I thought the problem was because WSS4J now is expecting a different keystore for trusted certs and another for keys... or it should be backward compatible?
On Tue, Jul 26, 2011 at 10:22 AM, Colm O hEigeartaigh <cohei...@apache.org>wrote: > Hi, > > Could you try with this jar? I fixed a problem recently in WSS4J that > sounds like it could be the problem here: > > > https://issues.apache.org/jira/secure/attachment/12487842/wss4j-1.6.2-SNAPSHOT.jar > > Colm. > > On Tue, Jul 19, 2011 at 3:34 PM, Jaime Hablutzel Egoavil > <hablutz...@gmail.com> wrote: > > NO I was using 2.3.5 because with 2.4.1 my configuration is not working, > a > > wsdl like this one: > > > > <?xml version='1.0' encoding='UTF-8'?><wsdl:definitions > > name="CXFLibraryImplService" > > targetNamespace="http://service2.ws.service.kprtech.com/"; > > xmlns:ns1="http://cxf.apache.org/bindings/xformat"; > > xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"; > > xmlns:tns="http://service2.ws.service.kprtech.com/"; > > xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"; > > xmlns:xsd="http://www.w3.org/2001/XMLSchema";> > > > > > > <wsp:Policy wsu:Id="SignEncr" > > xmlns:wsu=" > http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd > " > > xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy";> > > > > <wsp:ExactlyOne> > > <wsp:All> > > <sp:AsymmetricBinding > > xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702";> > > <wsp:Policy> > > <sp:InitiatorToken> > > <wsp:Policy> > > <sp:X509Token > > sp:IncludeToken=" > http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient > "> > > <wsp:Policy> > > <sp:RequireThumbprintReference/> > > <sp:WssX509V1Token10/> > > </wsp:Policy> > > </sp:X509Token> > > </wsp:Policy> > > </sp:InitiatorToken> > > <sp:RecipientToken> > > <wsp:Policy> > > <sp:X509Token > > sp:IncludeToken=" > http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never > "> > > <wsp:Policy> > > <sp:RequireThumbprintReference/> > > <sp:WssX509V3Token10/> > > </wsp:Policy> > > </sp:X509Token> > > </wsp:Policy> > > </sp:RecipientToken> > > <sp:AlgorithmSuite> > > <wsp:Policy> > > <sp:TripleDesRsa15/> > > </wsp:Policy> > > </sp:AlgorithmSuite> > > <sp:Layout> > > <wsp:Policy> > > <sp:Strict/> > > </wsp:Policy> > > </sp:Layout> > > <sp:IncludeTimestamp/> > > <sp:OnlySignEntireHeadersAndBody/> > > </wsp:Policy> > > </sp:AsymmetricBinding> > > <sp:Wss10 > > xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy";> > > <wsp:Policy> > > <sp:MustSupportRefKeyIdentifier/> > > <sp:MustSupportRefIssuerSerial/> > > </wsp:Policy> > > </sp:Wss10> > > <sp:SignedParts > > xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702";> > > <sp:Body/> > > </sp:SignedParts> > > > > </wsp:All> > > </wsp:ExactlyOne> > > </wsp:Policy> > > > > > > > > <wsdl:types> > > <xs:schema elementFormDefault="unqualified" > > targetNamespace="http://service2.ws.service.kprtech.com/"; version="1.0" > > xmlns:tns="http://service2.ws.service.kprtech.com/"; > > xmlns:xs="http://www.w3.org/2001/XMLSchema";> > > <xs:element name="sayHello" type="tns:sayHello" /> > > <xs:element name="sayHelloResponse" type="tns:sayHelloResponse" /> > > <xs:complexType name="sayHello"> > > <xs:sequence> > > <xs:element minOccurs="0" name="arg0" type="xs:string" /> > > </xs:sequence> > > </xs:complexType> > > <xs:complexType name="sayHelloResponse"> > > <xs:sequence> > > <xs:element minOccurs="0" name="return" type="xs:string" /> > > </xs:sequence> > > </xs:complexType> > > </xs:schema> > > > > </wsdl:types> > > <wsdl:message name="sayHelloResponse"> > > <wsdl:part element="tns:sayHelloResponse" name="parameters"> > > </wsdl:part> > > </wsdl:message> > > <wsdl:message name="sayHello"> > > <wsdl:part element="tns:sayHello" name="parameters"> > > </wsdl:part> > > </wsdl:message> > > > > <wsdl:portType name="Library"> > > <wsdl:operation name="sayHello"> > > <wsdl:input message="tns:sayHello" name="sayHello"> > > </wsdl:input> > > <wsdl:output message="tns:sayHelloResponse" > name="sayHelloResponse"> > > </wsdl:output> > > </wsdl:operation> > > </wsdl:portType> > > <wsdl:binding name="CXFLibraryImplServiceSoapBinding" > type="tns:Library"> > > <wsp:PolicyReference > > xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"; > > URI="#SignEncr"/> > > <soap:binding style="document" > > transport="http://schemas.xmlsoap.org/soap/http"; /> > > <wsdl:operation name="sayHello"> > > <soap:operation soapAction="" style="document" /> > > <wsdl:input name="sayHello"> > > <soap:body use="literal" /> > > </wsdl:input> > > <wsdl:output name="sayHelloResponse"> > > <soap:body use="literal" /> > > </wsdl:output> > > > > </wsdl:operation> > > </wsdl:binding> > > <wsdl:service name="CXFLibraryImplService"> > > <wsdl:port binding="tns:CXFLibraryImplServiceSoapBinding" > > name="CXFLibraryImplPort"> > > <soap:address > > location="http://localhost:8080/domicilios/services/service2"; /> > > </wsdl:port> > > </wsdl:service> > > </wsdl:definitions> > > > > > > The service exposed this way: > > > > > > <jaxws:endpoint id="service2" > > > > implementor="com.kprtech.service.ws.service2.CXFLibraryImpl" > > wsdlLocation="classpath:service2.wsdl" > > address="/service2"> > > > > <jaxws:properties> > > <entry key="ws-security.signature.properties" > > value="server-crypto.properties"/> > > <entry key="ws-security.signature.username" > value="serverkey"/> > > <!--<entry key="ws-security.encryption.username" > > value="useReqSigCert"/>--> > > <entry key="ws-security.callback-handler" > > value="com.kprtech.service.ws.impl.ServerCallback"/> > > </jaxws:properties> > > > > </jaxws:endpoint> > > > > > > ANd the client generated using cxf tool. > > > > This is working perfectly in 2.3.5 and and 2.2.6. Has something changed > for > > the 2.4.1 version when the wsdl first approach is used? > > I´m getting this error: > > > > 2011-07-19 09:26:23,720 [qtp32323148-24] WARN > > org.apache.cxf.phase.PhaseInterceptorChain - Interceptor for > > {http://service2.ws.service.kprtech.com/}CXFLibraryImplService has > thrown > > exception, unwinding now > > org.apache.cxf.binding.soap.SoapFault: The signature or decryption was > > invalid > > > > > > > > On Tue, Jul 19, 2011 at 3:36 AM, Colm O hEigeartaigh < > cohei...@apache.org> > > wrote: > >> > >> Hi Jaime, > >> > >> What version of CXF are you using? There is a better way to do this > >> than via a CXF interceptor from CXF 2.4.0 onwards. Trust validation is > >> done by WSS4J via the SignatureTrustValidator, which is given the > >> certificate used to verify the signature, and verifies trust via the > >> CertPath API. You can simply plug your own Validator implementation in > >> here instead. See this blog entry for more details: > >> > >> > >> > http://coheigea.blogspot.com/2011/06/custom-token-validation-in-apache-cxf.html > >> > >> Colm. > >> > >> On Mon, Jul 18, 2011 at 7:30 PM, Jaime Hablutzel Egoavil > >> <hablutz...@gmail.com> wrote: > >> > Hi I have a web service exposed with cxf with this wsdl: > >> > > >> > <?xml version='1.0' encoding='UTF-8'?><wsdl: > >> > definitions name="CXFLibraryImplService" targetNamespace=" > >> > http://service2.ws.service.kprtech.com/"; xmlns:ns1=" > >> > http://cxf.apache.org/bindings/xformat"; xmlns:soap=" > >> > http://schemas.xmlsoap.org/wsdl/soap/"; xmlns:tns=" > >> > http://service2.ws.service.kprtech.com/"; xmlns:wsdl=" > >> > http://schemas.xmlsoap.org/wsdl/"; xmlns:xsd=" > >> > http://www.w3.org/2001/XMLSchema";> > >> > <wsdl:types> > >> > <xs:schema elementFormDefault="unqualified" targetNamespace=" > >> > http://service2.ws.service.kprtech.com/"; version="1.0" xmlns:ns1=" > >> > http://cxf.apache.org/bindings/xformat"; xmlns:soap=" > >> > http://schemas.xmlsoap.org/wsdl/soap/"; xmlns:tns=" > >> > http://service2.ws.service.kprtech.com/"; xmlns:wsdl=" > >> > http://schemas.xmlsoap.org/wsdl/"; > >> > xmlns:xs="http://www.w3.org/2001/XMLSchema"; > >> > xmlns:xsd="http://www.w3.org/2001/XMLSchema";> > >> > <xs:element name="sayHello" type="tns:sayHello" /> > >> > <xs:element name="sayHelloResponse" type="tns:sayHelloResponse" /> > >> > <xs:complexType name="sayHello"> > >> > <xs:sequence> > >> > <xs:element minOccurs="0" name="arg0" type="xs:string" /> > >> > </xs:sequence> > >> > </xs:complexType> > >> > <xs:complexType name="sayHelloResponse"> > >> > <xs:sequence> > >> > <xs:element minOccurs="0" name="return" type="xs:string" /> > >> > </xs:sequence> > >> > </xs:complexType> > >> > </xs:schema> > >> > </wsdl:types> > >> > <wsdl:message name="sayHello"> > >> > <wsdl:part element="tns:sayHello" name="parameters"> > >> > </wsdl:part> > >> > </wsdl:message> > >> > <wsdl:message name="sayHelloResponse"> > >> > <wsdl:part element="tns:sayHelloResponse" name="parameters"> > >> > </wsdl:part> > >> > </wsdl:message> > >> > <wsdl:portType name="Library"> > >> > <wsdl:operation name="sayHello"> > >> > <wsdl:input message="tns:sayHello" name="sayHello"> > >> > </wsdl:input> > >> > <wsdl:output message="tns:sayHelloResponse" > >> > name="sayHelloResponse"> > >> > </wsdl:output> > >> > </wsdl:operation> > >> > </wsdl:portType> > >> > <wsdl:binding name="CXFLibraryImplServiceSoapBinding" > >> > type="tns:Library"> > >> > <wsp:PolicyReference URI="#SignEncr" xmlns:wsp=" > >> > http://schemas.xmlsoap.org/ws/2004/09/policy"; /> > >> > <soap:binding style="document" transport=" > >> > http://schemas.xmlsoap.org/soap/http"; /> > >> > <wsdl:operation name="sayHello"> > >> > <soap:operation soapAction="" style="document" /> > >> > <wsdl:input name="sayHello"> > >> > <soap:body use="literal" /> > >> > </wsdl:input> > >> > <wsdl:output name="sayHelloResponse"> > >> > <soap:body use="literal" /> > >> > </wsdl:output> > >> > </wsdl:operation> > >> > </wsdl:binding> > >> > <wsdl:service name="CXFLibraryImplService"> > >> > <wsdl:port binding="tns:CXFLibraryImplServiceSoapBinding" > >> > name="CXFLibraryImplPort"> > >> > <soap:address location=" > >> > http://localhost:8888/domicilios/services/service2"; /> > >> > </wsdl:port> > >> > </wsdl:service> > >> > <wsp:Policy wsu:Id="SignEncr" xmlns:wsp=" > >> > http://schemas.xmlsoap.org/ws/2004/09/policy"; xmlns:wsu=" > >> > > >> > > http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd > >> > "> > >> > > >> > <wsp:ExactlyOne> > >> > <wsp:All> > >> > <sp:AsymmetricBinding xmlns:sp=" > >> > http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702";> > >> > <wsp:Policy> > >> > <sp:InitiatorToken> > >> > <wsp:Policy> > >> > <sp:X509Token sp:IncludeToken=" > >> > > >> > > http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient > >> > "> > >> > <wsp:Policy> > >> > <sp:RequireThumbprintReference /> > >> > <sp:WssX509V1Token10 /> > >> > </wsp:Policy> > >> > </sp:X509Token> > >> > </wsp:Policy> > >> > </sp:InitiatorToken> > >> > <sp:RecipientToken> > >> > <wsp:Policy> > >> > <sp:X509Token sp:IncludeToken=" > >> > > >> > > http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never > >> > "> > >> > <wsp:Policy> > >> > <sp:RequireThumbprintReference /> > >> > <sp:WssX509V3Token10 /> > >> > </wsp:Policy> > >> > </sp:X509Token> > >> > </wsp:Policy> > >> > </sp:RecipientToken> > >> > <sp:AlgorithmSuite> > >> > <wsp:Policy> > >> > <sp:TripleDesRsa15 /> > >> > </wsp:Policy> > >> > </sp:AlgorithmSuite> > >> > <sp:Layout> > >> > <wsp:Policy> > >> > <sp:Strict /> > >> > </wsp:Policy> > >> > </sp:Layout> > >> > <sp:IncludeTimestamp /> > >> > <sp:OnlySignEntireHeadersAndBody /> > >> > </wsp:Policy> > >> > </sp:AsymmetricBinding> > >> > <sp:Wss10 xmlns:sp=" > >> > http://schemas.xmlsoap.org/ws/2005/07/securitypolicy";> > >> > <wsp:Policy> > >> > <sp:MustSupportRefKeyIdentifier /> > >> > <sp:MustSupportRefIssuerSerial /> > >> > </wsp:Policy> > >> > </sp:Wss10> > >> > <sp:SignedParts xmlns:sp=" > >> > http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702";> > >> > <sp:Body /> > >> > </sp:SignedParts> > >> > > >> > </wsp:All> > >> > </wsp:ExactlyOne> > >> > </wsp:Policy> > >> > </wsdl:definitions> > >> > > >> > > >> > And I want to be able to get the certificate in a custom intereceptor > to > >> > be > >> > able to pass it to spring security session context. > >> > Another thing I want is to be able to override the default behaviour > of > >> > cxf > >> > trying to validate the certPath, because I want to do this by my own > >> > because > >> > certificate aren't in a .jsk keystore but in a database. > >> > > >> > I have read that I need a second interceptor, but how to set an > >> > interceptor > >> > and give it lower precedence?? > >> > > >> > Thanks. > >> > > >> > > >> > > >> > -- > >> > Jaime Hablutzel - 9-9956-3299 > >> > > >> > (tildes omitidas intencionalmente) > >> > > >> > >> > >> > >> -- > >> Colm O hEigeartaigh > >> > >> http://coheigea.blogspot.com/ > >> Talend - http://www.talend.com > > > > > > > > -- > > Jaime Hablutzel - 9-9956-3299 > > > > (tildes omitidas intencionalmente) > > > > > > -- > Colm O hEigeartaigh > > http://coheigea.blogspot.com/ > Talend - http://www.talend.com > -- Jaime Hablutzel - 9-9956-3299 (tildes omitidas intencionalmente)
