Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug with UsernameToken and Wss4jSecurityInterceptor [SWS-700] #796

Closed
gregturn opened this issue Mar 30, 2011 · 2 comments
Closed

Bug with UsernameToken and Wss4jSecurityInterceptor [SWS-700] #796

gregturn opened this issue Mar 30, 2011 · 2 comments
Assignees

Comments

@gregturn
Copy link
Member

@gregturn gregturn commented Mar 30, 2011

Arnaud BARRE opened SWS-700 and commented

Here's a part of my spring-ws-servlet.xml

<sws:interceptors>
		<bean id="securityInterceptor" 
			 class="org.springframework.ws.soap.security.wss4j.Wss4jSecurityInterceptor">
			<property name="validationActions" value="UsernameToken"/>			
			<property name="validationCallbackHandler">
				<ref bean="authenticationHandler" />
			</property>			
		</bean>		
	</sws:interceptors>
	
	<bean id="authenticationHandler"
		class="org.springframework.ws.soap.security.wss4j.callback.SimplePasswordValidationCallbackHandler">
		<property name="users">
			<props>
				<prop key="${auth.user}">${auth.password}</prop>
			</props>
		</property>
	</bean>

When I send the following SOAP message using SOAPUi, it works, I get the result :

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://deltabank.com/webservices">
   <soapenv:Header>
      
   </soapenv:Header>
   <soapenv:Body>
      <web:versionRequest/>
   </soapenv:Body>
</soapenv:Envelope>

But if I add UsernameToken informations like this :

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://deltabank.com/webservices">
   <soapenv:Header>
      <wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
         <wsse:UsernameToken wsu:Id="UsernameToken-38" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
            <wsse:Username>tomcat</wsse:Username>
            <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">XXXXXX</wsse:Password>
            <wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">kD6o77T+cO3QbE1gd4/9lA==</wsse:Nonce>
            <wsu:Created>2011-03-30T15:31:33.906Z</wsu:Created>
         </wsse:UsernameToken>
      </wsse:Security>
   </soapenv:Header>
   <soapenv:Body>
      <web:versionRequest/>
   </soapenv:Body>
</soapenv:Envelope>

I get the following exception :
Security processing failed (actions mismatch)

Could you help me please because where I did something's wrong...


Affects: 2.0 GA

@gregturn
Copy link
Member Author

@gregturn gregturn commented Mar 31, 2011

Arnaud BARRE commented

Please close this issue. The problem was due to SOAPUi that automatically adds the UsernameToken in the header...

@gregturn
Copy link
Member Author

@gregturn gregturn commented May 4, 2012

Arjen Poutsma commented

Closing old issues

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants
You can’t perform that action at this time.