Mailing-List: contact dev-help@cxf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cxf.apache.org
From: Siva Kulendrasingam <Siva.Kulendrasingam@vu.edu.au>
To: Daniel Kulp <dkulp@apache.org>, "dev@cxf.apache.org" <dev@cxf.apache.org>,
        "coheigea@apache.org" <coheigea@apache.org>
Subject: Re: CXF - WS Security Issue
Thread-Topic: CXF - WS Security Issue
Thread-Index: AdL+jiDR0/7kMRbuRkWxD6aZDE0GuwABEzywABIY0IAAISib8AAR1bSAAAh+OwAAAC7o2w==
Date: Tue, 18 Jul 2017 13:27:42 +0000
Message-ID: <ME1PR01MB10587A305AA856D0029A0B91ABA10@ME1PR01MB1058.ausprd01.prod.outlook.com>
References: <ME1PR01MB1058AC8305CF6EC33D415921ABA00@ME1PR01MB1058.ausprd01.prod.outlook.com>
 <CAB8XdGCC84Y_9xkg6FGaJMWdru1OVAtUEdzYP3+XpT10ROfc1Q@mail.gmail.com>
 <ME1PR01MB10582B14087012F6E2395BB0ABA10@ME1PR01MB1058.ausprd01.prod.outlook.com>
 <CAB8XdGA2KDnnzZbuh6hZm51fxzuheVASTE1ffTkqLFtUL5o0qQ@mail.gmail.com>,<C655D4F9-9792-452D-8EBE-DB31510EC5A9@apache.org>
In-Reply-To: <C655D4F9-9792-452D-8EBE-DB31510EC5A9@apache.org>
Accept-Language: en-AU, en-US
Content-Language: en-AU
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative;
	boundary="_000_ME1PR01MB10587A305AA856D0029A0B91ABA10ME1PR01MB1058ausp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Jul 2017 13:27:42.6769
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d51ba343-9258-4ea6-9907-426d8c84ec12
X-MS-Exchange-Transport-CrossTenantHeadersStamped: ME1PR01MB1060
X-OriginatorOrg: vu.edu.au
X-Scanned-By: MIMEDefang 2.75 on 140.159.23.9
X-Scanned-By: MIMEDefang 2.78 on 140.159.23.3
archived-at: Tue, 18 Jul 2017 13:28:00 -0000

--_000_ME1PR01MB10587A305AA856D0029A0B91ABA10ME1PR01MB1058ausp_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Thanks Dan.


Will try the suggestions and update you.


Siva

________________________________
From: Daniel Kulp <dkulp@apache.org>
Sent: Tuesday, 18 July 2017 11:21:28 PM
To: dev@cxf.apache.org; coheigea@apache.org
Cc: Siva Kulendrasingam
Subject: Re: CXF - WS Security Issue


Actually, you don=92t need to write anything as we already have this in CXF=
.  If you add:

    <bean class=3D"org.apache.cxf.ws.policy.IgnorablePolicyInterceptorProvi=
der">
        <constructor-arg>
            <!-- the list of assertion types that can be ignored -->
            <list>
                <bean class=3D"javax.xml.namespace.QName">
                    <constructor-arg value=3D"http://www.bea.com/wls90/secu=
rity/policy"/>
                    <constructor-arg value=3D=93Identity"/>
                </bean>
            </list>
        </constructor-arg>
    </bean>

To your spring config, it should be automatically ignored.


Dan


> On Jul 18, 2017, at 5:18 AM, Colm O hEigeartaigh <coheigea@apache.org> wr=
ote:
>
> Yeah, this is not a standard policy, and so CXF doesn't support it out of
> the box. You can either remove the policy jar from the classpath, as you'=
ve
> already noted, or else write a CXF interceptor to "assert" (and so ignore=
)
> the policy.
>
> Colm.
>
> On Tue, Jul 18, 2017 at 2:04 AM, Siva Kulendrasingam <
> Siva.Kulendrasingam@vu.edu.au> wrote:
>
>> Thanks Colm.
>>
>> From the WSDL, I could see the following
>>
>> <wsp:UsingPolicy WL5G3N1:Required=3D"true" />
>>   <wsp:Policy WL5G3N0:Id=3D"Auth.xml">
>>      <wssp:Identity xmlns:wssp=3D"http://www.bea.com/wls90/security/poli=
cy
>> ">
>>         <wssp:SupportedTokens>
>>            <wssp:SecurityToken TokenType=3D"http://docs.oasis-
>> open.org/wss/2004/01/oasis-200401-wss-username-token-
>> profile-1.0#UsernameToken">
>>               <wssp:UsePassword Type=3D"http://docs.oasis-open.
>> org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText=
"
>> />
>>            </wssp:SecurityToken>
>>         </wssp:SupportedTokens>
>>      </wssp:Identity>
>>   </wsp:Policy>
>>
>> I attached the WSDL for your reference.
>>
>> Stack Trace:
>> Jul 18, 2017 10:53:17 AM org.apache.cxf.wsdl.service.factory.ReflectionS=
erviceFactoryBean
>> buildServiceFromWSDL
>> INFO: Creating Service {http://au/edu/vu/its/as/ws/
>> callista/VuCalendarWS.wsdl}VuCalendarWS from WSDL:
>> http://devsdvd.vu.edu.au:9990/VuCalendar/VuCalendarWSSoapHttpPort?wsdl
>> Invoking getTeachCalendarsPerAcad...
>> Jul 18, 2017 10:53:17 AM org.apache.cxf.ws.policy.AssertionBuilderRegist=
ryImpl
>> handleNoRegisteredBuilder
>> WARNING: No assertion builder for type {http://www.bea.com/wls90/
>> security/policy}Identity registered.
>> Jul 18, 2017 10:53:17 AM org.apache.cxf.phase.PhaseInterceptorChain
>> doDefaultLogging
>> WARNING: Interceptor for {http://au/edu/vu/its/as/ws/
>> callista/VuCalendarWS.wsdl}VuCalendarWS#{http://au/edu/
>> vu/its/as/ws/callista/VuCalendarWS.wsdl}getTeachCalendarsPerAcad has
>> thrown exception, unwinding now
>> org.apache.cxf.ws.policy.PolicyException: None of the policy alternative=
s
>> can be satisfied.
>>       at org.apache.cxf.ws.policy.EffectivePolicyImpl.chooseAlternative(
>> EffectivePolicyImpl.java:199)
>>       at org.apache.cxf.ws.policy.EffectivePolicyImpl.chooseAlternative(
>> EffectivePolicyImpl.java:192)
>>       at org.apache.cxf.ws.policy.EffectivePolicyImpl.initialise(
>> EffectivePolicyImpl.java:96)
>>       at org.apache.cxf.ws.policy.PolicyEngineImpl.
>> getEffectiveClientRequestPolicy(PolicyEngineImpl.java:204)
>>       at org.apache.cxf.ws.policy.PolicyOutInterceptor.handle(
>> PolicyOutInterceptor.java:98)
>>       at org.apache.cxf.ws.policy.AbstractPolicyInterceptor.
>> handleMessage(AbstractPolicyInterceptor.java:44)
>>       at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(
>> PhaseInterceptorChain.java:308)
>>       at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:518=
)
>>       at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:427)
>>       at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:328)
>>       at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:281)
>>       at org.apache.cxf.frontend.ClientProxy.invokeSync(
>> ClientProxy.java:96)
>>       at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(
>> JaxWsClientProxy.java:139)
>>       at com.sun.proxy.$Proxy35.getTeachCalendarsPerAcad(Unknown Source)
>>       at au.edu.vu.its.as.ws.callista.vucalendarws.wsdl.VuCalendarWS_
>> VuCalendarWSSoapHttpPort_Client.main(VuCalendarWS_
>> VuCalendarWSSoapHttpPort_Client.java:49)
>>
>> Exception in thread "main" javax.xml.ws.soap.SOAPFaultException: None of
>> the policy alternatives can be satisfied.
>>       at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(
>> JaxWsClientProxy.java:161)
>>       at com.sun.proxy.$Proxy35.getTeachCalendarsPerAcad(Unknown Source)
>>       at au.edu.vu.its.as.ws.callista.vucalendarws.wsdl.VuCalendarWS_
>> VuCalendarWSSoapHttpPort_Client.main(VuCalendarWS_
>> VuCalendarWSSoapHttpPort_Client.java:49)
>> Caused by: org.apache.cxf.ws.policy.PolicyException: None of the policy
>> alternatives can be satisfied.
>>       at org.apache.cxf.ws.policy.EffectivePolicyImpl.chooseAlternative(
>> EffectivePolicyImpl.java:199)
>>       at org.apache.cxf.ws.policy.EffectivePolicyImpl.chooseAlternative(
>> EffectivePolicyImpl.java:192)
>>       at org.apache.cxf.ws.policy.EffectivePolicyImpl.initialise(
>> EffectivePolicyImpl.java:96)
>>       at org.apache.cxf.ws.policy.PolicyEngineImpl.
>> getEffectiveClientRequestPolicy(PolicyEngineImpl.java:204)
>>       at org.apache.cxf.ws.policy.PolicyOutInterceptor.handle(
>> PolicyOutInterceptor.java:98)
>>       at org.apache.cxf.ws.policy.AbstractPolicyInterceptor.
>> handleMessage(AbstractPolicyInterceptor.java:44)
>>       at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(
>> PhaseInterceptorChain.java:308)
>>       at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:518=
)
>>       at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:427)
>>       at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:328)
>>       at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:281)
>>       at org.apache.cxf.frontend.ClientProxy.invokeSync(
>> ClientProxy.java:96)
>>       at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(
>> JaxWsClientProxy.java:139)
>>       ... 2 more
>>
>>
>> Thanks
>> Siva
>> -----Original Message-----
>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>> Sent: Monday, 17 July 2017 6:58 PM
>> To: dev@cxf.apache.org
>> Subject: Re: CXF - WS Security Issue
>>
>> What does the security policy of the service look like? What's the exact
>> stack trace you get?
>>
>> Colm.
>>
>> On Mon, Jul 17, 2017 at 1:22 AM, Siva Kulendrasingam <
>> Siva.Kulendrasingam@vu.edu.au> wrote:
>>
>>> Dear Team,
>>>
>>> We are trying to consume a web service hosted in Weblogic server using
>>> the CXF client connector in Mule, but getting the following error.
>>>
>>> "None of the policy alternatives can be satisfied.. Failed to route
>>> event via endpoint: org.mule.module.cxf.CxfOutboundMessageProcessor".
>>>
>>> It seems that the following BEA Weblogic policy is not supported by CXF=
.
>>> <wssp:Identity xmlns:wssp=3D"http://www.bea.com/wls90/security/policy">
>>>
>>> If we remove the cxf-rt-ws-policy-2.7.15.jar, then it works as
>>> org.apache.cxf.ws.policy.PolicyOutInterceptor interceptor is not get
>>> registered.
>>>
>>> How this issue would be approached?
>>>
>>> CXF Version: 2.7.15
>>>
>>> WSDL:
>>> <flow name=3D"get:/academicCalendars:vuc-api-config">
>>> <message-properties-transformer
>>> doc:name=3D"Message Properties">
>>> <add-message-property key=3D"operation"
>>> value=3D"getAllAcadCalendars" />
>>> </message-properties-transformer>
>>> <set-payload value=3D"#[new Object[]{}]" doc:name=3D"Set
>>> Payload"></set-payload> <flow-ref name=3D"calendar" doc:name=3D"calenda=
r"
>>> /> </flow>
>>>
>>> <sub-flow name=3D"calendar">
>>> <cxf:jaxws-client
>>> clientClass=3D"au.edu.vu.its.as.ws.callista.vucalendarws.
>>> VuCalendarWS_Service"
>>> wsdlLocation=3D"${ws.callista.calendar.url}?WSDL" port=3D"
>>> VuCalendarWSSoapHttpPort"
>>> doc:name=3D"SOAP">
>>> <cxf:inInterceptors>
>>> <spring:bean class=3D"org.apache.cxf.interceptor.LoggingInInterceptor"
>>> /> </cxf:inInterceptors> <cxf:outInterceptors> <spring:bean
>>> class=3D"org.apache.cxf.interceptor.LoggingOutInterceptor" />
>>> <spring:bean parent=3D"wss4jOutInterceptor" /> </cxf:outInterceptors>
>>> </cxf:jaxws-client> <outbound-endpoint doc:name=3D"HTTP"
>>> address=3D"http://devsdvd.vu.edu.au:9990/VuCalendar/
>> VuCalendarWSSoapHttpPort"
>>> />
>>> </sub-flow>
>>>
>>> <spring:bean id=3D"wss4jOutConfiguration"
>>> class=3D"org.springframework.beans.factory.config.MapFactoryBean">
>>> <spring:property name=3D"sourceMap">
>>> <spring:map>
>>> <spring:entry key=3D"action" value=3D"UsernameToken" /> <spring:entry
>>> key=3D"user" value=3D"${ws.callista.user}" /> <spring:entry
>>> key=3D"passwordType" value=3D"PasswordText" /> <spring:entry
>>> key=3D"passwordCallbackClass"
>>> value=3D"au.edu.vu.its.as.mule.ClientPasswordCallback" /> </spring:map>
>>> </spring:property> </spring:bean>
>>>
>>> <spring:bean id=3D"wss4jOutInterceptor" abstract=3D"true"
>>> class=3D"org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
>>> <spring:property name=3D"properties" ref=3D"wss4jOutConfiguration" />
>>> </spring:bean>
>>>
>>> Thanks
>>> Siva
>>>
>>
>>
>>
>> --
>> Colm O hEigeartaigh
>>
>> Talend Community Coder
>> http://coders.talend.com
>>
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com

--
Daniel Kulp
dkulp@apache.org - http://dankulp.com/blog
Talend Community Coder - http://coders.talend.com


--_000_ME1PR01MB10587A305AA856D0029A0B91ABA10ME1PR01MB1058ausp_--