org.apache.cxf.ws.policy.PolicyException: None of the policy alternatives can be satisfied.
This exception is getting due to the cxf bundle. I am not sure how to get away from this. Anyone has any idea about this issue?
The service client works as a java program but when deployed as a service in WSO2 application server it throws this exception. The cause in CXF bundle but not sure how to avoid it.
Exception trace:
WARN {org.apache.cxf.phase.PhaseInterceptorChain} - Application {http://test.tss.com/}Sync#{http://test.tss.com/}hello has thrown exception, unwinding now
org.apache.cxf.interceptor.Fault: org.apache.cxf.ws.policy.PolicyException: None of the policy alternatives can be satisfied.
at org.apache.cxf.service.invoker.AbstractInvoker.createFault(AbstractInvoker.java:162)
at org.apache.cxf.jaxws.AbstractJAXWSMethodInvoker.createFault(AbstractJAXWSMethodInvoker.java:213)
at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:128)
at org.apache.cxf.jaxws.AbstractJAXWSMethodInvoker.invoke(AbstractJAXWSMethodInvoker.java:178)
at org.apache.cxf.jaxws.JAXWSMethodInvoker.invoke(JAXWSMethodInvoker.java:68)
at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:75)
at org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:57)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at org.apache.cxf.workqueue.SynchronousExecutor.execute(SynchronousExecutor.java:37)
at org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:106)
at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:271)
at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:239)
at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:223)
at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:203)
at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:137)
at org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:159)
at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:286)
at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:206)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:646)
at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:262)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
at
I don't have any policy XML. The wsdl includes the policy tags:
<wsp:Policy wsu:Id="BN_BN_binding_SOAP12">
<saptrnbnd:OptimizedXMLTransfer xmlns:saptrnbnd="http://www.sap.com/webas/710/soap/features/transportbinding/" uri="http://xml.sap.com/2006/11/esi/esp/binxml" wsp:Optional="true" />
<saptrnbnd:OptimizedMimeSerialization xmlns:saptrnbnd="http://schemas.xmlsoap.org/ws/2004/09/policy/optimizedmimeserialization" wsp:Optional="true" />
<wsp:ExactlyOne>
<wsp:All>
<sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702" xmlns:sapsp="http://www.sap.com/webas/630/soap/features/security/policy" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/200512" xmlns:wsu="http://schemas.xmlsoap.org/ws/2002/07/utility" xmlns:wsx="http://schemas.xmlsoap.org/ws/2004/09/mex">
<wsp:Policy>
<sp:TransportToken>
<wsp:Policy>
<sp:HttpsToken>
<wsp:Policy>
<sp:HttpBasicAuthentication />
</wsp:Policy>
</sp:HttpsToken>
</wsp:Policy>
</sp:TransportToken>
<sp:AlgorithmSuite>
<wsp:Policy>
<sp:Basic128Rsa15 />
</wsp:Policy>
</sp:AlgorithmSuite>
<sp:Layout>
<wsp:Policy>
<sp:Strict />
</wsp:Policy>
</sp:Layout>
</wsp:Policy>
</sp:TransportBinding>
</wsp:All>
</wsp:ExactlyOne>
<wsp:ExactlyOne>
<wsp:All>
<wsrmp:RMAssertion xmlns:wsrmp="http://docs.oasis-open.org/ws-rx/wsrmp/200702">
<wsp:Policy />
</wsrmp:RMAssertion>
<wsaw:UsingAddressing xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl" />
</wsp:All>
<wsp:All>
<wsrm:RMAssertion xmlns:wsrm="http://schemas.xmlsoap.org/ws/2005/02/rm/policy" />
<wsaw:UsingAddressing xmlns:wsaw="http://schemas.xmlsoap.org/ws/2004/08/addressing" />
</wsp:All>
</wsp:ExactlyOne>
I have solved this.
I have added the tag to the cxf file and set the right security certificates
Sample cxf file
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jaxws="http://cxf.apache.org/jaxws"
xmlns:http="http://cxf.apache.org/transports/http/configuration"
xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
xmlns:sec="http://cxf.apache.org/configuration/security" xmlns:cxf="http://cxf.apache.org/core"
xmlns:p="http://cxf.apache.org/policy"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
http://cxf.apache.org/jaxws
http://cxf.apache.org/schemas/jaxws.xsd
http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd
http://cxf.apache.org/policy http://cxf.apache.org/schemas/policy.xsd
http://cxf.apache.org/transports/http/configuration
http://cxf.apache.org/schemas/configuration/http-conf.xsd
http://cxf.apache.org/transports/http-jetty/configuration
http://cxf.apache.org/schemas/configuration/http-jetty.xsd
http://cxf.apache.org/configuration/security
http://cxf.apache.org/schemas/configuration/security.xsd ">
<cxf:bus>
<cxf:features>
<p:policies />
<cxf:logging />
</cxf:features>
</cxf:bus>
<jaxws:server id="CustomerSyncService" address="/customer_sync_service">
<jaxws:serviceBean>
<bean class="com.CustomerService" />
</jaxws:serviceBean>
</jaxws:server>
</beans>
Related
I have build a wcf-service (vb.Net with VisualStudio2017) that works well with a testclient, and wcfstorm. SOAPUI can load the wsdl, but when sending a request, it fails with "a:ActionNotSupported"
My Service uses WsHttpbinding, no authentification, no security, with sessions and reliable messaging.
Messagetracing shows that my TestClient succeds with using
< CreateSequence xmlns="http://schemas.xmlsoap.org/ws/2005/02/rm">
where as SOAPUI fails with using
< wsa:Action>http://docs.oasis-open.org/ws-rx/wsrm/200702/CreateSequence< /wsa:Action>
My Questions:
How can i configure my Service to understand/accept the second schema?
I'm a bit puzzled, from what i understand it should already speak SOAP 1.2
How can i get SOAPUI to use a different schema? - or configure the request so it'll work?
SOAPUI-Message
<MessageLogTraceRecord>
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
<soap:Header xmlns:wsa="http://www.w3.org/2005/08/addressing">
<wsa:Action>http://docs.oasis-open.org/ws-rx/wsrm/200702/CreateSequence</wsa:Action>
<wsa:MessageID>uuid:f610452d-80ef-4439-9cc1-40c7a1731eac</wsa:MessageID>
<wsa:To>http://rmwebservice:8733/TestService</wsa:To>
</soap:Header>
<soap:Body xmlns:wsrm="http://docs.oasis-open.org/ws-rx/wsrm/200702">
<wsrm:CreateSequence>
<wsrm:AcksTo xmlns:wsa="http://www.w3.org/2005/08/addressing">
<wsa:Address>http://www.w3.org/2005/08/addressing/anonymous?id=64f9580f-bfe9-4bd2-9b34-db88e0a5c982</wsa:Address>
</wsrm:AcksTo>
</wsrm:CreateSequence>
</soap:Body>
</soap:Envelope>
</MessageLogTraceRecord>
Response:
<MessageLogTraceRecord>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing">
<s:Header>
<a:Action s:mustUnderstand="1">http://www.w3.org/2005/08/addressing/fault</a:Action>
<a:RelatesTo>uuid:f610452d-80ef-4439-9cc1-40c7a1731eac</a:RelatesTo>
</s:Header>
<s:Body>
<s:Fault>
<s:Code>
<s:Value>s:Sender</s:Value>
<s:Subcode>
<s:Value>a:ActionNotSupported</s:Value>
</s:Subcode>
</s:Code>
<s:Reason>
<s:Text xml:lang="de-DE">Die Aktion http://docs.oasis-open.org/ws-rx/wsrm/200702/CreateSequence wird von diesem Endpunkt nicht unterstützt. Durch diesen Endpunkt werden nur Nachrichten verarbeitet, die der Spezifikation für WS-ReliableMessaging vom Februar 2005 entsprechen.</s:Text>
</s:Reason>
</s:Fault>
</s:Body>
</s:Envelope>
</MessageLogTraceRecord>
relevant service config:
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior name="myBehavior">
<serviceMetadata httpGetEnabled="true" httpGetUrl="http://myService:8733/" />
<serviceDebug includeExceptionDetailInFaults="true" />
</behavior>
</serviceBehaviors>
</behaviors>
<bindings>
<wsHttpBinding>
<binding name="reliableBinding">
<reliableSession ordered="true" enabled="true" />
<security mode="None">
<message clientCredentialType="None" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<services>
<service name="TestSoapService.TestService"
behaviorConfiguration="myBehavior">
<endpoint address="http://myService:8733/TestService"
binding="wsHttpBinding"
bindingConfiguration="reliableBinding"
contract="TestSoapService.ITestService" />
<endpoint address="http://myService:8733/mex" binding="mexHttpBinding" contract="IMetadataExchange"/>
</service>
</services>
</system.serviceModel>
wsdl:
<?xml version="1.0" encoding="UTF-8"?>
<wsdl:definitions xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:tns="http://tempuri.org/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/" xmlns:msc="http://schemas.microsoft.com/ws/2005/12/wsdl/contract" xmlns:wsap="http://schemas.xmlsoap.org/ws/2004/08/addressing/policy" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsa10="http://www.w3.org/2005/08/addressing" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsx="http://schemas.xmlsoap.org/ws/2004/09/mex" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" targetNamespace="http://tempuri.org/" name="TestService">
<wsp:Policy wsu:Id="WSHttpBinding_ITestService_policy">
<wsp:ExactlyOne>
<wsp:All>
<wsrm:RMAssertion xmlns:wsrm="http://schemas.xmlsoap.org/ws/2005/02/rm/policy">
<wsrm:InactivityTimeout Milliseconds="600000"/>
<wsrm:AcknowledgementInterval Milliseconds="200"/>
</wsrm:RMAssertion>
<wsaw:UsingAddressing/>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
<wsdl:types>
<xsd:schema targetNamespace="http://tempuri.org/Imports">
<xsd:import namespace="http://tempuri.org/" schemaLocation="http://rmwebservice:8733/?xsd=xsd0"/>
<xsd:import namespace="http://schemas.microsoft.com/2003/10/Serialization/" schemaLocation="http://rmwebservice:8733/?xsd=xsd1"/>
</xsd:schema>
</wsdl:types>
<wsdl:message name="ITestService_Echo_InputMessage">
<wsdl:part name="parameters" element="tns:Echo"/>
</wsdl:message>
<wsdl:message name="ITestService_Echo_OutputMessage">
<wsdl:part name="parameters" element="tns:EchoResponse"/>
</wsdl:message>
<wsdl:portType name="ITestService" msc:usingSession="true">
<wsdl:operation name="Echo" msc:isTerminating="false" msc:isInitiating="true">
<wsdl:input message="tns:ITestService_Echo_InputMessage" wsaw:Action="http://tempuri.org/ITestService/Echo"/>
<wsdl:output message="tns:ITestService_Echo_OutputMessage" wsaw:Action="http://tempuri.org/ITestService/EchoResponse"/>
</wsdl:operation>
</wsdl:portType>
<wsdl:binding type="tns:ITestService" name="WSHttpBinding_ITestService">
<wsp:PolicyReference URI="#WSHttpBinding_ITestService_policy"/>
<soap12:binding transport="http://schemas.xmlsoap.org/soap/http"/>
<wsdl:operation name="Echo">
<soap12:operation style="document" soapAction="http://tempuri.org/ITestService/Echo"/>
<wsdl:input>
<soap12:body use="literal"/>
</wsdl:input>
<wsdl:output>
<soap12:body use="literal"/>
</wsdl:output>
</wsdl:operation>
</wsdl:binding>
<wsdl:service name="TestService">
<wsdl:port name="WSHttpBinding_ITestService" binding="tns:WSHttpBinding_ITestService">
<soap12:address location="http://rmwebservice:8733/TestService"/>
<wsa10:EndpointReference>
<wsa10:Address>http://rmwebservice:8733/TestService</wsa10:Address>
</wsa10:EndpointReference>
</wsdl:port>
</wsdl:service>
</wsdl:definitions>
While your error is in German and Google likely made a mess of translating it, it states
The action http://docs.oasis-open.org/ws-rx/wsrm/200702/CreateSequence is not supported by this endpoint. This endpoint only processes messages that meet the February 2005 WS-ReliableMessaging specification.
The suggested fix to test that it is causing the problem is to disable reliableBinding like this:
<wsHttpBinding>
<binding name="reliableBinding">
<reliableSession ordered="true" enabled="false" />
<security mode="None">
<message clientCredentialType="None" />
</security>
</binding>
</wsHttpBinding>
If that works you might try re-enabling it then in SOAP-UI you can enable WS-ReliableMessaging following this article Using WS-Reliable messaging
Update:
For a little more info on what SOAP-UI might support albeit they're discussing an older version see WCF services testing with SOAP-UI
If all else fails, I'd suggest posting in their forum/community
Another answer(s) from SO that might help Problems with wcf reliable session reliable messaging
I am trying to invoke secure WCF service and keep getting following error
I am using wso2 esb 4.8.1 and this is pass through proxy.
I have also disabled inflow security in rampart config file.
Also attached is my security policy for this service
WARN FaultHandler ERROR_DETAIL : org.apache.synapse.SynapseException: Unexpected error during sending message out
at org.apache.synapse.core.axis2.Axis2Sender.handleException(Axis2Sender.java:172)
at org.apache.synapse.core.axis2.Axis2Sender.sendOn(Axis2Sender.java:71)
at org.apache.synapse.core.axis2.Axis2SynapseEnvironment.send(Axis2SynapseEnvironment.java:338)
at org.apache.synapse.endpoints.AbstractEndpoint.send(AbstractEndpoint.java:333)
at org.apache.synapse.endpoints.AddressEndpoint.send(AddressEndpoint.java:59)
at org.apache.synapse.endpoints.IndirectEndpoint.send(IndirectEndpoint.java:54)
at org.apache.synapse.mediators.builtin.CallMediator.mediate(CallMediator.java:114)
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:77)
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:47)
at org.apache.synapse.mediators.base.SequenceMediator.mediate(SequenceMediator.java:131)
at org.apache.synapse.core.axis2.ProxyServiceMessageReceiver.receive(ProxyServiceMessageReceiver.java:166)
at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180)
at org.apache.synapse.transport.passthru.ServerWorker.processEntityEnclosingRequest(ServerWorker.java:411)
at org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:183)
at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:745)
Caused by: org.apache.axis2.AxisFault: Error in obtaining a token
at org.apache.rampart.handler.RampartSender.invoke(RampartSender.java:76)
at org.apache.axis2.engine.Phase.invokeHandler(Phase.java:340)
at org.apache.axis2.engine.Phase.invoke(Phase.java:313)
at org.apache.axis2.engine.AxisEngine.invoke(AxisEngine.java:261)
at org.apache.axis2.engine.AxisEngine.send(AxisEngine.java:426)
at org.apache.synapse.core.axis2.DynamicAxisOperation$DynamicOperationClient.executeImpl(DynamicAxisOperation.java:156)
at org.apache.axis2.client.OperationClient.execute(OperationClient.java:149)
at org.apache.synapse.core.axis2.Axis2FlexibleMEPClient.send(Axis2FlexibleMEPClient.java:482)
at org.apache.synapse.core.axis2.Axis2Sender.sendOn(Axis2Sender.java:59)
... 16 more
Caused by: org.apache.rampart.RampartException: Error in obtaining a token
at org.apache.rampart.util.RampartUtil.getToken(RampartUtil.java:779)
at org.apache.rampart.util.RampartUtil.getSecConvToken(RampartUtil.java:633)
at org.apache.rampart.builder.TransportBindingBuilder.handleSecureConversationTokens(TransportBindingBuilder.java:626)
at org.apache.rampart.builder.TransportBindingBuilder.build(TransportBindingBuilder.java:141)
at org.apache.rampart.MessageBuilder.build(MessageBuilder.java:140)
at org.apache.rampart.handler.RampartSender.invoke(RampartSender.java:65)
... 24 more
Caused by: org.apache.rahas.TrustException: Error in obtaining token from : "https://myendpoint"
at org.apache.rahas.client.STSClient.requestSecurityToken(STSClient.java:174)
at org.apache.rahas.client.STSClient.requestSecurityToken(STSClient.java:182)
at org.apache.rampart.util.RampartUtil.getToken(RampartUtil.java:766)
... 29 more
Caused by: org.apache.axis2.AxisFault: The input stream for an incoming message is null.
at org.apache.axis2.transport.TransportUtils.createSOAPMessage(TransportUtils.java:93)
at org.apache.axis2.transport.TransportUtils.createSOAPMessage(TransportUtils.java:68)
at org.apache.axis2.description.OutInAxisOperationClient.handleResponse(OutInAxisOperation.java:348)
at org.apache.axis2.description.OutInAxisOperationClient.send(OutInAxisOperation.java:445)
at org.apache.axis2.description.OutInAxisOperationClient.executeImpl(OutInAxisOperation.java:225)
at org.apache.axis2.client.OperationClient.execute(OperationClient.java:149)
at org.apache.axis2.client.ServiceClient.sendReceive(ServiceClient.java:554)
at org.apache.rahas.client.STSClient.requestSecurityToken(STSClient.java:165)
... 31 more
Policy.xml
I have removed users and URL's for security purposes
<?xml version="1.0" encoding="UTF-8"?>
<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing"
xmlns:wsap="http://schemas.xmlsoap.org/ws/2004/08/addressing/policy"
xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl"
xmlns:msc="http://schemas.microsoft.com/ws/2005/12/wsdl/contract"
xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata">
<wsp:ExactlyOne>
<wsp:All>
<sp:TransportBinding xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:TransportToken>
<wsp:Policy>
<sp:HttpsToken RequireClientCertificate="false"/>
</wsp:Policy>
</sp:TransportToken>
<sp:AlgorithmSuite>
<wsp:Policy>
<sp:Basic256/>
</wsp:Policy>
</sp:AlgorithmSuite>
<sp:Layout>
<wsp:Policy>
<sp:Strict/>
</wsp:Policy>
</sp:Layout>
<sp:IncludeTimestamp/>
</wsp:Policy>
</sp:TransportBinding>
<sp:EndorsingSupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:SecureConversationToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
<wsp:Policy>
<sp:BootstrapPolicy>
<wsp:Policy>
<sp:SignedParts>
<sp:Body/>
<sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
<sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/>
<sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/>
<sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/>
<sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/>
<sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/>
<sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/>
</sp:SignedParts>
<sp:EncryptedParts>
<sp:Body/>
</sp:EncryptedParts>
<sp:TransportBinding>
<wsp:Policy>
<sp:TransportToken>
<wsp:Policy>
<sp:HttpsToken RequireClientCertificate="false"/>
</wsp:Policy>
</sp:TransportToken>
<sp:AlgorithmSuite>
<wsp:Policy>
<sp:Basic256/>
</wsp:Policy>
</sp:AlgorithmSuite>
<sp:Layout>
<wsp:Policy>
<sp:Strict/>
</wsp:Policy>
</sp:Layout>
<sp:IncludeTimestamp/>
</wsp:Policy>
</sp:TransportBinding>
<sp:SignedSupportingTokens>
<wsp:Policy>
<sp:UsernameToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
<wsp:Policy>
<sp:WssUsernameToken10/>
</wsp:Policy>
</sp:UsernameToken>
</wsp:Policy>
</sp:SignedSupportingTokens>
<sp:Wss11>
<wsp:Policy/>
</sp:Wss11>
<sp:Trust10>
<wsp:Policy>
<sp:MustSupportIssuedTokens/>
<sp:RequireClientEntropy/>
<sp:RequireServerEntropy/>
</wsp:Policy>
</sp:Trust10>
</wsp:Policy>
</sp:BootstrapPolicy>
</wsp:Policy>
</sp:SecureConversationToken>
</wsp:Policy>
</sp:EndorsingSupportingTokens>
<sp:Wss11 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy/>
</sp:Wss11>
<sp:Trust10 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:MustSupportIssuedTokens/>
<sp:RequireClientEntropy/>
<sp:RequireServerEntropy/>
</wsp:Policy>
</sp:Trust10>
<wsaw:UsingAddressing/>
<ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy">
<ramp:user>User</ramp:user>
<ramp:passwordCallbackClass>org.example.rampart.PWCBHandler</ramp:passwordCallbackClass>
<ramp:signatureCrypto>
<ramp:crypto provider="org.apache.ws.security.components.crypto.Merlin">
<ramp:property name="org.apache.ws.security.crypto.merlin.keystore.type">JKS</ramp:property>
<ramp:property name="org.apache.ws.security.crypto.merlin.file">/pathto/wso2carbon.jks</ramp:property>
<ramp:property name="org.apache.ws.security.crypto.merlin.keystore.password">wso2carbon</ramp:property>
</ramp:crypto>
</ramp:signatureCrypto>
<ramp:encryptionCypto>
<ramp:crypto provider="org.apache.ws.security.components.crypto.Merlin">
<ramp:property name="org.apache.ws.security.crypto.merlin.keystore.type">JKS</ramp:property>
<ramp:property name="org.apache.ws.security.crypto.merlin.file">/pathto/wso2carbon.jks</ramp:property>
<ramp:property name="org.apache.ws.security.crypto.merlin.keystore.password">wso2carbon</ramp:property>
</ramp:crypto>
</ramp:encryptionCypto>
</ramp:RampartConfig>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
Policy is copied from WSDL file from service
Thank you all for feedback
Eldin
I have a wsdl with following WS-Policy block:
<wsp:Policy wsu:Id="MemberBindingPolicy">
<wsp:All>
<sp:AsymmetricBinding>
<wsp:Policy>
<sp:InitiatorToken>
<wsp:Policy>
<sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never">
<wsp:Policy>
<sp:WssX509V1Token11/>
<sp:RequireIssuerSerialReference/>
</wsp:Policy>
</sp:X509Token>
</wsp:Policy>
</sp:InitiatorToken>
<sp:RecipientToken>
<wsp:Policy>
<sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never">
<wsp:Policy>
<sp:WssX509V1Token11/>
<sp:RequireIssuerSerialReference/>
</wsp:Policy>
</sp:X509Token>
</wsp:Policy>
</sp:RecipientToken>
<sp:AlgorithmSuite>
<wsp:Policy>
<sp:Basic256Sha256/>
<sp:InclusiveC14N>http://www.w3.org/2001/10/xml-exc-c14n#</sp:InclusiveC14N>
</wsp:Policy>
</sp:AlgorithmSuite>
<sp:Layout>
<wsp:Policy>
<sp:Strict/>
</wsp:Policy>
</sp:Layout>
<sp:OnlySignEntireHeadersAndBody/>
</wsp:Policy>
</sp:AsymmetricBinding>
<sp:SignedParts>
<sp:Body/>
</sp:SignedParts>
<sp:Wss11>
<wsp:Policy>
<sp:MustSupportRefIssuerSerial/>
</wsp:Policy>
</sp:Wss11>
</wsp:All>
</wsp:Policy>
I run svc util and it returns following error:
An unsupported security policy assertion was detected during the security policy import
XPath: //wsdl:definitions[#targetNamespace='http://xxxx.com']/wsdl:binding[#name='IssAuthSoapBinding']
Is there a workaround (in code, or not using svcutil at all)?
m.
I am trying to publish a webservice using apache camel cxf. I am able to access the published webservice using http. However I am trying to configure the same using https. But I am not able to get it to work.
below are parts of spring context and wsdl files
<camel-cxf:cxfEndpoint id="myEndoint"
address="http://localhost:9000/PostXml/" serviceClass="com.XXXXXXXXXX.techquest.ServicesPortType"
xmlns:ssp="http://techquest.interswitchng.com/" endpointName="ssp:PostXml"
serviceName="ssp:PostXml" />
<http:conduit name="*.http-conduit">
<http:tlsClientParameters
secureSocketProtocol="SSL">
<sec:keyManagers keyPassword="password">
<sec:keyStore type="JKS" password="password"
file="A:/apache-sermfino_conf/cherry.jks" />
</sec:keyManagers>
<sec:trustManagers>
<sec:keyStore type="JKS" password="password"
file="A:/apache-ser/truststore.jks" />
</sec:trustManagers>
<sec:cipherSuitesFilter>
<!-- these filters ensure that a ciphersuite with export-suitable or
null encryption is used, but exclude anonymous Diffie-Hellman key change
as this is vulnerable to man-in-the-middle attacks -->
<sec:include>.*_EXPORT_.*</sec:include>
<sec:include>.*_EXPORT1024_.*</sec:include>
<sec:include>.*_WITH_DES_.*</sec:include>
<sec:include>.*_WITH_AES_.*</sec:include>
<sec:include>.*_WITH_NULL_.*</sec:include>
<sec:exclude>.*_DH_anon_.*</sec:exclude>
</sec:cipherSuitesFilter>
</http:tlsClientParameters>
<http:client AutoRedirect="true" Connection="Keep-Alive" />
</http:conduit>
===============================================================================
<wsdl:portType name="ServicesPortType">
<wsdl:operation name="PostXml">
<wsdl:input message="tns:PostXml" />
<wsdl:output message="tns:PostXml" />
</wsdl:operation>
</wsdl:portType>
<wsdl:binding name="ServicesSoap12Binding" type="tns:ServicesPortType">
<soap12:binding style="document"
transport="http://schemas.xmlsoap.org/soap/http" />
<wsdl:operation name="PostXml">
<soap12:operation soapAction="PostXml" style="document" />
<wsdl:input>
<soap12:body use="literal" />
</wsdl:input>
<wsdl:output>
<soap12:body use="literal" />
</wsdl:output>
</wsdl:operation>
</wsdl:binding>
<wsdl:service name="ServicesPortTypeService">
<wsdl:port binding="tns:ServicesSoap12Binding" name="ServicesSoap12Endpoint">
<soap12:address location="http://localhost:9000/PostXml" />
</wsdl:port>
</wsdl:service>
The first one configuration is for the http client not for the server side.
You can find the configuration example here[1]
[1]http://cxf.apache.org/docs/jetty-configuration.html
I was able to configure apache-camel-2.19.4 with camel-config.xml:
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:camel="http://camel.apache.org/schema/spring"
xmlns:cxf="http://camel.apache.org/schema/cxf" xmlns:context="http://www.springframework.org/schema/context"
xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration"
xmlns:sec="http://cxf.apache.org/configuration/security" xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:cxfcore="http://cxf.apache.org/core"
xsi:schemaLocation="
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
http://camel.apache.org/schema/spring http://camel.apache.org/schema/spring/camel-spring.xsd
http://camel.apache.org/schema/cxf http://camel.apache.org/schema/cxf/camel-cxf.xsd
http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd
http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd
http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd
http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd
">
<cxf:cxfEndpoint id="my-endpoint-http"
address="http://localhost:8080/test"
endpointName="tns:endpointName1" serviceName="tns:endpointServiceName1"
wsdlURL="myService.wsdl" xmlns:tns="myServiceWsdlNamespace">
<cxf:properties>
<entry key="allowStreaming" value="true" />
<entry key="autoRewriteSoapAddressForAllServices" value="true" />
</cxf:properties>
</cxf:cxfEndpoint>
<cxf:cxfEndpoint id="my-endpoint-https"
address="https://localhost:8443/test"
endpointName="tns:endpointName1" serviceName="tns:endpointServiceName1"
wsdlURL="myService.wsdl" xmlns:tns="myServiceWsdlNamespace">
<cxf:properties>
<entry key="allowStreaming" value="true" />
<entry key="autoRewriteSoapAddressForAllServices" value="true" />
</cxf:properties>
</cxf:cxfEndpoint>
<camelContext xmlns="http://camel.apache.org/schema/spring">
<route id="my-endpoint-http-route" streamCache="true">
<from uri="cxf:bean:my-endpoint-http?dataFormat=MESSAGE" />
<to uri="direct:myServiceDirect" />
</route>
<route id="my-endpoint-https-route" streamCache="true">
<from uri="cxf:bean:my-endpoint-https?dataFormat=MESSAGE" />
<to uri="direct:myServiceDirect" />
</route>
<route id="all" streamCache="true">
<from uri="direct:myServiceDirect" />
<log message="headers1=${headers}" />
</route>
</camelContext>
<cxfcore:bus/>
<httpj:engine-factory bus="cxf">
<httpj:engine port="8443">
<httpj:tlsServerParameters secureSocketProtocol="TLSv1">
<sec:keyManagers keyPassword="skpass">
<sec:keyStore password="changeit" file="src/test/resources/certificate-stores/localhost-keystore.jks" />
</sec:keyManagers>
<!--
<sec:trustManagers>
- <sec:keyStore resource="certs/serviceKeystore.jks" password="sspass" type="JKS"/> -
<sec:keyStore password="changeit" file="src/main/resources/certificate-stores/cacerts" />
</sec:trustManagers>
-->
<sec:cipherSuitesFilter>
<sec:include>.*_WITH_3DES_.*</sec:include>
<sec:include>.*_WITH_DES_.*</sec:include>
<sec:exclude>.*_WITH_NULL_.*</sec:exclude>
<sec:exclude>.*_DH_anon_.*</sec:exclude>
</sec:cipherSuitesFilter>
<!-- <sec:clientAuthentication want="true" required="false"/> -->
</httpj:tlsServerParameters>
</httpj:engine>
</httpj:engine-factory>
</beans>
With this you should be able to access:
http://localhost:8080/test?wsdl
https://localhost:8443/test?wsdl
The file src/test/resources/certificate-stores/localhost-keystore.jks should contain a generated key pair (use KeyStoreExplorer) and the pair saved with keyPassword(skpass) key password and password(changeit) for the keystore file password.
I'm binding as follows
//Get certificate in bytes[]
X509Store store = new X509Store(StoreLocation.CurrentUser);
store.Open(OpenFlags.ReadWrite);
localCert = new X509Certificate2(cert.File, "mypassword");
store.Add(localCert);
certFriendlyName = localCert.FriendlyName;
//set binding
SecurityBindingElement security = new TransportSecurityBindingElement();
X509SecurityTokenParameters item = new X509SecurityTokenParameters(X509KeyIdentifierClauseType.Any, SecurityTokenInclusionMode.AlwaysToRecipient);
security.EndpointSupportingTokenParameters.SignedEncrypted.Add(item);
security.IncludeTimestamp = false;
security.MessageSecurityVersion = MessageSecurityVersion.WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10;
TextMessageEncodingBindingElement encoding = new TextMessageEncodingBindingElement(MessageVersion.Soap11, Encoding.UTF8);
HttpsTransportBindingElement transport = new HttpsTransportBindingElement();
transport.RequireClientCertificate = true;
System.ServiceModel.Channels.Binding currentBinding = new CustomBinding(security, encoding, transport);
EndpointIdentity identity = EndpointIdentity.CreateDnsIdentity("mydns");
EndpointAddress ea = new EndpointAddress(new Uri("MyURI"), identity);
service.ClientCredentials.ClientCertificate.SetCertificate(StoreLocation.CurrentUser, StoreName.My , X509FindType.FindBySubjectName, certFriendlyName);
service.ClientCredentials.ServiceCertificate.SetDefaultCertificate(System.Security.Cryptography.X509Certificates.StoreLocation.CurrentUser,
System.Security.Cryptography.X509Certificates.StoreName.My,
System.Security.Cryptography.X509Certificates.X509FindType.FindBySubjectName,
certFriendlyName);
and below is the security policy from the provided WSDL
<wsp:Policy Name="GAPolicy" wsu:Id="policy.ga" xmlns:wsaws="http://www.w3.org/2005/08/addressing">
<wsp:ExactlyOne>
<wsp:All>
<wsaws:UsingAddressing xmlns:wsaws="http://www.w3.org/2006/05/addressing/wsdl" />
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
<wsp:Policy Name="NPPIPolicy" wsu:Id="policy.nppi"
xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:ExactlyOne>
<wsp:All>
<!-- Force the use of WS-Addressing -->
<wsaws:UsingAddressing xmlns:wsaws="http://www.w3.org/2006/05/addressing/wsdl" />
<!-- Require a signature on the body of the message -->
<wsp:SignedParts>
<wsp:Body />
</wsp:SignedParts>
<!-- X.509 Certs in header -->
<wsp:AsymmetricBinding
xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:InitiatorSignatureToken>
<wsp:Policy>
<sp:X509Token
sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200512/IncludeToken/AlwaysToRecipient" />
</wsp:Policy>
</sp:InitiatorSignatureToken>
<sp:RecipientToken>
<wsp:Policy>
<sp:X509Token
sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Never" />
</wsp:Policy>
</sp:RecipientToken>
<!-- Supported encryption algorithms -->
<sp:AlgorithmSuite>
<wsp:Policy>
<wsp:ExactlyOne>
<sp:Basic256 />
<sp:TripleDes />
<sp:TripleDesSha256 />
<sp:TripleDesSha256Rsa15 />
</wsp:ExactlyOne>
</wsp:Policy>
</sp:AlgorithmSuite>
<!-- Do not impose an order of layout -->
<sp:Layout>
<wsp:Policy>
<sp:Lax />
</wsp:Policy>
</sp:Layout>
</wsp:Policy>
</wsp:AsymmetricBinding>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
<wsp:Policy Name="PCIPolicy" wsu:Id="policy.pci"
xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:ExactlyOne>
<wsp:All>
<!-- Force the use of WS-Addressing -->
<wsaws:UsingAddressing xmlns:wsaws="http://www.w3.org/2006/05/addressing/wsdl" />
<!-- Require a signature on the body of the message -->
<wsp:SignedParts>
<wsp:Body />
</wsp:SignedParts>
<!-- X.509 Certs in header -->
<wsp:AsymmetricBinding
xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:InitiatorSignatureToken>
<wsp:Policy>
<sp:X509Token
sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200512/IncludeToken/AlwaysToRecipient" />
</wsp:Policy>
</sp:InitiatorSignatureToken>
<sp:RecipientToken>
<wsp:Policy>
<sp:X509Token
sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Never" />
</wsp:Policy>
</sp:RecipientToken>
<!-- Supported encryption algorithms -->
<sp:AlgorithmSuite>
<wsp:Policy>
<wsp:ExactlyOne>
<sp:Basic256 />
<sp:TripleDes />
<sp:TripleDesSha256 />
<sp:TripleDesSha256Rsa15 />
</wsp:ExactlyOne>
</wsp:Policy>
</sp:AlgorithmSuite>
<!-- Do not impose an order of layout -->
<sp:Layout>
<wsp:Policy>
<sp:Lax />
</wsp:Policy>
</sp:Layout>
</wsp:Policy>
</wsp:AsymmetricBinding>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
Using this I'm running into "System.ServiceModel.FaultException: No signature in the WS-Security message for the configured soap actor/role ""! (from client)"
Use CustomBinding directly. By introducing WsHttpBinding and setting its security to expect client certificate you are configuring completely different security mode. I wrote an article about this issue (as a result of the question on MSDN you've already found). Start with the binding described in the article or modify it according to your needs. The described binding uses mutual HTTPS (client certificate for HTTPS) with supporting certificate in each request message.