| Author |
Message
|
| kuzman |
 Posted: Thu Sep 29, 2011 1:28 am Post subject: WS-Security testing X509 |
 |
|
Apprentice
Joined: 24 Aug 2010
Posts: 27
|
Hi,
I had trouble to test my x509 authentication with soap input/reply node.
I followed the http://publib.boulder.ibm.com/infocenter/wmbhelp/v7r0m0/index.jsp?topic=%2Fcom.ibm.etools.mft.doc%2Fac60110_.htm
I had configured the WS-Security as following:
-Created certificate authory with openssl
-created user request and certificate with openssh and singned with the CA key
-imported the user request key to the broker keystore/trustore
-the trust and keystore was previously configured to the broker because I use SSL and
another key in another scenario
-I have created policy set with username token and x509token
-created binding to the previous policy (provider)
-in the bar file at Provider policy set and provider polcy set bindings and put the previously defined policy and binding
I tried to test with soapUI.
I have created the soap request and configured the soap project to use my X509 key
(Security configuration-> outgoing security-> keystore: meX509 key, passwd etc. key identifier type: x509certificate)
I got the following error:
<faultstring>CWWSS5511E: An exception occurred during the decryption of a message. The exception is CWWSS7309E: An XML digital signature exists in the security header. Hoowever an inbound signature configuration is not present.</faultstring>
<detail>
<Exception>org.apache.axis2.AxisFault: CWWSS5511E: An exception occurred during the decryption of a message. The exception is CWWSS7309E: An XML digital signature exists in the security header. Hoowever an inbound signature configuration is not present.
at org.apache.axis2.AxisFault.makeFault(AxisFault.java:430)
at com.ibm.ws.wssecurity.handler.WSSecurityConsumerBase.invoke(WSSecurityConsumerBase.java:132)
at com.ibm.ws.wssecurity.handler.WSSecurityConsumerHandler._invoke(WSSecurityConsumerHandler.java:518)
at com.ibm.ws.wssecurity.handler.WSSecurityConsumerHandler.invoke(WSSecurityConsumerHandler.java:221)
at org.apache.axis2.engine.Phase.invoke(Phase.java:318)
at org.apache.axis2.engine.AxisEngine.invoke(AxisEngine.java:268)
at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:175)
at com.ibm.broker.axis2.Axis2Invoker.processInboundRequest(Axis2Invoker.java:2937)
at com.ibm.broker.axis2.Axis2Invoker.invokeAxis2(Axis2Invoker.java:2607)
at com.ibm.broker.axis2.TomcatNodeRegistrationUtil.invokeAXIS2(TomcatNodeRegistrationUtil.java:470)
Caused by: com.ibm.wsspi.wssecurity.core.SoapSecurityException: CWWSS5511E: An exception occurred during the decryption of a message. The exception is CWWSS7309E: An XML digital signature exists in the security header. Hoowever an inbound signature configuration is not present.
at com.ibm.wsspi.wssecurity.core.SoapSecurityException.format(SoapSecurityException.java:77)
at com.ibm.ws.wssecurity.core.WSSConsumer.callSignatureConsumer(WSSConsumer.java:2614)
at com.ibm.ws.wssecurity.core.WSSConsumer.invoke(WSSConsumer.java:838)
at com.ibm.ws.wssecurity.handler.WSSecurityConsumerBase.invoke(WSSecurityConsumerBase.java:111)
I do not understand why is in the error WSSConsumer? I configured the binding to provider!
Br,
Zsolt |
|
| Back to top |
|
 |
| fjb_saper |
| Posted: Thu Sep 29, 2011 1:40 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
The error seems quite clear:
| Quote: |
<faultstring>CWWSS5511E: An exception occurred during the decryption of a message. The exception is CWWSS7309E: An XML digital signature exists in the security header. Hoowever an inbound signature configuration is not present.</faultstring>
<detail> |
So you set up the signature in the outbound policy and it is present....
What is the next step? Are you receiving signed messages?
Is this the next flow downstream protesting?
Have fun 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| kuzman |
| Posted: Thu Sep 29, 2011 3:06 am Post subject: |
|
|
Apprentice
Joined: 24 Aug 2010
Posts: 27
|
I would like to use the x509token and the username token for authentication in the flow.
The flow receives incomming request with username and x509 token, authenticate the request and responded in SOAP reply. I dont want encrypt the message body.
If I good understand the error message the flow can not understand the incoimming request from the SOAPUI? |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Thu Sep 29, 2011 8:14 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
| kuzman wrote: |
I would like to use the x509token and the username token for authentication in the flow.
The flow receives incomming request with username and x509 token, authenticate the request and responded in SOAP reply. I dont want encrypt the message body.
If I good understand the error message the flow can not understand the incoimming request from the SOAPUI? |
What the message is telling you is that your outbound is configured for the token but the inbound is not. However your inbound message has a token.
Have fun
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| kuzman |
| Posted: Fri Sep 30, 2011 12:03 am Post subject: |
|
|
Apprentice
Joined: 24 Aug 2010
Posts: 27
|
I have configured the policy set and bindins as a wrote according to the doc.
http://publib.boulder.ibm.com/infocenter/wmbhelp/v7r0m0/index.jsp?topic=%2Fcom.ibm.etools.mft.doc%2Fac60110_.htm
Node Broker viewpoint Initiator Recipient
SOAPInput SOAP message inbound External client sending SOAP message to the broker. SOAPInput node
In the policy set the the soapmessage is REQUEST.
In the binding policy set config: PROVIDER
In the bar file:Provider policy set and binding are the previously defined policy and binding.
Why isn't the incoming requst not configured? Therefore I do not understand it!! Not that is the provider configuration?
It looks like it configured to CONSUMER!
I have found one error in my code
In the request:
The initiator uses the broker's public encryption token to encrypt the message, and its own private signature token to sign it.
The broker uses its own private encryption token to decrypt the message, and the initiator's public signature token to verify the signature.
I sign my request with my own CA private key and not with the brokers private key, but this does not affect to the consumer/provider configuration. Or does?
Zs |
|
| Back to top |
|
|
|
|
