[
https://issues.apache.org/jira/browse/CXF-7979?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16799158#comment-16799158
]
Colm O hEigeartaigh commented on CXF-7979:
------------------------------------------
Hi [~netmikey]
Firstly, thanks for the test-case - it makes resolving issues a lot easier.
The issue here is that you are using a Dispatch client and attaching policies
at the operation level. CXF does not know the operation for this case, and the
policies end up not being processed. The good news is that there is a very easy
fix, simply specify something like this to let CXF know what the operation is:
disp.getRequestContext().put(MessageContext.WSDL_OPERATION,
wsdlOperationQName);
I added a test-case here:
https://gitbox.apache.org/repos/asf?p=cxf.git;a=commit;h=6bf89e9c8804c8845ec4d38583dd33eea8256439
This fixes the first and third case listed in your README. I think the second
case is not valid (SecurePolicy applied to wsdl:binding, EmptyPolicy applied to
wsdl:output). EmptyPolicy will not override SecurePolicy on the response, so
having a secured response is "expected" for this case.
Colm.
> Issues when an operation's input and output should have different policies
> --------------------------------------------------------------------------
>
> Key: CXF-7979
> URL: https://issues.apache.org/jira/browse/CXF-7979
> Project: CXF
> Issue Type: Bug
> Components: JAX-WS Runtime
> Affects Versions: 3.3.0
> Environment: Tested with CXF 3.3.0, a reproducing example and unit
> test can be found here: https://github.com/netmikey/cxf-security-test
> Reporter: Mike M.
> Assignee: Colm O hEigeartaigh
> Priority: Major
>
> We think we might have found an issue in the way WSDL-Embedded WebService
> Security Policies are interpreted at runtime.
> We are in contract-first mode, but don't use generated JAXB bindings. We use
> a {{@WebServiceProvider}} implementation as a dynamic server and use
> {{javax.xml.ws.Dispatch}} to build a dynamic client.
> The issue happens when we try to apply different WSS-Policies to an
> operation's {{wsdl:input}} and {{wsdl:output}}, so e.g. having the request
> secured but the response non-secured.
> We see different behavior depending on where we put the
> {{wsp:PolicyReference}} within the WSDL, but we didn't manage to make it
> work: either the client doesn't encrypt the request at all, or the server
> encrypts the response as well.
> I created a small but fully functional project on GitHub that contains a unit
> test which demonstrates the behavior (be sure to check the project's README).
> Please have a look at: https://github.com/netmikey/cxf-security-test
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
