ZrWQ=</wsse:KeyIdentifier></wsse:SecurityTokenReference>
>>>>>>>
>>>>>>> </ds:KeyInfo>
>>>>>>> ……………………………………………...
>>>>>>>
>>>>>>> The WSS4JInInterceptor complains with the following:
>>>>>>>
>>>>>>> 16.07.2008 15:57:28
>>>>>>> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
>>>>>>> handleMessage
>>>>>>> WARNUNG: Request does not contain required Security header
>>>>>>> 16.07.2008 15:57:28
>>>>>>> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
>>>>>>> handleMessage
>>>>>>> WARNUNG:
>>>>>>> org.apache.ws.security.WSSecurityException: An error was discovered
>>>>>>> processing the <wsse:Security> header
>>>>>>>
>>>>>>>
>>>>>>> It seams that the SAAJInInterceptor does not prepare the
>>>>>>> wssw:Security
>>>>>>> element in the DOM tree !?!
>>>>>>>
>>>>>>> Is there anybody who can help us?
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>
>>>>
>>>
>>
>>
>
>
Re: Cxf security problem
Posted by Freeman Fang <fr...@gmail.com>.
Hi,
Looks like a bug.
Would you please fill a jira for this issue.
Thanks
Freeman
Jens Willhardt wrote:
> Hi,
>
> I am using the last version 4.0-SNAPSHOT, wich invokes automaticaly the
> SAAJInInterceptor.
> the problem is the same if I have the interceptor in the configuration
>
>
>
> 2008/7/18 Freeman Fang <fr...@gmail.com>:
>
>
>> Hi,
>> From your xbean configuration, you comment out SAAJInInterceptor.
>>
>> Which Servicemix version you are using? Since for servicemix 3.2.2 snapshot
>> we still use cxf 2.0.x which means SAAJInInterceptor is needed here.
>>
>> Could you try with adding SAAJInInterceptor back?
>>
>>
>> Freeman
>>
>> Jens Willhardt wrote:
>>
>>
>>> Hi,
>>> do you have something new about the problem I reported ?
>>>
>>>
>>> 2008/7/17 Jens Willhardt <jw...@googlemail.com>:
>>>
>>>
>>>
>>>
>>>> Hi,
>>>>
>>>> for cxf bus we don't have cxf.xml (use the deafaults)
>>>> The xbean.xml and Wsdl without the .xsd are in the attachment
>>>>
>>>> 2008/7/16 Freeman Fang <fr...@gmail.com>:
>>>>
>>>> Hi,
>>>>
>>>>
>>>>
>>>>> What's the configuration for the cxf bc provider? If possible please
>>>>> append the xbean.xml, the configuration for cxf bus and wsdl you are
>>>>> using.
>>>>>
>>>>> Freeman
>>>>>
>>>>>
>>>>> Jens Willhardt wrote:
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>> Hi,
>>>>>>
>>>>>>
>>>>>> We have CXF Provider component witch uses Security Interceptor -
>>>>>> WSS4JInInterceptor for the incoming messages(Response) from Axis2
>>>>>> server
>>>>>> The incoming message looks as follows:
>>>>>>
>>>>>> Payload: <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope
>>>>>> xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xenc="
>>>>>> http://www.w3.org/2001/04/xmlenc#"><soapenv:Header>
>>>>>> <wsse:Security xmlns:wsse="
>>>>>>
>>>>>>
>>>>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
>>>>>> "
>>>>>> soapenv:mustUnderstand="1"><xenc:EncryptedKey Id="EncKeyId-25228613">
>>>>>> <xenc:EncryptionMethod Algorithm="
>>>>>> http://www.w3.org/2001/04/xmlenc#rsa-1_5"
>>>>>> />
>>>>>> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>>>>>> <wsse:SecurityTokenReference><wsse:KeyIdentifier EncodingType="
>>>>>>
>>>>>>
>>>>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
>>>>>> "
>>>>>> ValueType="
>>>>>>
>>>>>>
>>>>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier
>>>>>>
>>>>>>
>>>>>> ">amyJMqOXoch5Z5N5VuYSWR7ZrWQ=</wsse:KeyIdentifier></wsse:SecurityTokenReference>
>>>>>> </ds:KeyInfo>
>>>>>> ……………………………………………...
>>>>>>
>>>>>> The WSS4JInInterceptor complains with the following:
>>>>>>
>>>>>> 16.07.2008 15:57:28 org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
>>>>>> handleMessage
>>>>>> WARNUNG: Request does not contain required Security header
>>>>>> 16.07.2008 15:57:28 org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
>>>>>> handleMessage
>>>>>> WARNUNG:
>>>>>> org.apache.ws.security.WSSecurityException: An error was discovered
>>>>>> processing the <wsse:Security> header
>>>>>>
>>>>>>
>>>>>> It seams that the SAAJInInterceptor does not prepare the wssw:Security
>>>>>> element in the DOM tree !?!
>>>>>>
>>>>>> Is there anybody who can help us?
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>
>>>
>>
>
>
Re: Cxf security problem
Posted by Jens Willhardt <jw...@googlemail.com>.
Hi,
I am using the last version 4.0-SNAPSHOT, wich invokes automaticaly the
SAAJInInterceptor.
the problem is the same if I have the interceptor in the configuration
2008/7/18 Freeman Fang <fr...@gmail.com>:
> Hi,
> From your xbean configuration, you comment out SAAJInInterceptor.
>
> Which Servicemix version you are using? Since for servicemix 3.2.2 snapshot
> we still use cxf 2.0.x which means SAAJInInterceptor is needed here.
>
> Could you try with adding SAAJInInterceptor back?
>
>
> Freeman
>
> Jens Willhardt wrote:
>
>> Hi,
>> do you have something new about the problem I reported ?
>>
>>
>> 2008/7/17 Jens Willhardt <jw...@googlemail.com>:
>>
>>
>>
>>> Hi,
>>>
>>> for cxf bus we don't have cxf.xml (use the deafaults)
>>> The xbean.xml and Wsdl without the .xsd are in the attachment
>>>
>>> 2008/7/16 Freeman Fang <fr...@gmail.com>:
>>>
>>> Hi,
>>>
>>>
>>>> What's the configuration for the cxf bc provider? If possible please
>>>> append the xbean.xml, the configuration for cxf bus and wsdl you are
>>>> using.
>>>>
>>>> Freeman
>>>>
>>>>
>>>> Jens Willhardt wrote:
>>>>
>>>>
>>>>
>>>>> Hi,
>>>>>
>>>>>
>>>>> We have CXF Provider component witch uses Security Interceptor -
>>>>> WSS4JInInterceptor for the incoming messages(Response) from Axis2
>>>>> server
>>>>> The incoming message looks as follows:
>>>>>
>>>>> Payload: <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope
>>>>> xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xenc="
>>>>> http://www.w3.org/2001/04/xmlenc#"><soapenv:Header>
>>>>> <wsse:Security xmlns:wsse="
>>>>>
>>>>>
>>>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
>>>>> "
>>>>> soapenv:mustUnderstand="1"><xenc:EncryptedKey Id="EncKeyId-25228613">
>>>>> <xenc:EncryptionMethod Algorithm="
>>>>> http://www.w3.org/2001/04/xmlenc#rsa-1_5"
>>>>> />
>>>>> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>>>>> <wsse:SecurityTokenReference><wsse:KeyIdentifier EncodingType="
>>>>>
>>>>>
>>>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
>>>>> "
>>>>> ValueType="
>>>>>
>>>>>
>>>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier
>>>>>
>>>>>
>>>>> ">amyJMqOXoch5Z5N5VuYSWR7ZrWQ=</wsse:KeyIdentifier></wsse:SecurityTokenReference>
>>>>> </ds:KeyInfo>
>>>>> ……………………………………………...
>>>>>
>>>>> The WSS4JInInterceptor complains with the following:
>>>>>
>>>>> 16.07.2008 15:57:28 org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
>>>>> handleMessage
>>>>> WARNUNG: Request does not contain required Security header
>>>>> 16.07.2008 15:57:28 org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
>>>>> handleMessage
>>>>> WARNUNG:
>>>>> org.apache.ws.security.WSSecurityException: An error was discovered
>>>>> processing the <wsse:Security> header
>>>>>
>>>>>
>>>>> It seams that the SAAJInInterceptor does not prepare the wssw:Security
>>>>> element in the DOM tree !?!
>>>>>
>>>>> Is there anybody who can help us?
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>
>>>>
>>>
>>
>>
>
>
Re: Cxf security problem
Posted by Freeman Fang <fr...@gmail.com>.
Hi,
From your xbean configuration, you comment out SAAJInInterceptor.
Which Servicemix version you are using? Since for servicemix 3.2.2
snapshot we still use cxf 2.0.x which means SAAJInInterceptor is needed
here.
Could you try with adding SAAJInInterceptor back?
Freeman
Jens Willhardt wrote:
> Hi,
> do you have something new about the problem I reported ?
>
>
> 2008/7/17 Jens Willhardt <jw...@googlemail.com>:
>
>
>> Hi,
>>
>> for cxf bus we don't have cxf.xml (use the deafaults)
>> The xbean.xml and Wsdl without the .xsd are in the attachment
>>
>> 2008/7/16 Freeman Fang <fr...@gmail.com>:
>>
>> Hi,
>>
>>> What's the configuration for the cxf bc provider? If possible please
>>> append the xbean.xml, the configuration for cxf bus and wsdl you are using.
>>>
>>> Freeman
>>>
>>>
>>> Jens Willhardt wrote:
>>>
>>>
>>>> Hi,
>>>>
>>>>
>>>> We have CXF Provider component witch uses Security Interceptor -
>>>> WSS4JInInterceptor for the incoming messages(Response) from Axis2 server
>>>> The incoming message looks as follows:
>>>>
>>>> Payload: <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope
>>>> xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xenc="
>>>> http://www.w3.org/2001/04/xmlenc#"><soapenv:Header>
>>>> <wsse:Security xmlns:wsse="
>>>>
>>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
>>>> "
>>>> soapenv:mustUnderstand="1"><xenc:EncryptedKey Id="EncKeyId-25228613">
>>>> <xenc:EncryptionMethod Algorithm="
>>>> http://www.w3.org/2001/04/xmlenc#rsa-1_5"
>>>> />
>>>> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>>>> <wsse:SecurityTokenReference><wsse:KeyIdentifier EncodingType="
>>>>
>>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
>>>> "
>>>> ValueType="
>>>>
>>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier
>>>>
>>>> ">amyJMqOXoch5Z5N5VuYSWR7ZrWQ=</wsse:KeyIdentifier></wsse:SecurityTokenReference>
>>>> </ds:KeyInfo>
>>>> ……………………………………………...
>>>>
>>>> The WSS4JInInterceptor complains with the following:
>>>>
>>>> 16.07.2008 15:57:28 org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
>>>> handleMessage
>>>> WARNUNG: Request does not contain required Security header
>>>> 16.07.2008 15:57:28 org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
>>>> handleMessage
>>>> WARNUNG:
>>>> org.apache.ws.security.WSSecurityException: An error was discovered
>>>> processing the <wsse:Security> header
>>>>
>>>>
>>>> It seams that the SAAJInInterceptor does not prepare the wssw:Security
>>>> element in the DOM tree !?!
>>>>
>>>> Is there anybody who can help us?
>>>>
>>>>
>>>>
>>>>
>>>
>
>
Re: Cxf security problem
Posted by Jens Willhardt <jw...@googlemail.com>.
Hi,
do you have something new about the problem I reported ?
2008/7/17 Jens Willhardt <jw...@googlemail.com>:
> Hi,
>
> for cxf bus we don't have cxf.xml (use the deafaults)
> The xbean.xml and Wsdl without the .xsd are in the attachment
>
> 2008/7/16 Freeman Fang <fr...@gmail.com>:
>
> Hi,
>>
>> What's the configuration for the cxf bc provider? If possible please
>> append the xbean.xml, the configuration for cxf bus and wsdl you are using.
>>
>> Freeman
>>
>>
>> Jens Willhardt wrote:
>>
>>> Hi,
>>>
>>>
>>> We have CXF Provider component witch uses Security Interceptor -
>>> WSS4JInInterceptor for the incoming messages(Response) from Axis2 server
>>> The incoming message looks as follows:
>>>
>>> Payload: <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope
>>> xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xenc="
>>> http://www.w3.org/2001/04/xmlenc#"><soapenv:Header>
>>> <wsse:Security xmlns:wsse="
>>>
>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
>>> "
>>> soapenv:mustUnderstand="1"><xenc:EncryptedKey Id="EncKeyId-25228613">
>>> <xenc:EncryptionMethod Algorithm="
>>> http://www.w3.org/2001/04/xmlenc#rsa-1_5"
>>> />
>>> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>>> <wsse:SecurityTokenReference><wsse:KeyIdentifier EncodingType="
>>>
>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
>>> "
>>> ValueType="
>>>
>>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier
>>>
>>> ">amyJMqOXoch5Z5N5VuYSWR7ZrWQ=</wsse:KeyIdentifier></wsse:SecurityTokenReference>
>>> </ds:KeyInfo>
>>> ……………………………………………...
>>>
>>> The WSS4JInInterceptor complains with the following:
>>>
>>> 16.07.2008 15:57:28 org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
>>> handleMessage
>>> WARNUNG: Request does not contain required Security header
>>> 16.07.2008 15:57:28 org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
>>> handleMessage
>>> WARNUNG:
>>> org.apache.ws.security.WSSecurityException: An error was discovered
>>> processing the <wsse:Security> header
>>>
>>>
>>> It seams that the SAAJInInterceptor does not prepare the wssw:Security
>>> element in the DOM tree !?!
>>>
>>> Is there anybody who can help us?
>>>
>>>
>>>
>>
>>
>
Re: Cxf security problem
Posted by Jens Willhardt <jw...@googlemail.com>.
Hi,
for cxf bus we don't have cxf.xml (use the deafaults)
The xbean.xml and Wsdl without the .xsd are in the attachment
2008/7/16 Freeman Fang <fr...@gmail.com>:
> Hi,
>
> What's the configuration for the cxf bc provider? If possible please append
> the xbean.xml, the configuration for cxf bus and wsdl you are using.
>
> Freeman
>
>
> Jens Willhardt wrote:
>
>> Hi,
>>
>>
>> We have CXF Provider component witch uses Security Interceptor -
>> WSS4JInInterceptor for the incoming messages(Response) from Axis2 server
>> The incoming message looks as follows:
>>
>> Payload: <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope
>> xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xenc="
>> http://www.w3.org/2001/04/xmlenc#"><soapenv:Header>
>> <wsse:Security xmlns:wsse="
>>
>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
>> "
>> soapenv:mustUnderstand="1"><xenc:EncryptedKey Id="EncKeyId-25228613">
>> <xenc:EncryptionMethod Algorithm="
>> http://www.w3.org/2001/04/xmlenc#rsa-1_5"
>> />
>> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>> <wsse:SecurityTokenReference><wsse:KeyIdentifier EncodingType="
>>
>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
>> "
>> ValueType="
>>
>> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier
>>
>> ">amyJMqOXoch5Z5N5VuYSWR7ZrWQ=</wsse:KeyIdentifier></wsse:SecurityTokenReference>
>> </ds:KeyInfo>
>> ……………………………………………...
>>
>> The WSS4JInInterceptor complains with the following:
>>
>> 16.07.2008 15:57:28 org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
>> handleMessage
>> WARNUNG: Request does not contain required Security header
>> 16.07.2008 15:57:28 org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
>> handleMessage
>> WARNUNG:
>> org.apache.ws.security.WSSecurityException: An error was discovered
>> processing the <wsse:Security> header
>>
>>
>> It seams that the SAAJInInterceptor does not prepare the wssw:Security
>> element in the DOM tree !?!
>>
>> Is there anybody who can help us?
>>
>>
>>
>
>
Re: Cxf security problem
Posted by Freeman Fang <fr...@gmail.com>.
Hi,
What's the configuration for the cxf bc provider? If possible please
append the xbean.xml, the configuration for cxf bus and wsdl you are using.
Freeman
Jens Willhardt wrote:
> Hi,
>
>
> We have CXF Provider component witch uses Security Interceptor -
> WSS4JInInterceptor for the incoming messages(Response) from Axis2 server
> The incoming message looks as follows:
>
> Payload: <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope
> xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xenc="
> http://www.w3.org/2001/04/xmlenc#"><soapenv:Header>
> <wsse:Security xmlns:wsse="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
> soapenv:mustUnderstand="1"><xenc:EncryptedKey Id="EncKeyId-25228613">
> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"
> />
> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <wsse:SecurityTokenReference><wsse:KeyIdentifier EncodingType="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
> ValueType="
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier
> ">amyJMqOXoch5Z5N5VuYSWR7ZrWQ=</wsse:KeyIdentifier></wsse:SecurityTokenReference>
> </ds:KeyInfo>
> ……………………………………………...
>
> The WSS4JInInterceptor complains with the following:
>
> 16.07.2008 15:57:28 org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
> handleMessage
> WARNUNG: Request does not contain required Security header
> 16.07.2008 15:57:28 org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor
> handleMessage
> WARNUNG:
> org.apache.ws.security.WSSecurityException: An error was discovered
> processing the <wsse:Security> header
>
>
> It seams that the SAAJInInterceptor does not prepare the wssw:Security
> element in the DOM tree !?!
>
> Is there anybody who can help us?
>
>