You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@cxf.apache.org by Rafał Libik <ra...@gmail.com> on 2014/11/24 18:12:11 UTC

Webservice decryption

Hi,

I have to write webservice based on provided WSDL and additional 
specification.

Sample request, which I need to process looks like:

     <ns0:findMedDocsOfPatientRequestPar 
xmlns:ns0="http://www.domain.com/xsd/smth/reg" 
xmlns:ns1="http://www.domain.com/xsd/smth/datatypes">
     <metadata>
     <receiver>15113180204300</receiver>
     </metadata>
     <EncryptedRequest>
<KeyInfo>X1JRq4ztpkb/G81EpTi1Su3H1K2vOpKvq2aa+8TKCM+i+iYKLF0aRWntaBWIt/vR2XKn1idR+blg
a3IiN6cl10RnD+VTDPDrfz9nvJfejiDHagRrGOczvkKnYDFTSVIiDFIRfmXG6/+7mPeMfOIM18ik
UQyiaF9fXORNt64YrXyJEPAvE79s73UKp4h/7v7S9TaHJNoR1W4NdxrM9t69y810UM4jBGup/p9o
+5ufj1Uv8GTfpahd50wi8nfOCBsUoBKdsqKowCP0UNfdukqQcLtsvL1B6p3sczzAZeG1FycIPdB0
     GJn2T3fUpi3Zl2yo/UpMRSFA84zdA66F4uOKCg==</KeyInfo>
     <request>
     <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" 
Type="http://www.w3.org/2001/04/xmlenc#Content">
     <xenc:EncryptionMethod 
Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
     <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
     <xenc:EncryptedKey>
     <xenc:EncryptionMethod 
Algorithm="http://www.w3.org/2001/04/xmlenc#kw-tripledes"/>
     <xenc:CipherData>
<xenc:CipherValue>nKHP7vvFwhl9XpLaZhlZlHMXvhrj1MUcca8AR8WsXlY=</xenc:CipherValue>
     </xenc:CipherData>
     </xenc:EncryptedKey>
     </ds:KeyInfo>
     <xenc:CipherData>
<xenc:CipherValue>jAxLLB2ab+UT9A+ClgsWKWR1OZKFMhRDVchSyFa2PEE8jZL0WmQmYi7/3URhiUI5OOJUGjPZKsa+
FFHQnAZ9JOin5nWqMKBz7hjiKiClknAu8f8l44Shy+pdyYSUhOebQUna0FSptwDrdkIvhh/6bvKZ
U5xw2QZRigRTJiAr7pi8q+OsnufMPMIncRh5tfKXIam3kankPNRqIrN7ZU15Cu23FLjOE6miwiKl
8cavQhkCTT+qPmYaCFtVT3e0B/IKdQ2ZpFcWcKubo4TKWck4zDftmXHxy/ZniXUHW4QybvP88bmt
oILFxF/6ZU1c+urH+i9pL/0hb126MLYJR97KOhLQDIU5evfu+IRfSc0Qp5fOd8nigWWltdNW/xbb
C1DjjJyhdrvKoFtQN21xUuQjxbvELVlP/rbkxXyLfEf084zNx6WAlwlGagKv2M8ItV6OVbyJ7MWb
0/eiAePoT5rG9MkB+I8wFaY+3z5NpiRBj8sYlUR1Ody48a3BVleOBeldG+pkPzDd2eRbbOUN6JtP
4Q9w0uHuZVCLPpuvuF764sEKY/zSiLdTCZbYeoiZ4dt4gvhOSQpT3AIHrEU7wynFKx60NSLqUUWM
XUYb/MfpXp/79aTbSIUbGYbIQAAB7CbfCXp8Cm/o4CcGHtVAB8o3jVxOa0ZC6p1j4l8rSR0TtxI=</xenc:CipherValue>
     </xenc:CipherData>
     </xenc:EncryptedData>
     </request>
     </EncryptedRequest>
     </ns0:findMedDocsOfPatientRequestPar>



And I need to decrypt it to the form:


     <ns0:findMedDocsOfPatientRequestPar 
xmlns:ns0="http://www.domain.com/xsd/smth/reg" 
xmlns:ns1="http://www.domain.com/xsd/smth/datatypes">
     <metadata>
     <receiver>15113180204300</receiver>
     </metadata>
     <request>
<asyncInvokeId>3200a3b4-80f6-4099-89fb-00543f3006ba</asyncInvokeId>
     <searchCriteria>
     <patientName>
     <firstName>Slawomir</firstName>
     <lastName>Slawomirski</lastName>
     </patientName>
     <patientIds>
     <personIdent>
     <nationalPersonId>
     <issuingCountry>PL</issuingCountry>
     <personIdNumber>63101101023</personIdNumber>
     </nationalPersonId>
     </personIdent>
     </patientIds>
     </searchCriteria>
     <selectionCriteria>
     <docTypeCode>X1.01</docTypeCode>
     <docTypeCode>X1.01</docTypeCode>
     </selectionCriteria>
     </request>
     </ns0:findMedDocsOfPatientRequestPar>


**Specification**:

Encrypted is only `<request>` content but it is wrapped by 
`<EncryptedRequest>` element too.
`<KeyInfo>` is also in section `<EncryptedRequest>` and it is DES key 
encrypted by my public key with algorithm: RSA/ECB/PKCS1PADDING.
Content of `<request>` is encrypted by AES key which is encrypted by DES 
key in WRAP mode with algorithm: xmlenc#kw-tripledes



So, my question is:
How to simply receive and process this encrypted request in java?
My software stack is:

  - cxf
  - spring
  - camel

I can configure this without encryption or with simple encryption.
But in this manner seems to difficult for me and I don't want to 
reinvent the wheel.
Provided WSDL corresponds to decrypted form but in encrypted form we 
have strange `<EncryptedRequest>` section wrapper.

Please help. :)

Ps. Better formatted is here:
http://stackoverflow.com/questions/27104746/webservice-decryption

Re: Webservice decryption

Posted by Rafal Libik <ra...@gmail.com>.

Thank you for the answer.
I figured it out today with the same results (the same lib).
I've been thinking about putting this encryption code in cxf interceptor 
(in USER_STREAM phase?) and transform the SOAP body.
Is it correct?
Could you give me some tips/examples/links about transforming body this way?

Rafal.



W dniu 25.11.2014 o 17:19, Colm O hEigeartaigh pisze:
> Your request is not encrypted in a standard manner, and so there is no "out
> of the box" way to support it. You will have to grab the SOAP Body after
> CXF is finished processing it, and then search for the EncryptedData
> structure and decrypt it using the XML Security (Apache Santuario) API.
>
> Colm.
>
> On Tue, Nov 25, 2014 at 10:59 AM, Rafał Libik <ra...@gmail.com> wrote:
>
>> W dniu 24.11.2014 o 18:12, Rafał Libik pisze:
>>
>>> **Specification**:
>>>
>>> Encrypted is only `<request>` content but it is wrapped by
>>> `<EncryptedRequest>` element too.
>>> `<KeyInfo>` is also in section `<EncryptedRequest>` and it is DES key
>>> encrypted by my public key with algorithm: RSA/ECB/PKCS1PADDING.
>>> Content of `<request>` is encrypted by AES key which is encrypted by DES
>>> key in WRAP mode with algorithm: xmlenc#kw-tripledes
>>>
>>>
>>>
>>> So, my question is:
>>> How to simply receive and process this encrypted request in java?
>>> My software stack is:
>>>
>>>   - cxf
>>>   - spring
>>>   - camel
>>>
>>> I can configure this without encryption or with simple encryption.
>>> But in this manner seems to difficult for me and I don't want to reinvent
>>> the wheel.
>>> Provided WSDL corresponds to decrypted form but in encrypted form we have
>>> strange `<EncryptedRequest>` section wrapper.
>>>
>>>
>>> Ps. Better formatted is here:
>>> http://stackoverflow.com/questions/27104746/webservice-decryption
>>>
>> No one can help me?
>>
>
>

Re: Webservice decryption

Posted by Colm O hEigeartaigh <co...@apache.org>.

Your request is not encrypted in a standard manner, and so there is no "out
of the box" way to support it. You will have to grab the SOAP Body after
CXF is finished processing it, and then search for the EncryptedData
structure and decrypt it using the XML Security (Apache Santuario) API.

Colm.

On Tue, Nov 25, 2014 at 10:59 AM, Rafał Libik <ra...@gmail.com> wrote:

>
> W dniu 24.11.2014 o 18:12, Rafał Libik pisze:
>
>>
>> **Specification**:
>>
>> Encrypted is only `<request>` content but it is wrapped by
>> `<EncryptedRequest>` element too.
>> `<KeyInfo>` is also in section `<EncryptedRequest>` and it is DES key
>> encrypted by my public key with algorithm: RSA/ECB/PKCS1PADDING.
>> Content of `<request>` is encrypted by AES key which is encrypted by DES
>> key in WRAP mode with algorithm: xmlenc#kw-tripledes
>>
>>
>>
>> So, my question is:
>> How to simply receive and process this encrypted request in java?
>> My software stack is:
>>
>>  - cxf
>>  - spring
>>  - camel
>>
>> I can configure this without encryption or with simple encryption.
>> But in this manner seems to difficult for me and I don't want to reinvent
>> the wheel.
>> Provided WSDL corresponds to decrypted form but in encrypted form we have
>> strange `<EncryptedRequest>` section wrapper.
>>
>>
>> Ps. Better formatted is here:
>> http://stackoverflow.com/questions/27104746/webservice-decryption
>>
>
> No one can help me?
>



-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

Re: Webservice decryption

Posted by Rafał Libik <ra...@gmail.com>.

W dniu 24.11.2014 o 18:12, Rafał Libik pisze:
>
> **Specification**:
>
> Encrypted is only `<request>` content but it is wrapped by 
> `<EncryptedRequest>` element too.
> `<KeyInfo>` is also in section `<EncryptedRequest>` and it is DES key 
> encrypted by my public key with algorithm: RSA/ECB/PKCS1PADDING.
> Content of `<request>` is encrypted by AES key which is encrypted by 
> DES key in WRAP mode with algorithm: xmlenc#kw-tripledes
>
>
>
> So, my question is:
> How to simply receive and process this encrypted request in java?
> My software stack is:
>
>  - cxf
>  - spring
>  - camel
>
> I can configure this without encryption or with simple encryption.
> But in this manner seems to difficult for me and I don't want to 
> reinvent the wheel.
> Provided WSDL corresponds to decrypted form but in encrypted form we 
> have strange `<EncryptedRequest>` section wrapper.
>
>
> Ps. Better formatted is here:
> http://stackoverflow.com/questions/27104746/webservice-decryption

No one can help me?