[jira] [Updated] (CXF-8986) Ws-security-policy: if more policies are used in the same JVM, their algorithm suites influences each other

["Jiri Ondrusek (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CXF-8986?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jiri Ondrusek updated CXF-8986:
-------------------------------
    Summary: Ws-security-policy: if more policies are used in the same JVM, their algorithm suites influences each other  (was: Ws-security-policy: if more policies is used in the same JVM, their algorithm suites influences each other)

> Ws-security-policy: if more policies are used in the same JVM, their algorithm suites influences each other
> -----------------------------------------------------------------------------------------------------------
>
>                 Key: CXF-8986
>                 URL: https://issues.apache.org/jira/browse/CXF-8986
>             Project: CXF
>          Issue Type: Bug
>          Components: WS-* Components
>    Affects Versions: 4.0.4
>            Reporter: Jiri Ondrusek
>            Priority: Major
>
> I'm fixing some tests in quarkus-cxf and I found a behavior which seems to be not desired. On the other hand I might be missing some information and this behavior is expected.
> Reproducer:
>  # Clone and build [https://github.com/JiriOndrusek/quarkus-cxf/tree/suite-influence-reprodocer]
>  # Run (with remote debug)
> {code:java}
> ./mvnw clean test -f integration-tests/ws-security-policy -Dtest="EncryptSignPolicyTest#helloEncryptSign" -Dmaven.surefire.debug{code}
> Check value of effectivePolicy in this line [https://github.com/apache/cxf/blob/main/rt/ws/policy/src/main/java/org/apache/cxf/ws/policy/PolicyOutInterceptor.java#L98]
> Look into
> {code:java}
> effectivePolicy->policy->policyComponents->exactlyOne->policyComponents->all->policyComponents->asymmetricBinding->alghoritnSuite->alghorithSuiteType{code}
> Value is *Basic256*
>  # Run different test by this command
> {code:java}
> ./mvnw clean test -f integration-tests/ws-security-policy -Dtest="CustomEncryptSignPolicyTest#helloDefaultCustomValues" -Dmaven.surefire.debug{code}
> Debug the same place and you can see, that the alghoritmSuiteType is *CustomAlgorithmSuite*
>  # Now run both tests together by
> {code:java}
> ./mvnw clean test -f integration-tests/ws-security-policy -Dtest="EncryptSignPolicyTest#helloEncryptSign,CustomEncryptSignPolicyTest#helloDefaultCustomValues" -Dmaven.surefire.debug{code}
> The first breakpoint is triggered by
> {code:java}
> CustomEncryptSignPolicyTest#helloDefaultCustomValues{code}
> and you can see hat the alghoritmSuiteType is *CustomAlgorithmSuite*
> The second breakpoint belongs to
> {code:java}
> EncryptSignPolicyTest#helloEncryptSign{code}
> , but the value in the efectivePolicy->..->asymmetricBinding is *CustomAlgorithmSuite*
> This is wrong, the correct value should be *Basic256*
> I changed test `CustomEncryptSignPolicyTest#helloDefaultCustomValues` to use *Basic128Rsa15* (to verify that the culprit is not the customAlgorithmSuite) and the result was wrong as with default values.
> Single execution showed *Basic128Rsa15* or *Basic256* (depends on the test), but execution of both tests showed *Basic128Rsa15* in both cases.
> I think that the behavior is wrong. I have a test suite running on FIPS machine. If tests are executed alone all works correctly (some tests asserts success, some tests asserts failure). If I run tests together, the tests which should fail, are successful.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)