You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by pat7 <pa...@gmail.com> on 2017/03/02 15:08:20 UTC
Bipro Security token service simple Usernametoken
Hi forum,
I want to implement a BIPRO Basic authentication. (only a Usernametoken)
I use Spring Boot, CXF 3.1.7 with a java based config.
If i send via SOAPUI a request with a Usernametoken to my endpoint, I get
several policy errors...
*Errormsg*
org.apache.cxf.ws.policy.PolicyException: These policy alternatives can not
be satisfied:
{http://schemas.xmlsoap.org/ws/2005/07/securitypolicy}TransportBinding
{http://schemas.xmlsoap.org/ws/2005/07/securitypolicy}TransportToken
{http://schemas.xmlsoap.org/ws/2005/07/securitypolicy}SupportingTokens
{http://schemas.xmlsoap.org/ws/2005/07/securitypolicy}UsernameToken
at
org.apache.cxf.ws.policy.AssertionInfoMap.checkEffectivePolicy(AssertionInfoMap.java:179)
~[cxf-rt-ws-policy-3.1.7.jar:3.1.7]
at
org.apache.cxf.ws.policy.PolicyVerificationInInterceptor.handle(PolicyVerificationInInterceptor.java:102)
~[cxf-rt-ws-policy-3.1.7.jar:3.1.7]
at
org.apache.cxf.ws.policy.AbstractPolicyInterceptor.handleMessage(AbstractPolicyInterceptor.java:44)
~[cxf-rt-ws-policy-3.1.7.jar:3.1.7]
at
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
~[cxf-core-3.1.7.jar:3.1.7]
...
*EndErrortext*
My policy definition in the wsdl:
<wsp:Policy xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"
xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
wsu:Id="BiPROAuthSecurityPolicy">
<wsp:ExactlyOne>
<wsp:All>
<sp:TransportBinding>
<wsp:Policy>
<sp:TransportToken>
<wsp:Policy>
<sp:HttpsToken RequireClientCertificate="false"/>
</wsp:Policy>
</sp:TransportToken>
</wsp:Policy>
</sp:TransportBinding>
<sp:SupportingTokens>
<wsp:Policy>
<wsp:ExactlyOne>
<wsp:All>
<sp:UsernameToken wsu:Id="BiPROBasicToken"/>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
</sp:SupportingTokens>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
Furthermore my Callback Handler is very simple and just verify one user:
*JavaClass*
public class STSCallbackHandler implements CallbackHandler {
public void handle(Callback[] callbacks) throws IOException,
UnsupportedCallbackException {
WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
if ("anna".equals(pc.getIdentifier())) {
pc.setPassword("anna123");
//break;
}
}
}
My Service endpoint looks also very simple:
*JavaClass*
@WebService
(
portName = "UserPasswordLogin",
serviceName = "SecurityTokenService_2.6.0.1.0",
wsdlLocation =
"src/main/resources/wsdl/SecurityTokenService-2.6.0.1.0.wsdl",
endpointInterface = "net.bipro.namespace.SecurityTokenServicePortType"
)
@EndpointProperties({
@EndpointProperty(key = "ws-security.callback-handler",
value="com.muki.endpoint.STSCallbackHandler"),
//@EndpointProperty(key =
"ws-security.return.security.error",value="false"),
})
public class SecurityTokenEndpoint implements SecurityTokenServicePortType {
@Override
public void requestSecurityToken(RequestSecurityTokenType parameters,
Holder<RequestSecurityTokenResponseType> parameters0) {
RequestSecurityTokenResponseType requestSecurityTokenResponse = new
RequestSecurityTokenResponseType();
// "TokenType"
Element tokenType = createElement("TokenType");
tokenType.setTextContent("urn:oasis:names:tc:SAML:1.0:assertion");
requestSecurityTokenResponse.getAny().add(tokenType);
parameters0.value = requestSecurityTokenResponse;
}
private Element createElement(String tagName) {
Element element = null;
try {
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
DocumentBuilder db = dbf.newDocumentBuilder();
Document doc = db.newDocument();
element =
doc.createElementNS("http://schemas.xmlsoap.org/ws/2005/02/trust",
tagName);
} catch(Exception e){
e.printStackTrace();
}
return element;
}
}
Do anybody know why I am getting this errors and help me to find a solution?
I'm new with CXF and Spring Boot.
Kind regards,
patrick
--
View this message in context: http://cxf.547215.n5.nabble.com/Bipro-Security-token-service-simple-Usernametoken-tp5777721.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Bipro Security token service simple Usernametoken
Posted by pat7 <pa...@gmail.com>.
Hi,
thx for reply.
With the following Policy definition it works.
<wsp:Policy xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"
xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
wsu:Id="BiPROAuthSecurityPolicy">
<wsp:ExactlyOne>
<wsp:All>
<sp:TransportBinding>
<wsp:Policy>
<sp:TransportToken>
<wsp:Policy>
<sp:HttpsToken RequireClientCertificate="false"/>
</wsp:Policy>
</sp:TransportToken>
</wsp:Policy>
</sp:TransportBinding>
<sp:SupportingTokens>
<wsp:Policy>
<wsp:ExactlyOne>
<wsp:All>
<sp:UsernameToken
sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
<wsp:Policy/>
</sp:UsernameToken>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
</sp:SupportingTokens>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
I have one more question.
Can you give me a hit how can I implement in the Callback Handler an access
to a own data source(MySQL) for username and password?
patrick
--
View this message in context: http://cxf.547215.n5.nabble.com/Bipro-Security-token-service-simple-Usernametoken-tp5777721p5777791.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Bipro Security token service simple Usernametoken
Posted by Colm O hEigeartaigh <co...@apache.org>.
The error is caused by the fact that you are manually adding the
WSS4JInInterceptor to the CXF in-interceptor list in
WebServiceConfiguration. You only do this when you don't have a
WS-SecurityPolicy. For the policy case, CXF will set up the interceptors
for you automatically.
Note that when you remove the WSS4JInInterceptor, you'll see an error about
not specifying a username. This is because the policy is a little unusual,
normally a UsernameToken is specified with an "IncludeToken" attribute that
specifies "AlwaysToRecipient". In this case, there is no attribute, so CXF
expects to send a UsernameToken back to the client.
Colm.
On Mon, Mar 6, 2017 at 7:46 AM, pat7 <pa...@gmail.com> wrote:
> Hi,
> thats very interesting. I use SOAPUI as a test client for my STS web
> service. I generate a zip with my project and put inside the zip also a
> soapui request.
>
> CoBiComNEW.zip
> <http://cxf.547215.n5.nabble.com/file/n5777771/CoBiComNEW.zip>
>
> patrick
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.
> com/Bipro-Security-token-service-simple-Usernametoken-
> tp5777721p5777771.html
> Sent from the cxf-user mailing list archive at Nabble.com.
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: Bipro Security token service simple Usernametoken
Posted by pat7 <pa...@gmail.com>.
Hi,
thats very interesting. I use SOAPUI as a test client for my STS web
service. I generate a zip with my project and put inside the zip also a
soapui request.
CoBiComNEW.zip
<http://cxf.547215.n5.nabble.com/file/n5777771/CoBiComNEW.zip>
patrick
--
View this message in context: http://cxf.547215.n5.nabble.com/Bipro-Security-token-service-simple-Usernametoken-tp5777721p5777771.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Bipro Security token service simple Usernametoken
Posted by Colm O hEigeartaigh <co...@apache.org>.
I don't see anything obviously wrong there. I tried using a CXF system test
with that policy and it worked fine. Could you create a demo/test-case to
reproduce the problem + I'll take a look?
Colm.
On Fri, Mar 3, 2017 at 12:38 PM, pat7 <pa...@gmail.com> wrote:
> Hi,
> thx for reply.
> Yes, I have following dependencies in my pom.xml file.
>
> <dependencies>
> <dependency>
> <groupId>org.springframework.boot</groupId>
> <artifactId>spring-boot-devtools</artifactId>
> </dependency>
> <dependency>
> <groupId>org.springframework.boot</groupId>
> <artifactId>spring-boot-starter-web</artifactId>
> </dependency>
> <dependency>
> <groupId>org.springframework.boot</groupId>
> <artifactId>spring-boot-starter-ws</artifactId>
> </dependency>
> <dependency>
> <groupId>org.springframework.boot</groupId>
> <artifactId>spring-boot-starter-test</artifactId>
> <scope>test</scope>
> </dependency>
> <dependency>
> <groupId>org.apache.cxf</groupId>
> <artifactId>cxf-rt-frontend-jaxws</artifactId>
> <version>${cxf.version}</version>
> </dependency>
> <dependency>
> <groupId>org.apache.cxf</groupId>
> <artifactId>cxf-rt-transports-http</artifactId>
> <version>${cxf.version}</version>
> </dependency>
> <dependency>
> <groupId>org.apache.cxf</groupId>
> <artifactId>cxf-rt-ws-security</artifactId>
> <version>${cxf.version}</version>
> </dependency>
> <dependency>
> <groupId>org.apache.cxf</groupId>
> <artifactId>cxf-rt-ws-policy</artifactId>
> <version>${cxf.version}</version>
> </dependency>
> <dependency>
> <groupId>org.keycloak</groupId>
> <artifactId>keycloak-spring-boot-adapter</artifactId>
> <version>2.2.1.Final</version>
> </dependency>
> <dependency>
> <groupId>org.keycloak</groupId>
> <artifactId>keycloak-tomcat8-adapter</artifactId>
> <version>2.2.1.Final</version>
> </dependency>
>
> <dependency>
> <groupId>org.springframework.boot</groupId>
> <artifactId>spring-boot-starter-data-jpa</artifactId>
> </dependency>
> <dependency>
> <groupId>org.hsqldb</groupId>
> <artifactId>hsqldb</artifactId>
> <scope>runtime</scope>
> </dependency>
> <dependency>
> <groupId>org.springframework.boot</groupId>
> <artifactId>spring-boot-starter-jdbc</artifactId>
> </dependency>
> <dependency>
> <groupId>mysql</groupId>
> <artifactId>mysql-connector-java</artifactId>
> <scope>runtime</scope>
> </dependency>
> </dependencies>
>
> I really read a lot, but I did not a solution for my problem.
>
> kind regards,
> patrick
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.
> com/Bipro-Security-token-service-simple-Usernametoken-
> tp5777721p5777750.html
> Sent from the cxf-user mailing list archive at Nabble.com.
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: Bipro Security token service simple Usernametoken
Posted by pat7 <pa...@gmail.com>.
Hi,
thx for reply.
Yes, I have following dependencies in my pom.xml file.
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-devtools</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-ws</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.apache.cxf</groupId>
<artifactId>cxf-rt-frontend-jaxws</artifactId>
<version>${cxf.version}</version>
</dependency>
<dependency>
<groupId>org.apache.cxf</groupId>
<artifactId>cxf-rt-transports-http</artifactId>
<version>${cxf.version}</version>
</dependency>
<dependency>
<groupId>org.apache.cxf</groupId>
<artifactId>cxf-rt-ws-security</artifactId>
<version>${cxf.version}</version>
</dependency>
<dependency>
<groupId>org.apache.cxf</groupId>
<artifactId>cxf-rt-ws-policy</artifactId>
<version>${cxf.version}</version>
</dependency>
<dependency>
<groupId>org.keycloak</groupId>
<artifactId>keycloak-spring-boot-adapter</artifactId>
<version>2.2.1.Final</version>
</dependency>
<dependency>
<groupId>org.keycloak</groupId>
<artifactId>keycloak-tomcat8-adapter</artifactId>
<version>2.2.1.Final</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>org.hsqldb</groupId>
<artifactId>hsqldb</artifactId>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-jdbc</artifactId>
</dependency>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<scope>runtime</scope>
</dependency>
</dependencies>
I really read a lot, but I did not a solution for my problem.
kind regards,
patrick
--
View this message in context: http://cxf.547215.n5.nabble.com/Bipro-Security-token-service-simple-Usernametoken-tp5777721p5777750.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Bipro Security token service simple Usernametoken
Posted by Colm O hEigeartaigh <co...@apache.org>.
Do you have the cxf-rt-ws-security jar on the classpath?
Colm.
On Thu, Mar 2, 2017 at 3:08 PM, pat7 <pa...@gmail.com> wrote:
> Hi forum,
>
> I want to implement a BIPRO Basic authentication. (only a Usernametoken)
> I use Spring Boot, CXF 3.1.7 with a java based config.
>
> If i send via SOAPUI a request with a Usernametoken to my endpoint, I get
> several policy errors...
>
> *Errormsg*
> org.apache.cxf.ws.policy.PolicyException: These policy alternatives can
> not
> be satisfied:
> {http://schemas.xmlsoap.org/ws/2005/07/securitypolicy}TransportBinding
> {http://schemas.xmlsoap.org/ws/2005/07/securitypolicy}TransportToken
> {http://schemas.xmlsoap.org/ws/2005/07/securitypolicy}SupportingTokens
> {http://schemas.xmlsoap.org/ws/2005/07/securitypolicy}UsernameToken
> at
> org.apache.cxf.ws.policy.AssertionInfoMap.checkEffectivePolicy(
> AssertionInfoMap.java:179)
> ~[cxf-rt-ws-policy-3.1.7.jar:3.1.7]
> at
> org.apache.cxf.ws.policy.PolicyVerificationInInterceptor.handle(
> PolicyVerificationInInterceptor.java:102)
> ~[cxf-rt-ws-policy-3.1.7.jar:3.1.7]
> at
> org.apache.cxf.ws.policy.AbstractPolicyInterceptor.handleMessage(
> AbstractPolicyInterceptor.java:44)
> ~[cxf-rt-ws-policy-3.1.7.jar:3.1.7]
> at
> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(
> PhaseInterceptorChain.java:308)
> ~[cxf-core-3.1.7.jar:3.1.7]
> ...
> *EndErrortext*
>
> My policy definition in the wsdl:
> <wsp:Policy xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
> "
> xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
> xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-
> 200401-wss-wssecurity-utility-1.0.xsd"
> wsu:Id="BiPROAuthSecurityPolicy">
> <wsp:ExactlyOne>
> <wsp:All>
> <sp:TransportBinding>
> <wsp:Policy>
> <sp:TransportToken>
> <wsp:Policy>
> <sp:HttpsToken RequireClientCertificate="false"/>
> </wsp:Policy>
> </sp:TransportToken>
> </wsp:Policy>
> </sp:TransportBinding>
> <sp:SupportingTokens>
> <wsp:Policy>
> <wsp:ExactlyOne>
> <wsp:All>
> <sp:UsernameToken wsu:Id="BiPROBasicToken"/>
> </wsp:All>
>
> </wsp:ExactlyOne>
> </wsp:Policy>
> </sp:SupportingTokens>
> </wsp:All>
> </wsp:ExactlyOne>
> </wsp:Policy>
>
> Furthermore my Callback Handler is very simple and just verify one user:
> *JavaClass*
> public class STSCallbackHandler implements CallbackHandler {
> public void handle(Callback[] callbacks) throws IOException,
> UnsupportedCallbackException {
> WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
> if ("anna".equals(pc.getIdentifier())) {
> pc.setPassword("anna123");
> //break;
> }
>
> }
> }
> My Service endpoint looks also very simple:
> *JavaClass*
> @WebService
> (
> portName = "UserPasswordLogin",
> serviceName = "SecurityTokenService_2.6.0.1.0",
> wsdlLocation =
> "src/main/resources/wsdl/SecurityTokenService-2.6.0.1.0.wsdl",
> endpointInterface = "net.bipro.namespace.SecurityTokenServicePortType"
> )
> @EndpointProperties({
> @EndpointProperty(key = "ws-security.callback-handler",
> value="com.muki.endpoint.STSCallbackHandler"),
> //@EndpointProperty(key =
> "ws-security.return.security.error",value="false"),
>
> })
> public class SecurityTokenEndpoint implements SecurityTokenServicePortType
> {
>
> @Override
> public void requestSecurityToken(RequestSecurityTokenType
> parameters,
> Holder<RequestSecurityTokenResponseType> parameters0) {
>
> RequestSecurityTokenResponseType requestSecurityTokenResponse = new
> RequestSecurityTokenResponseType();
>
> // "TokenType"
> Element tokenType = createElement("TokenType");
> tokenType.setTextContent("urn:oasis:names:tc:SAML:1.0:
> assertion");
> requestSecurityTokenResponse.getAny().add(tokenType);
>
> parameters0.value = requestSecurityTokenResponse;
> }
>
> private Element createElement(String tagName) {
>
> Element element = null;
> try {
> DocumentBuilderFactory dbf =
> DocumentBuilderFactory.newInstance();
> DocumentBuilder db = dbf.newDocumentBuilder();
> Document doc = db.newDocument();
> element =
> doc.createElementNS("http://schemas.xmlsoap.org/ws/2005/02/trust",
> tagName);
> } catch(Exception e){
> e.printStackTrace();
> }
> return element;
> }
>
>
> }
>
>
> Do anybody know why I am getting this errors and help me to find a
> solution?
> I'm new with CXF and Spring Boot.
>
> Kind regards,
>
> patrick
>
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.
> com/Bipro-Security-token-service-simple-Usernametoken-tp5777721.html
> Sent from the cxf-user mailing list archive at Nabble.com.
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com