Werner, Roy, Yes ... I think can give it a try by turning off MTOM optimization ... however the thing that troubles me is that the client -> service configuration seems to be the same as service ->client config and it (client -> service) worked with MTOM optimization, where is seems to be replacing the binary content properly to be decrypted at the service.
Thoughts?? Thanks, Ruchith On 5/19/06, Dittmann, Werner <[EMAIL PROTECTED]> wrote:
Roy, Axis2 has a feature that optimizes transmission of binary data, AFAIK it convert base64 into real binary and send it over the wire. That save some bandwith. The problem is that the receiver cannot restore the base64 from the binary in exactly the same way as it was. Thus decryption and also signatuire processing have problems. You may switch off this optimization an try again, no "optimizeParts" parameter. Regards, Werner > -----Ursprüngliche Nachricht----- > Von: Reshef Roy [mailto:[EMAIL PROTECTED] > Gesendet: Freitag, 19. Mai 2006 17:12 > An: [email protected]; [email protected] > Betreff: Decryption of a complex Axis2 SOAP message fails in > WSS4J/XmlSec > > Hello WSS4J and Axis2 folks, > > I come back here on this issue which was discussed by > Brian and Werner on the WSS4J mailing list in March, > and has not been resolved. I am facing exactly the > same problem. I believe it is a WSS4J/XMLSec issue, > but I send it to both Axis2 and WSSS4J mailing lists. > The original thread I copied from the mail archive and > added at the bottom. > > My configuration is as follows: > - My webservice is running on Axis2 1.0 deployed on > Tomcat 5.5.16 > - My client application is a standalone Java > application using an Axis2 1.0 client repository > - jre1.5.0_06 > - relevant jar files in the Axis2 lib directory (both > the server and the client): wss4j-1.5.0, xmlsec-1.3.0, > xalan-2.7.0 (probably not relevant), various > javamail-1.4 jars (in case it has to do with the MTOM > attachment??). > - the security configuration of both the webservice > and the Axis2 client repository is similar to the one > in the security sample of Axis2 1.0. > > I send a simple SOAP message from the client to the > service, and get a complex, eventually a very complex, > SOAP message containing the data back. > > The client->server message works fine, both when I > configure it to be signed and encrypted and when I > don't. > The server->client message works fine without > signature and encryption, but fails on the same > exception as Brian's when the client side has to > decrypt it. > > At first I thought the fault was in our code, as the > generated XML was a mixture of XML generated by AXIOM > and "self-made" XML Strings in POJO code (however > Axis2 does escape the < sign). In the past few days I > cleaned our POJO code up completely, now the XML > message is generated solely by AXIOM. I still get the > following exception: > > [java] org.apache.axis2.AxisFault: > WSDoAllReceiver: security processing failed; nested > exception is: > [java] > org.apache.ws.security.WSSecurityException: Cannot > encrypt/decrypt data; nested exception is: > [java] > org.apache.xml.security.encryption.XMLEncryptionException: > Error while decoding > [java] Original Exception was > org.apache.xml.security.exceptions.Base64DecodingException: > Error while decoding > [java] at > org.apache.axis2.security.WSDoAllReceiver.processMessage(WSDoA > llReceiver.java:183) > [java] at > org.apache.axis2.security.handler.WSDoAllHandler.invoke(WSDoAl > lHandler.java:82) > [java] at > org.apache.axis2.engine.Phase.invoke(Phase.java:381) > [java] at > org.apache.axis2.engine.AxisEngine.invoke(AxisEngine.java:473) > [java] at > org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:445) > [java] at > org.apache.axis2.description.OutInAxisOperationClient.send(Out > InAxisOperation.java:355) > [java] at > org.apache.axis2.description.OutInAxisOperationClient.execute( > OutInAxisOperation.java:279) > [java] at > org.apache.axis2.client.ServiceClient.sendReceive(ServiceClien > t.java:457) > [java] at > org.apache.axis2.client.ServiceClient.sendReceive(ServiceClien > t.java:399) > [java] at > nitg.dino.dataclient.DataClient.sendDataRequest(Unknown > Source) > [java] at > nitg.dino.dataclient.DataClient.getData(Unknown > Source) > [java] at > nitg.dino.dataclient.DataClient.getData(Unknown > Source) > [java] at > nitg.dino.dataclient.DataClient.main(Unknown Source) > [java] Caused by: > org.apache.ws.security.WSSecurityException: Cannot > encrypt/decrypt data; nested exception is: > [java] > org.apache.xml.security.encryption.XMLEncryptionException: > Error while decoding > [java] Original Exception was > org.apache.xml.security.exceptions.Base64DecodingException: > Error while decoding > [java] at > org.apache.ws.security.processor.EncryptedKeyProcessor.decrypt > DataRef(EncryptedKeyProcessor.java:404) > [java] at > org.apache.ws.security.processor.EncryptedKeyProcessor.handleE > ncryptedKey(EncryptedKeyProcessor.java:328) > [java] at > org.apache.ws.security.processor.EncryptedKeyProcessor.handleE > ncryptedKey(EncryptedKeyProcessor.java:84) > [java] at > org.apache.ws.security.processor.EncryptedKeyProcessor.handleT > oken(EncryptedKeyProcessor.java:76) > [java] at > org.apache.ws.security.WSSecurityEngine.processSecurityHeader( > WSSecurityEngine.java:269) > [java] at > org.apache.ws.security.WSSecurityEngine.processSecurityHeader( > WSSecurityEngine.java:191) > [java] at > org.apache.axis2.security.WSDoAllReceiver.processMessage(WSDoA > llReceiver.java:180) > [java] ... 12 more > [java] Caused by: > org.apache.xml.security.encryption.XMLEncryptionException: > Error while decoding > [java] Original Exception was > org.apache.xml.security.exceptions.Base64DecodingException: > Error while decoding > [java] at > org.apache.xml.security.encryption.XMLCipherInput.getDecryptBy > tes(Unknown > Source) > [java] at > org.apache.xml.security.encryption.XMLCipherInput.getBytes(Unknown > Source) > [java] at > org.apache.xml.security.encryption.XMLCipher.decryptToByteArra > y(Unknown > Source) > [java] at > org.apache.xml.security.encryption.XMLCipher.decryptElement(Unknown > Source) > [java] at > org.apache.xml.security.encryption.XMLCipher.decryptElementCon > tent(Unknown > Source) > [java] at > org.apache.xml.security.encryption.XMLCipher.doFinal(Unknown > Source) > [java] at > org.apache.ws.security.processor.EncryptedKeyProcessor.decrypt > DataRef(EncryptedKeyProcessor.java:402) > [java] ... 18 more > > I attach here the following: > > 1. tcpmon capture when the messages are not secured > (here you can read the SOAP messages): > > ============== > Listen Port: 8070 > Target Host: 127.0.0.1 > Target Port: 8080 > ==== Request ==== > POST /axis2/services/PiezoService HTTP/1.1 > User-Agent: Axis/2.0 > Host: 127.0.0.1:8070 > Transfer-Encoding: chunked > Content-Type: multipart/related; > boundary=MIMEBoundaryurn_uuid_250A5D084C2807B5EA11480503381251; > type="application/xop+xml"; > start="<0.urn:uuid:[EMAIL PROTECTED]>"; > start-info="application/soap+xml"; > charset=UTF-8;action="urn:getPiezoById"; > > 3c3 > --MIMEBoundaryurn_uuid_250A5D084C2807B5EA11480503381251 > content-type:application/xop+xml; charset=UTF-8; > type="application/soap+xml"; > content-transfer-encoding:binary > content-id:<0.urn:uuid:[EMAIL PROTECTED]> > > <?xml version='1.0' > encoding='UTF-8'?><soapenv:Envelope > xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope"; > xmlns:wsa="http://www.w3.org/2005/08/addressing";><soapenv:Head > er><wsa:To>http://localhost:8070/axis2/services/PiezoService</ > wsa:To><wsa:ReplyTo><wsa:Address>http://www.w3.org/2005/08/add > ressing/anonymous</wsa:Address></wsa:ReplyTo><wsa:MessageID>ur > n:uuid:5DDEADED942C61847311480503378751</wsa:MessageID><wsa:Ac > tion>urn:getPiezoById</wsa:Action></soapenv:Header><soapenv:Bo > dy><getPiezoById > xmlns="http://dinoservices.nitg.tno.nl";><parameters><iD>NL-B02 C0214-002</iD><dataLevel>2</dataLevel></parameters></getPiezoById></soapenv:Body></soapenv:Envelope> > --MIMEBoundaryurn_uuid_250A5D084C2807B5EA11480503381251-- > 0 > > ==== Response ==== > HTTP/1.1 200 OK > Server: Apache-Coyote/1.1 > Set-Cookie: > JSESSIONID=80BC3E2AB2786F5FE2E017D5018E4053; > Path=/axis2 > Content-Type: multipart/related; > boundary=MIMEBoundaryurn_uuid_CD4AEADBBA124E2FB111480503456713; > type="application/xop+xml"; > start="<0.urn:uuid:[EMAIL PROTECTED]>"; > start-info="application/soap+xml";charset=UTF-8 > Transfer-Encoding: chunked > Date: Fri, 19 May 2006 14:52:25 GMT > > 979 > --MIMEBoundaryurn_uuid_CD4AEADBBA124E2FB111480503456713 > content-type:application/xop+xml; charset=UTF-8; > type="application/soap+xml"; > content-transfer-encoding:binary > content-id:<0.urn:uuid:[EMAIL PROTECTED]> > > <?xml version='1.0' > encoding='UTF-8'?><soapenv:Envelope > xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope"; > xmlns:wsa="http://www.w3.org/2005/08/addressing";><soapenv:Head > er><wsa:To>http://www.w3.org/2005/08/addressing/anonymous</wsa > :To><wsa:ReplyTo><wsa:Address>http://www.w3.org/2005/08/addres > sing/anonymous</wsa:Address></wsa:ReplyTo><wsa:From><wsa:Addre > ss>http://localhost:8070/axis2/services/PiezoService</wsa:Addr > ess></wsa:From><wsa:FaultTo><wsa:Address>http://localhost:8070 > /axis2/services/PiezoService</wsa:Address></wsa:FaultTo><wsa:M > essageID>urn:uuid:66AB8BB9CA1E1D2D0511480503384064</wsa:Messag > eID><wsa:Action>urn:getPiezoById</wsa:Action><wsa:RelatesTo > wsa:RelationshipType="wsa:Reply">urn:uuid:5DDEADED942C61847311 > 480503378751</wsa:RelatesTo></soapenv:Header><soapenv:Body><response > xmlns="http://dinoservices.nitg.tno.nl"; > xmlns:tns="http://dinoservices.nitg.tno.nl/";><result><piezometers > xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; > xsi:schemaLocation="http://dinoservices.nitg.tno.nl/xml/namesp > ace/piezometer/piezometer-v1.0/xsd"><meta><dateformat > src="ISO8601" format="YYYY-MM-DDThh:mmTZD" > /><coordinateSystem alias="WSG84" name="World Geodetic > System 1984" src="EPSG" code="4326" unit="decimal > degrees" /><levelReference alias="NAP" name="Normaal > Amsterdams Peil" src="EPSG" code="5109" unit="cm" > /><country src="ISO3166" /><language src="ISO639-2" > /><date>2006-05-19T16:52+0200</date></meta><piezometer > Id="NL-B02C0214-002"><country>NL</country><language>NLD</langu > age><databasename>DINO</databasename><ownerOrg>TNO-NITG</owner > Org><location > coordinates="5.87971132 53.44542629" > /><surfaceLevelHeight>327</surfaceLevelHeight><municipality>AM ELAND</municipality><topDepth>-559</topDepth><bottomDepth>-659</bottomDepth><headCount>195</headCount><firstHeadDate>2005-06-27T00:00+> 0200</firstHeadDate><lastHeadDate></lastHeadDate><groundwaterb > ody></groundwaterbody><aquifer></aquifer><verticalDatumCd>NAP< > /verticalDatumCd></piezometer></piezometers></result><meta><pi > ezometersFound><piezometer > Id="NL-B02C0214-002" > /></piezometersFound></meta><parameters><iD>NL-B02C0214-002</i > D><dataLevel>2</dataLevel></parameters></response></soapenv:Bo > dy></soapenv:Envelope> > 3b > > --MIMEBoundaryurn_uuid_CD4AEADBBA124E2FB111480503456713-- > 0 > > > ============== > > 2. tcpmon capture when the messages are secured: > > > ============== > Listen Port: 8070 > Target Host: 127.0.0.1 > Target Port: 8080 > ==== Request ==== > POST /axis2/services/PiezoService HTTP/1.1 > User-Agent: Axis/2.0 > Host: 127.0.0.1:8070 > Transfer-Encoding: chunked > Content-Type: multipart/related; > boundary=MIMEBoundaryurn_uuid_0F722611FABF8E534811480473705931; > type="application/xop+xml"; > start="<0.urn:uuid:[EMAIL PROTECTED]>"; > start-info="application/soap+xml"; > charset=UTF-8;action="urn:getPiezoById"; > > 13b3 > --MIMEBoundaryurn_uuid_0F722611FABF8E534811480473705931 > content-type:application/xop+xml; charset=UTF-8; > type="application/soap+xml"; > content-transfer-encoding:binary > content-id:<0.urn:uuid:[EMAIL PROTECTED]> > > <?xml version='1.0' > encoding='UTF-8'?><soapenv:Envelope > xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope"; > xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"; > xmlns:wsa="http://www.w3.org/2005/08/addressing";><soapenv:Header> > <wsse:Security > xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-20040 > 1-wss-wssecurity-secext-1.0.xsd" > soapenv:mustUnderstand="true"><xenc:EncryptedKey > Id="EncKeyId-30222347"> > <xenc:EncryptionMethod > Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"; > /> > <ds:KeyInfo > xmlns:ds="http://www.w3.org/2000/09/xmldsig#";> > <wsse:SecurityTokenReference><wsse:KeyIdentifier > EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200 > 401-wss-soap-message-security-1.0#Base64Binary" > ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-x509-token-profile-1.0#X509SubjectKeyIdentifier">WwslVkkU > D5Hwc9RYmoumJM77NkU=</wsse:KeyIdentifier></wsse:SecurityTokenR > eference> > </ds:KeyInfo> > <xenc:CipherData><xenc:CipherValue>bbu+tRp03z7q4CSB60iseEDiL+z LzdyPZinq2AhN51Mh1/0QkFpN4Ma5Bz/TXwa/HkU9yA2QjZeE6WM4OCxFLE/xp2pviN8uzbIe9TKBN5lU2jXH2n3g5Sczux0GAjcbmXlKcbbY6NLbxQYztbW5TR9ZxMQzg2scjh+ARNHWqxg=</xenc:Ci> pherValue></xenc:CipherData> > <xenc:ReferenceList><xenc:DataReference > URI="#EncDataId-23585701" > /></xenc:ReferenceList></xenc:EncryptedKey><ds:Signature > xmlns:ds="http://www.w3.org/2000/09/xmldsig#"; > Id="Signature-2595047"> > <ds:SignedInfo> > <ds:CanonicalizationMethod > Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"; /> > <ds:SignatureMethod > Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"; > /> > <ds:Reference URI="#id-19940306"> > <ds:Transforms> > <ds:Transform > Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"; /> > </ds:Transforms> > <ds:DigestMethod > Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"; /> > <ds:DigestValue>RVXkLPDEzDcaz9eWPVUCe2TYRAE=</ds:DigestValue> > </ds:Reference> > <ds:Reference URI="#id-540190"> > <ds:Transforms> > <ds:Transform > Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"; /> > </ds:Transforms> > <ds:DigestMethod > Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"; /> > <ds:DigestValue>RRNThBrxXGcBMajnZx40dbE5hog=</ds:DigestValue> > </ds:Reference> > <ds:Reference URI="#id-19287723"> > <ds:Transforms> > <ds:Transform > Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"; /> > </ds:Transforms> > <ds:DigestMethod > Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"; /> > <ds:DigestValue>Y7zvA4ZQzm6h/X8yGk8zoDKyoZw=</ds:DigestValue> > </ds:Reference> > <ds:Reference URI="#Timestamp-31614731"> > <ds:Transforms> > <ds:Transform > Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"; /> > </ds:Transforms> > <ds:DigestMethod > Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"; /> > <ds:DigestValue>HeP5hnTJ+QDGXheAmyfCjpJVe1I=</ds:DigestValue> > </ds:Reference> > </ds:SignedInfo> > <ds:SignatureValue> > NPwfdrsuexLCM3/Ji4NHDZtK0tcnJoBlbUc3YNcpfoP8eog75ztt1GXQrRtdxR > V++vMbmZu9svPq > at7joxw2Qst9nfP0zpEKiFtbSf1YvkiRrubF8C6DonLhem/D3jsP97VclWPPyz > q77/3MHTGAA8lq > wef3fglnBEXOrnXvEMQ= > </ds:SignatureValue> > <ds:KeyInfo Id="KeyId-31556811"> > <wsse:SecurityTokenReference > xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-wssecurity-utility-1.0.xsd" > wsu:Id="STRId-15245345"><wsse:KeyIdentifier > EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200 > 401-wss-soap-message-security-1.0#Base64Binary" > ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-x509-token-profile-1.0#X509SubjectKeyIdentifier">QrCDsN5t > WGrPLZHfPNw7lqOoSvA=</wsse:KeyIdentifier></wsse:SecurityTokenR > eference> > </ds:KeyInfo> > </ds:Signature><wsu:Timestamp > xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-wssecurity-utility-1.0.xsd" > wsu:Id="Timestamp-31614731"><wsu:Created>2006-05-19T14:02:44.9 > 68Z</wsu:Created><wsu:Expires>2006-05-19T14:07:44.968Z</wsu:Ex > pires></wsu:Timestamp></wsse:Security><wsa:To > xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-wssecurity-utility-1.0.xsd" > wsu:Id="id-19940306">http://localhost:8070/axis2/services/Piez > oService</wsa:To><wsa:ReplyTo > xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-wssecurity-utility-1.0.xsd" > wsu:Id="id-540190"><wsa:Address>http://www.w3.org/2005/08/addr > essing/anonymous</wsa:Address></wsa:ReplyTo><wsa:MessageID > xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-wssecurity-utility-1.0.xsd" > wsu:Id="id-19287723">urn:uuid:B53BA331374DCA64F511480473618591 > </wsa:MessageID><wsa:Action>urn:getPiezoById</wsa:Action></soa > penv:Header><soapenv:Body><xenc:EncryptedData > Id="EncDataId-23585701" > Type="http://www.w3.org/2001/04/xmlenc#Content";><xenc:EncryptionMethod > Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"; > /><xenc:CipherData><xenc:CipherValue><xop:Include > href="cid:1.urn:uuid:[EMAIL PROTECTED]" > xmlns:xop="http://www.w3.org/2004/08/xop/include"; > /></xenc:CipherValue></xenc:CipherData></xenc:EncryptedData></ > soapenv:Body></soapenv:Envelope> > 246 > > --MIMEBoundaryurn_uuid_0F722611FABF8E534811480473705931 > content-id:<1.urn:uuid:[EMAIL PROTECTED]> > content-type:application/octet-stream > content-transfer-encoding:binary > > ��I?�2��1�)\� �� > 5� �=�rw�? > ��E��v39O)�j��iW�?��G�yÖ"9�3�� > ?s��l�� QbÆŠ# > �i� Å·:qÜ«; > ~��3t� > ��\a��՞D�Z���?����7�Q��τP > �$��X}�0� > Í"{+%� > ��p)1���� > �[9Q3-et �E�u�/i���ܪ�T��Y7Hn��P�( > y{| > �� > P\��x��?; ��$-� > ���cw+# > L^�3���͢�:�� �?5Â(c)���Í"b�Qs[�S9cï¿ > ½ï¿½P+��fw > �SЦ䱻���ˢ��B? > ]� �?�L���0�\2_t�� > --MIMEBoundaryurn_uuid_0F722611FABF8E534811480473705931-- > 0 > > ==== Response ==== > HTTP/1.1 200 OK > Server: Apache-Coyote/1.1 > Set-Cookie: > JSESSIONID=703634597AA0DE46C23CA3F5F9D1F2DF; > Path=/axis2 > Content-Type: multipart/related; > boundary=MIMEBoundaryurn_uuid_994A544365FAB6DE4611480473745004; > type="application/xop+xml"; > start="<0.urn:uuid:[EMAIL PROTECTED]>"; > start-info="application/soap+xml";charset=UTF-8 > Transfer-Encoding: chunked > Date: Fri, 19 May 2006 14:02:54 GMT > > 17b5 > --MIMEBoundaryurn_uuid_994A544365FAB6DE4611480473745004 > content-type:application/xop+xml; charset=UTF-8; > type="application/soap+xml"; > content-transfer-encoding:binary > content-id:<0.urn:uuid:[EMAIL PROTECTED]> > > <?xml version='1.0' > encoding='UTF-8'?><soapenv:Envelope > xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope"; > xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"; > xmlns:wsa="http://www.w3.org/2005/08/addressing";><soapenv:Header> > <wsse:Security > xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-20040 > 1-wss-wssecurity-secext-1.0.xsd" > soapenv:mustUnderstand="true"><xenc:EncryptedKey > Id="EncKeyId-24577551"> > <xenc:EncryptionMethod > Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"; > /> > <ds:KeyInfo > xmlns:ds="http://www.w3.org/2000/09/xmldsig#";> > <wsse:SecurityTokenReference><wsse:KeyIdentifier > EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200 > 401-wss-soap-message-security-1.0#Base64Binary" > ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-x509-token-profile-1.0#X509SubjectKeyIdentifier">QrCDsN5t > WGrPLZHfPNw7lqOoSvA=</wsse:KeyIdentifier></wsse:SecurityTokenR > eference> > </ds:KeyInfo> > <xenc:CipherData><xenc:CipherValue>kEOEcMSSUdDdGGQZ5X/u1fMIuB6 Hk3WCioqiDDz3xc9T1Uoore6WDsCTtKj5/yT/bc6ynnm6PCjD14IXbgjnV7YeVrEtQNIkbU0cSkynGFXfwJOQS2GW2ynSHjc2/9NH5ps2tXxcvKjolD/z74Nc0Vi/0fB54YZRadKSr9prB+o=</xenc:Ci> pherValue></xenc:CipherData> > <xenc:ReferenceList><xenc:DataReference > URI="#EncDataId-19854534" > /></xenc:ReferenceList></xenc:EncryptedKey><ds:Signature > xmlns:ds="http://www.w3.org/2000/09/xmldsig#"; > Id="Signature-32181456"> > <ds:SignedInfo> > <ds:CanonicalizationMethod > Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"; /> > <ds:SignatureMethod > Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"; > /> > <ds:Reference URI="#id-20319379"> > <ds:Transforms> > <ds:Transform > Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"; /> > </ds:Transforms> > <ds:DigestMethod > Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"; /> > <ds:DigestValue>ZU+r4GxWvcFb0h2kjo0Q/Le7Sr8=</ds:DigestValue> > </ds:Reference> > <ds:Reference URI="#id-24356426"> > <ds:Transforms> > <ds:Transform > Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"; /> > </ds:Transforms> > <ds:DigestMethod > Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"; /> > <ds:DigestValue>GhnxOw33uQNB3UDR2/t1tRU1bNs=</ds:DigestValue> > </ds:Reference> > <ds:Reference URI="#id-27940994"> > <ds:Transforms> > <ds:Transform > Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"; /> > </ds:Transforms> > <ds:DigestMethod > Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"; /> > <ds:DigestValue>IQ1OIg2k4sJrA9BeSEozRs/uDIo=</ds:DigestValue> > </ds:Reference> > <ds:Reference URI="#Timestamp-15081761"> > <ds:Transforms> > <ds:Transform > Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"; /> > </ds:Transforms> > <ds:DigestMethod > Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"; /> > <ds:DigestValue>M0Kyhqu96pO7U+YnCEpUZ7HShHM=</ds:DigestValue> > </ds:Reference> > <ds:Reference URI="#SigConf-10372485"> > <ds:Transforms> > <ds:Transform > Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"; /> > </ds:Transforms> > <ds:DigestMethod > Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"; /> > <ds:DigestValue>9ORNHkyu7Avgl2zBxvxK5AytTiM=</ds:DigestValue> > </ds:Reference> > </ds:SignedInfo> > <ds:SignatureValue> > d4HGDbFD/N4q4G6QTRz/HiTeXEZ3Td5YuRx60VhKycJAdxxPI6HaRwlcM0NKLQ > 4gmLhxaJ5N05k8 > DGnQ4V3u1bibC1LMfgyPwhnkkUUh4EYlGz6qacQxX4A9SBhyJ5pcRiUPoSHT64 > tCGO+AR6IZctX3 > +ovvtTeV1Le/6XVDFm4= > </ds:SignatureValue> > <ds:KeyInfo Id="KeyId-9847088"> > <wsse:SecurityTokenReference > xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-wssecurity-utility-1.0.xsd" > wsu:Id="STRId-9550256"><wsse:KeyIdentifier > EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200 > 401-wss-soap-message-security-1.0#Base64Binary" > ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-x509-token-profile-1.0#X509SubjectKeyIdentifier">WwslVkkU > D5Hwc9RYmoumJM77NkU=</wsse:KeyIdentifier></wsse:SecurityTokenR > eference> > </ds:KeyInfo> > </ds:Signature><wsu:Timestamp > xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-wssecurity-utility-1.0.xsd" > wsu:Id="Timestamp-15081761"><wsu:Created>2006-05-19T14:02:54.4 > 53Z</wsu:Created><wsu:Expires>2006-05-19T14:07:54.453Z</wsu:Ex > pires></wsu:Timestamp><wsse11:SignatureConfirmation > xmlns:wsse11="http://docs.oasis-open.org/wss/2005/xx/oasis-200 > 5xx-wss-wssecurity-secext-1.1.xsd" > xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-wssecurity-utility-1.0.xsd" > Value="NPwfdrsuexLCM3/Ji4NHDZtK0tcnJoBlbUc3YNcpfoP8eog75ztt1GX > QrRtdxRV++vMbmZu9svPqat7joxw2Qst9nfP0zpEKiFtbSf1YvkiRrubF8C6Do > nLhem/D3jsP97VclWPPyzq77/3MHTGAA8lqwef3fglnBEXOrnXvEMQ=" > wsu:Id="SigConf-10372485" /></wsse:Security><wsa:To > xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-wssecurity-utility-1.0.xsd" > wsu:Id="id-20319379">http://www.w3.org/2005/08/addressing/anon > ymous</wsa:To><wsa:ReplyTo > xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-wssecurity-utility-1.0.xsd" > wsu:Id="id-24356426"><wsa:Address>http://www.w3.org/2005/08/ad > dressing/anonymous</wsa:Address></wsa:ReplyTo><wsa:From><wsa:A > ddress>http://localhost:8070/axis2/services/PiezoService</wsa: > Address></wsa:From><wsa:FaultTo><wsa:Address>http://localhost: > 8070/axis2/services/PiezoService</wsa:Address></wsa:FaultTo><w > sa:MessageID > xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401 > -wss-wssecurity-utility-1.0.xsd" > wsu:Id="id-27940994">urn:uuid:B36C4B2CB527DEB8FF11480473708284 > </wsa:MessageID><wsa:Action>urn:getPiezoById</wsa:Action><wsa: > RelatesTo > wsa:RelationshipType="wsa:Reply">urn:uuid:B53BA331374DCA64F511 > 480473618591</wsa:RelatesTo></soapenv:Header><soapenv:Body><xe > nc:EncryptedData > Id="EncDataId-19854534" > Type="http://www.w3.org/2001/04/xmlenc#Content";><xenc:EncryptionMethod > Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"; > /><xenc:CipherData><xenc:CipherValue><xop:Include > href="cid:1.urn:uuid:[EMAIL PROTECTED]" > xmlns:xop="http://www.w3.org/2004/08/xop/include"; > /></xenc:CipherValue></xenc:CipherData></xenc:EncryptedData></ > soapenv:Body></soapenv:Envelope> > 7e6 > > --MIMEBoundaryurn_uuid_994A544365FAB6DE4611480473745004 > content-id:<1.urn:uuid:[EMAIL PROTECTED]> > content-type:application/octet-stream > content-transfer-encoding:binary > > �-\mW����\�c�1],Q[� > �����y�����0\�+�n3�𖕞�?Q > �}m > > �F�}��8e�P�97`H���XF�?o��r��� > J)@ N%��,�z��� > Ҙ��=�T�u$f=~�9� ?cLCt>u����Y > �C�ß(r)��v�*����T�Q > =p�f�D���H}�\qc= 1�b�jq��??Cw�R6 ?%{fV > UÛ(r)�"d2r� > [EMAIL PROTECTED] ���}Q�ʥ# > ��7�V?� �8��6K� > �����W��{��4Y��nxz`�o��M3mo�aCܦ > �l�d���M?c??9w}� > �4��Ŵ�d�OVK�1]��������]c�ï > ¿½ï¿½z���2�a ���� > ��t�B�d�ZxJJ~=�K%t�(�K�ὡ5�SDo]�� > r�^��٨i) > ��s��e��̆[��B'f\j�1F��:��?NU‡�[ > �6}h�W팷��4���c��BW��] > =g]t�A*پ� �x(� > ��m%L^��V׾���2��� > �����dgԼ��I�C9>���nzW>� ��� > 8�` 3��n�DMR���Y{u�[V�Ŵ > �r�܆���.aaq�t��'3J?e.�� > (�|ر� �nоYҪ�;��\���Y > bA?�}NY��hL�L<\s�_2�R=b��Tz6����"ï > ¿½Z�:�Ts��tGî´'@�n[�Cd�����D�z�S ï > ¿½(�2�C.��; > �WH�6? > H�a?8T�?��9�X�6�b��g��tθ�$[?ï¿ > ½ï¿½N�I��P��%b&���i>� > &�n��%��^D���~��4 > ��j�a�z �vO���<k��s*� > ��UQL`�t�� > #�Q?��ݻ��ꡫ&� > \�?A& > y�.�0��Ǻ_Z烙��?�?3f)#\ > 0�L][pG<��pWL=B�~v}U���D����|�0<R�ï > ¿½|�}%�?�h*��Q֞�0��t�zi�, > s�,��ע�N��� � > ��F��B�l�$=� > 1� > �?t[I�pne��ѷscDE���6V7���"� ��.>�� > ����Q?^��P����} > �m�S;* ]SFj��ܱ�NY������57侰�[9�ï > ¿½ï¿½ �BA/�����_ > �_(C��P > Yl7�BÄž4�W��. > J()�Eܡ�滼�|q > ��?%�I2�)K�n��&馡o��,[ > �s_<A�+nt'�6�yC?�7���3�*�� > �W�oFEN� nW6�?�� > E��$�6�7s��w�?M��b����qB55�-�� > ;�PB��%�9K?�pQ� > t�q��+�t��uJ��6�?��[Ð'[EMAIL PROTECTED]>!� > �j�xj�)oY��L:�'� > ��A���M�OxO��b��o�>t��!�+:�q@ > D�?��AzmB$� > &vn�����uѬ�e,��߹;�:[EMAIL PROTECTED] > Q]�k��]Û‰;5���Av]�K�d�?d|`^��kÂ¼ï¿½ï¿ > ½E��R]-ШR > T/o�DM��IW!r?����7�e�e��E�dï¿½ï¿½ï¿ > ½}WÕµPݬJIC�nÒ§v#`�� > ?Ն�]���'�,��Ի��p?%#��?\|��hMg= ï > ¿½ï¿½ï¿½ï¿½Í"[EMAIL PROTECTED] > > �#`X�{dϼ���b�=B > � �v��CL8G5͡��5,{] �����&�&!�?� > m��O�L>;��'B�Ѕ7�=K\�7Ëžk){���ھ-ï > ¿½s��� > Kt > <�=��1zo��(�/�ݰT����׽K����}F > �'�n*z��x�ot%�^4H��k�jF > oY�? vB�t > --MIMEBoundaryurn_uuid_994A544365FAB6DE4611480473745004-- > 0 > > > ============== > > > > 3. Axis2 client configuration > > <parameter name="OutflowSecurity"> > <action> > <items>Timestamp Signature Encrypt</items> > <user>pres_service</user> > > <passwordCallbackClass>nitg.dino.dst.security.PWCallbackHandle > r</passwordCallbackClass> > > <signaturePropFile>security.properties</signaturePropFile> > > <encryptionPropFile>security.properties</encryptionPropFile> > > <signatureKeyIdentifier>SKIKeyIdentifier</signatureKeyIdentifier> > > <encryptionKeyIdentifier>SKIKeyIdentifier</encryptionKeyIdentifier> > <encryptionUser>data_service</encryptionUser> > > <signatureParts>{Element}{http://www.w3.org/2005/08/addressing > }To;{Element}{http://www.w3.org/2005/08/addressing}ReplyTo;{El > ement}{http://www.w3.org/2005/08/addressing}MessageID;{Element > }{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wsse > curity-utility-1.0.xsd}Timestamp</signatureParts> > > > <optimizeParts>//xenc:EncryptedData/xenc:CipherData/xenc:Ciphe > rValue</optimizeParts> > </action> > </parameter> > > <parameter name="InflowSecurity"> > <action> > <items>Timestamp Signature Encrypt</items> > > <passwordCallbackClass>nitg.dino.dst.security.PWCallbackHandle > r</passwordCallbackClass> > > <signaturePropFile>security.properties</signaturePropFile> > > <decryptionPropFile>security.properties</decryptionPropFile> > </action> > </parameter> > > --- > 4. Axis2 service configuration > > <parameter name="OutflowSecurity"> > <action> > <items>Timestamp Signature Encrypt</items> > <user>data_service</user> > > <passwordCallbackClass>nitg.dino.dst.security.PWCallbackHandle > r</passwordCallbackClass> > > <signaturePropFile>security.properties</signaturePropFile> > > <encryptionPropFile>security.properties</encryptionPropFile> > > <signatureKeyIdentifier>SKIKeyIdentifier</signatureKeyIdentifier> > > <encryptionKeyIdentifier>SKIKeyIdentifier</encryptionKeyIdentifier> > <encryptionUser>pres_service</encryptionUser> > > <signatureParts>{Element}{http://www.w3.org/2005/08/addressing > }To;{Element}{http://www.w3.org/2005/08/addressing}ReplyTo;{El > ement}{http://www.w3.org/2005/08/addressing}MessageID;{Element > }{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wsse > curity-utility-1.0.xsd}Timestamp</signatureParts> > > <optimizeParts>//xenc:EncryptedData/xenc:CipherData/xenc:Ciphe > rValue</optimizeParts> > </action> > </parameter> > > <parameter name="InflowSecurity"> > <action> > <items>Timestamp Signature Encrypt</items> > > <passwordCallbackClass>nitg.dino.dst.security.PWCallbackHandle > r</passwordCallbackClass> > > <signaturePropFile>security.properties</signaturePropFile> > > <decryptionPropFile>security.properties</decryptionPropFile> > </action> > </parameter> > > > Any help would be appreciated! > > Thanks, > > / Roy > > > > > > > > > ---- > > > Werner, > > I got distracted with other issues yesterday evening > > > so didnt get to explore much more. What I have > > narrowed it down to is this: > > It will send a simple string as a parameter both > > securely and unsecurely > > It will send a simple xml string as a parameter both > > > securely and unsecurely > > > > The XML String i need to send, and it is having > > problems with, is quite complex. It contains a full > > XML document as a CDATA element of the parent > > document, where i am interested in sending the > parent > > document. > > As i said, i have made some headway in narrowing > down > > exxactly what is causing the errors and will repost > > when I find exactly what is causing it. > > BTW, there is an embedded axis function that escapes > > > the angle brackets (only the < bracket needs to be > > escaped). This is not an issue as simple > > XML is working. > > > > Regards, > > Brian. > > > > Werner Dittmann wrote: > > >Brian, > > > >WSS4J uses a specific Axis method to set the message > generated by > >WSS4J that includes the security header as the new > message to send. > >Maybe there is a problem in that area - I'll test > this during the next > >day (maybe weekend). > > > >It would be helpful if you can provide me the message > you are going > >to send (the XML string). Do you escape the angle > bracket in your > >program or is this an embedded Axis function? > > > >Regards, > >Werner > > > > > >Brian Shields wrote: > > > > > >>Werner, > >>Yes I have tested it without security in place and > is working fine! > >>Angle brackets are modified to < to avoid errors! > >>Regards, > >>Brian. > >> > >>Werner Dittmann wrote: > >> > >> > >> > >>>Brian, > >>> > >>>did you test this without security enabled? Sending > an XML string > >>>may require some modifications to escape angle > bracket. > >>> > >>>Regards, > >>>Werner > >>> > >>> > >>>Brian Shields wrote: > >>> > >>> > >>> > >>> > >>>>Hi Guys, > >>>>I have a secure service established using wss4j > and connect to it using > >>>>a simple client. For testing purposes this is an > echo service. It works > >>>>perfectly when i pass a simple string as the > parameter to the call, > >>>>however when i pass it a string which is generated > from an > >>>>org.jdom.Document using an > org.jdom.output.XMLOutputter i get the errors > >>>>below. Is there something i have to do to the > String? or the Document > >>>>before outputting? > >>>>Thanks, > >>>>Brian. > >>>> > >>>>org.apache.ws.security.WSSecurityException: Cannot > encrypt/decrypt data; > >>>>nested exception is: > >>>> > org.apache.xml.security.encryption.XMLEncryptionException: > Error > >>>>while decoding > >>>>Original Exception was > >>>>org.apache.xml.security.exceptions.Base64DecodingException: > Error while > >>>>decoding > >>>> at > >>>>org.apache.ws.security.processor.EncryptedKeyProcessor.dec > ryptDataRef(EncryptedKeyProcessor.java:388) > >>>> > >>>> > >>>> at > >>>>org.apache.ws.security.processor.EncryptedKeyProcessor.han > dleEncryptedKey(EncryptedKeyProcessor.java:313) > >>>> > >>>> > >>>> at > >>>>org.apache.ws.security.processor.EncryptedKeyProcessor.han > dleEncryptedKey(EncryptedKeyProcessor.java:81) > >>>> > >>>> > >>>> at > >>>>org.apache.ws.security.processor.EncryptedKeyProcessor.han > dleToken(EncryptedKeyProcessor.java:75) > >>>> > >>>> > >>>> at > >>>>org.apache.ws.security.WSSecurityEngine.processSecurityHea > der(WSSecurityEngine.java:252) > >>>> > >>>> > >>>> at > >>>>org.apache.ws.security.WSSecurityEngine.processSecurityHea > der(WSSecurityEngine.java:179) > >>>> > >>>> > >>>> at > >>>>org.apache.axis2.security.WSDoAllReceiver.invoke(WSDoAllRe > ceiver.java:161) > >>>> > >>>> at > org.apache.axis2.engine.Phase.invoke(Phase.java:376) > >>>> at > org.apache.axis2.engine.AxisEngine.invoke(AxisEngine.java:351) > >>>> at > org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:322) > >>>> at > >>>>org.apache.axis2.transport.http.HTTPTransportUtils.process > HTTPPostRequest(HTTPTransportUtils.java:274) > >>>> > >>>> > >>>> at > >>>>org.apache.axis2.transport.http.AxisServlet.doPost(AxisSer > vlet.java:150) > >>>> at > javax.servlet.http.HttpServlet.service(HttpServlet.java:709) > >>>> at > javax.servlet.http.HttpServlet.service(HttpServlet.java:802) > >>>> at > >>>>org.apache.catalina.core.ApplicationFilterChain.internalDo > Filter(ApplicationFilterChain.java:252) > >>>> > >>>> > >>>> at > >>>>org.apache.catalina.core.ApplicationFilterChain.doFilter(A > pplicationFilterChain.java:173) > >>>> > >>>> > >>>> at > >>>>org.apache.catalina.core.StandardWrapperValve.invoke(Stand > ardWrapperValve.java:213) > >>>> > >>>> > >>>> at > >>>>org.apache.catalina.core.StandardContextValve.invoke(Stand > ardContextValve.java:178) > >>>> > >>>> > >>>> at > >>>>org.apache.catalina.core.StandardHostValve.invoke(Standard > HostValve.java:126) > >>>> > >>>> > >>>> at > >>>>org.apache.catalina.valves.ErrorReportValve.invoke(ErrorRe > portValve.java:105) > >>>> > >>>> > >>>> at > >>>>org.apache.catalina.core.StandardEngineValve.invoke(Standa > rdEngineValve.java:107) > >>>> > >>>> > >>>> at > >>>>org.apache.catalina.connector.CoyoteAdapter.service(Coyote > Adapter.java:148) > >>>> > >>>> at > >>>>org.apache.coyote.http11.Http11Processor.process(Http11Pro > cessor.java:856) > >>>> > >>>> at > >>>>org.apache.coyote.http11.Http11Protocol$Http11ConnectionHa > ndler.processConnection(Http11Protocol.java:744) > >>>> > >>>> > >>>> at > >>>>org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(P > oolTcpEndpoint.java:527) > >>>> > >>>> > >>>> at > >>>>org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runI > t(LeaderFollowerWorkerThread.java:80) > >>>> > >>>> > >>>> at > >>>>org.apache.tomcat.util.threads.ThreadPool$ControlRunnable. > run(ThreadPool.java:684) > >>>> > >>>> > >>>> at java.lang.Thread.run(Unknown Source) > >>>>Caused by: > org.apache.xml.security.encryption.XMLEncryptionException: > >>>>Error while decoding > >>>>Original Exception was > >>>>org.apache.xml.security.exceptions.Base64DecodingException: > Error while > >>>>decoding > >>>> at > >>>>org.apache.xml.security.encryption.XMLCipherInput.getDecry > ptBytes(Unknown > >>>> > >>>>Source) > >>>> at > org.apache.xml.security.encryption.XMLCipherInput.getBytes(Unknown > >>>>Source) > >>>> at > >>>>org.apache.xml.security.encryption.XMLCipher.decryptToByte > Array(Unknown > >>>>Source) > >>>> at > >>>>org.apache.xml.security.encryption.XMLCipher.decryptElemen > t(Unknown > >>>>Source) > >>>> at > >>>>org.apache.xml.security.encryption.XMLCipher.decryptElemen > tContent(Unknown > >>>> > >>>>Source) > >>>> at > org.apache.xml.security.encryption.XMLCipher.doFinal(Unknown > >>>>Source) > >>>> at > >>>>org.apache.ws.security.processor.EncryptedKeyProcessor.dec > ryptDataRef(EncryptedKeyProcessor.java:386) > >>>> > >>>> > >>>> ... 27 more > >>>> > >>>> > >>>> > >>>> > >>> > >>> > >>> > >>> > >>> > > > > > > > > > > -- > Brian Shields BSc. MSc., > PhD Candidate, > Department of Information Technology, > National University of Ireland, > Galway, > Ireland. > > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam > protection around > http://mail.yahoo.com > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam protection around > http://mail.yahoo.com > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [EMAIL PROTECTED] > For additional commands, e-mail: [EMAIL PROTECTED] > >
--------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
