You are viewing a plain text version of this content. The canonical link for it is here.
Posted to wss4j-dev@ws.apache.org by Rik Gruwez <ri...@admb.be> on 2009/03/26 10:09:38 UTC
Body attributes get modified when verifying digest
I am encountering a digest verification problem when using the
WSSecurityEngine.processSecurityHeader() method. The problem occurs when the
EnvelopeIdResolver.engineResolve() method calls
WSSecurityUtil.findBodyElement().
The call is: Element selectedElem = WSSecurityUtil.findBodyElement(doc, sc);
In the original document (doc parameter) the body tag is as follows:
<SOAP-ENV:Body
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
wsu:Id="id-4423115">
The selectedElem returned by the findBodyElement() method has a body tag
like this:
<SOAP-ENV:Body xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
wsu:Id="id-4423115">
As you can see, the part in bold has been added. I suppose it is inherited
from the original Soap envelope, which encapsulates the body:
<SOAP-ENV:Envelope
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
The trouble is now that the digest value is recalculated by the receiving
side on the modified body (the one containing the SOAP-ENV namespace) and of
course it does not match the digest value calculated by the sender on the
original body. I get a hash mismatch and the message is rejected by the
receiver.
The funny thing is that when I calculate the hash at the sender's side, the
exact same call is executed to find the body element, i.e.
findBodyElement(), but this time the body tag is not modified.
Is there somewhere a property (on the Document level perhaps?) indicating if
the namespace should be transfered from the Envelope tag to the Body tag
when the findBodyElement() call is executed?
Quite puzzled...
Regards,
Rik Gruwez
--
View this message in context: http://www.nabble.com/Body-attributes-get-modified-when-verifying-digest-tp22718268p22718268.html
Sent from the WSS4J mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
RE: Body attributes get modified when verifying digest
Posted by Rik Gruwez <ri...@admb.be>.
Colm O hEigeartaigh wrote:
>
> Hi Rik,
>
> It sounds like it could be a problem with the SAAJ implementation you're
> using. What does the SOAP message look like going over the wire, does
> the Body element have the SOAP-ENV namespace defined? What version of
> WSS4J, Axis/CXF etc are you using? Can you create a test-case?
>
> Colm.
>
Colm,
Found the problem. It is the implementation of the TransformerFactory and
Transformer that are the culprits. In my case I am using Xalan (2.7.1),
which implements TransformerFactory as
org.apache.xalan.processor.TransformerFactoryImpl and extends Transformer as
org.apache.xalan.transformer.TransformerIdentityImpl.
Even though both my J2SE client as well as my J2EE server have
Xalan-2.7.1.jar in their classpath, somehow the J2SE client managed to
obtain a version of org.apache.xalan.processor.TransformerFactoryImpl that
does not come from Xalan-2.7.1.jar. I suspect it finds it somewhere in the
JRE, but I'm not sure where. Anyway, I moved up Xalan-2.7.1.jar in the
"Order and Export" tab for the project properties in Eclipse and now
everything is OK. It seems very odd to me that
org.apache.xalan.processor.TransformerFactoryImpl would be included in a jar
that is not Xalan-2.7.1, but apparently that is the case on my machine.
Regards,
Rik
--
View this message in context: http://www.nabble.com/Body-attributes-get-modified-when-verifying-digest-tp22718268p22722016.html
Sent from the WSS4J mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
RE: Body attributes get modified when verifying digest
Posted by Rik Gruwez <ri...@admb.be>.
Colm O hEigeartaigh wrote:
>
> It sounds like it could be a problem with the SAAJ implementation you're
> using. What does the SOAP message look like going over the wire, does
> the Body element have the SOAP-ENV namespace defined? What version of
> WSS4J, Axis/CXF etc are you using? Can you create a test-case?
>
The SOAP message going over the wire does not have the SOAP-ENV namespace
defined in the body. The SOAP-ENV namespace is defined in the Envelope.
Basically it looks like this:
<SOAP-ENV:Envelope
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Header>
...
</SOAP-ENV:Header>
<SOAP-ENV:Body wsu:Id="id-26831805"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
...
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
Hi Colm,
Versions:
Wss4j: 1.5.6
Axis2-kernel-1.3.jar
I also have Axis-1.4 libraries as dependencies of Wss4j, but I assume those
are only there for compilation purposes? Not sure though...
I have created the following test case. It takes the file "Document.xml" as
input and extracts the body element. When I invoke it from my J2SE
application that creates and sends the SOAP message (via a simple main()
method), the result is as you can see it in "main.xml". When I do the same
thing at receiving side, in my J2EE servlet, the result is as you can see it
in "http-8080-1.xml". In the J2EE case, the namespace is added to the body
tag. Somehow this leads me to assume that I am looking at a classloading
problem, where the J2SE side uses a different implementation than the J2EE
side, but up till now I have found no differences. Below is the Java code
that performs the test case. I have instantiated the individual variables in
order to make debugging easier for me.
Still puzzled, so if you see anything I have overlooked, I would appreciate
hearing from you.
Regards,
Rik Gruwez
import java.io.File;
import java.io.FileOutputStream;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;
import org.apache.ws.security.SOAPConstants;
import org.apache.ws.security.util.WSSecurityUtil;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
public class TestNS {
public static void testSibling() {
try {
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
Document doc = dbf.newDocumentBuilder().parse(new
File("d:\\document.xml"));
SOAPConstants sc =
WSSecurityUtil.getSOAPConstants(doc.getDocumentElement());
Element selectedElem = WSSecurityUtil.findBodyElement(doc, sc);
String fileName = "d:\\" + Thread.currentThread().getName() + ".xml";
FileOutputStream fos = new FileOutputStream(fileName);
DOMSource ds = new DOMSource(selectedElem);
StreamResult sr = new StreamResult(fos);
TransformerFactory tf = TransformerFactory.newInstance();
Transformer transformer = tf.newTransformer();
transformer.transform(ds, sr);
fos.close();
} catch (Exception e) {
e.printStackTrace();
}
}
} http://www.nabble.com/file/p22720609/document.xml document.xml
http://www.nabble.com/file/p22720609/main.xml main.xml
http://www.nabble.com/file/p22720609/http-8080-1.xml http-8080-1.xml
http://www.nabble.com/file/p22720609/namespace.zip namespace.zip
--
View this message in context: http://www.nabble.com/Body-attributes-get-modified-when-verifying-digest-tp22718268p22720609.html
Sent from the WSS4J mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
RE: Body attributes get modified when verifying digest
Posted by Colm O hEigeartaigh <co...@progress.com>.
Hi Rik,
It sounds like it could be a problem with the SAAJ implementation you're
using. What does the SOAP message look like going over the wire, does
the Body element have the SOAP-ENV namespace defined? What version of
WSS4J, Axis/CXF etc are you using? Can you create a test-case?
Colm.
-----Original Message-----
From: Rik Gruwez [mailto:rik.gruwez@admb.be]
Sent: 26 March 2009 09:10
To: wss4j-dev@ws.apache.org
Subject: Body attributes get modified when verifying digest
I am encountering a digest verification problem when using the
WSSecurityEngine.processSecurityHeader() method. The problem occurs when
the
EnvelopeIdResolver.engineResolve() method calls
WSSecurityUtil.findBodyElement().
The call is: Element selectedElem = WSSecurityUtil.findBodyElement(doc,
sc);
In the original document (doc parameter) the body tag is as follows:
<SOAP-ENV:Body
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssec
urity-utility-1.0.xsd"
wsu:Id="id-4423115">
The selectedElem returned by the findBodyElement() method has a body tag
like this:
<SOAP-ENV:Body
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssec
urity-utility-1.0.xsd"
wsu:Id="id-4423115">
As you can see, the part in bold has been added. I suppose it is
inherited
from the original Soap envelope, which encapsulates the body:
<SOAP-ENV:Envelope
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
The trouble is now that the digest value is recalculated by the
receiving
side on the modified body (the one containing the SOAP-ENV namespace)
and of
course it does not match the digest value calculated by the sender on
the
original body. I get a hash mismatch and the message is rejected by the
receiver.
The funny thing is that when I calculate the hash at the sender's side,
the
exact same call is executed to find the body element, i.e.
findBodyElement(), but this time the body tag is not modified.
Is there somewhere a property (on the Document level perhaps?)
indicating if
the namespace should be transfered from the Envelope tag to the Body tag
when the findBodyElement() call is executed?
Quite puzzled...
Regards,
Rik Gruwez
--
View this message in context:
http://www.nabble.com/Body-attributes-get-modified-when-verifying-digest
-tp22718268p22718268.html
Sent from the WSS4J mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org