You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@ws.apache.org by Adrian Williamson <aw...@octavo2.demon.co.uk> on 2014/08/07 18:41:34 UTC

Decoding and Verfification in WSS4J - Need some help

Hi,

Using "public class SecurityManager implements
SOAPHandler<SOAPMessageContext>" and wsimport:

I've now managed to get the remote server to send me back a SOAP message
which has the timetamp and body signed and the body encrypted.

So I've been looking around the internet and I've got to the point where I
think I need to use:

results =
this.secEngine.processSecurityHeader(doc,null,this.callbackHandler,this.cryp
to);

But this is throwing an exception:

"The private key for the supplied alias does not exist in the keystore"

So I've got one keystore with all the certificates in it for the client and
the remote server.

I think I need to tell secEngine or the callbackhandler which alias and
password to use - but I'm not sure - is it supposed to get this information
from the security header returned in the SOAP message?

I was looking at this for inspiration:

http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/tes
t/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java?revisi
on=1503186&view=co

But if anyone has a better source please point it out.

Or you can tease me by suggesting some classes and method names and I'll
join the dots.

Thanks

Adrian

Re: Decoding and Verfification in WSS4J - Need some help

Posted by Colm O hEigeartaigh <co...@apache.org>.
Why not just use a SOAP stack such as CXF or Axis which will take care of
all this for you? If you really insist on implementing your own parsing,
you could take a look at the WSS4JInInterceptor in CXF, to see how it sets
up the configuration + processing for WSS4J to parse the security header:

https://git-wip-us.apache.org/repos/asf?p=cxf.git;a=blob_plain;f=rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/WSS4JInInterceptor.java;hb=HEAD

Colm.


On Thu, Aug 7, 2014 at 5:41 PM, Adrian Williamson <aw...@octavo2.demon.co.uk>
wrote:

> Hi,
>
> Using "public class SecurityManager implements
> SOAPHandler<SOAPMessageContext>" and wsimport:
>
> I've now managed to get the remote server to send me back a SOAP message
> which has the timetamp and body signed and the body encrypted.
>
> So I've been looking around the internet and I've got to the point where I
> think I need to use:
>
> results =
>
> this.secEngine.processSecurityHeader(doc,null,this.callbackHandler,this.cryp
> to);
>
> But this is throwing an exception:
>
> "The private key for the supplied alias does not exist in the keystore"
>
> So I've got one keystore with all the certificates in it for the client and
> the remote server.
>
> I think I need to tell secEngine or the callbackhandler which alias and
> password to use - but I'm not sure - is it supposed to get this information
> from the security header returned in the SOAP message?
>
> I was looking at this for inspiration:
>
>
> http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/tes
>
> t/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java?revisi
> on=1503186&view=co
>
> But if anyone has a better source please point it out.
>
> Or you can tease me by suggesting some classes and method names and I'll
> join the dots.
>
> Thanks
>
> Adrian
>
>
>
>
>


-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

RE: Decoding and Verfification in WSS4J - Need some help

Posted by Adrian Williamson <aw...@octavo2.demon.co.uk>.
Sorry I should have mentioned I'm using Wss4J 2.0.2 on:

java version "1.7.0_55"
Java(TM) SE Runtime Environment (build 1.7.0_55-b13)
Java HotSpot(TM) 64-Bit Server VM (build 24.55-b03, mixed mode)

I keep finding examples that refer to 1.5 or 1.6 where a lot of methods no
longer exist.

Cheers

Adrian

-----Original Message-----
From: Adrian Williamson [mailto:aw@octavo2.demon.co.uk] 
Sent: 07 August 2014 17:42
To: users@ws.apache.org
Subject: Decoding and Verfification in WSS4J - Need some help

Hi,

Using "public class SecurityManager implements
SOAPHandler<SOAPMessageContext>" and wsimport:

I've now managed to get the remote server to send me back a SOAP message
which has the timetamp and body signed and the body encrypted.

So I've been looking around the internet and I've got to the point where I
think I need to use:

results =
this.secEngine.processSecurityHeader(doc,null,this.callbackHandler,this.cryp
to);

But this is throwing an exception:

"The private key for the supplied alias does not exist in the keystore"

So I've got one keystore with all the certificates in it for the client and
the remote server.

I think I need to tell secEngine or the callbackhandler which alias and
password to use - but I'm not sure - is it supposed to get this information
from the security header returned in the SOAP message?

I was looking at this for inspiration:

http://svn.apache.org/viewvc/webservices/wss4j/trunk/ws-security-dom/src/tes
t/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java?revisi
on=1503186&view=co

But if anyone has a better source please point it out.

Or you can tease me by suggesting some classes and method names and I'll
join the dots.

Thanks

Adrian