[ https://issues.apache.org/jira/browse/WSS-527?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Colm O hEigeartaigh resolved WSS-527.
-------------------------------------
       Resolution: Fixed
    Fix Version/s: 2.0.4

> When using WSS4JStaxInInterceptor giving NullPointer Exception in X509IssuerSerialTokenImpl.java:60
> ---------------------------------------------------------------------------------------------------
>
>                 Key: WSS-527
>                 URL: https://issues.apache.org/jira/browse/WSS-527
>             Project: WSS4J
>          Issue Type: Bug
>          Components: WSS4J Core
>    Affects Versions: 2.0.0, 2.0.3
>         Environment: Windows 7 
>            Reporter: Sudarshan Menon
>            Assignee: Colm O hEigeartaigh
>             Fix For: 2.0.4
>
>
> I Upgraded WSS4J 1.6.1 to WSS4J 2.0.0. The main motive was to encrypt passwords in crypto properties file.
> Let me paste the configuration. It is as  below.
> <jaxws:inInterceptors>
> 			<bean class="org.apache.cxf.ws.security.wss4j.WSS4JStaxInInterceptor">
> 				<constructor-arg>
> 					<map>
> 						<entry
> 							key="#{T(org.apache.wss4j.dom.handler.WSHandlerConstants).ACTION}"
> 							value="SAMLTokenSigned" />
> 						<entry key="faultStackTraceEnabled" value="true" />
> 						<entry key="signaturePropFile" value="${cloudenv}.ess.properties" />
> 						<entry key="passwordCallbackClass" value="com.uhg.optuminsight.pim.service.ws.interceptor.SAMLSecurityCallback" />
> 					</map>
> 				</constructor-arg>
> 			</bean>
> 			<bean class="com.uhg.optuminsight.pim.service.ws.interceptor.WebServiceInterceptor" />
> 		</jaxws:inInterceptors>
> 		
> 		<jaxws:properties>
> 			<entry key="ws-security.signature.properties" value="${cloudenv}.ess.properties" />
> 			<entry key="ws-security.saml2.validator">
> 				<ref bean="samlTokenValidator" />
> 			</entry>
> 			<entry key="jaxb.encoding" value="UTF-8"/>
> 			<entry key="schema-validation-enabled" value="true" />
> 		</jaxws:properties>
> Let me put the Soap Header request.It is as below
> <soap:Header>
>       <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
>          <xenc:EncryptedKey Id="EK-2891A1F499E94EA11A13831255443381" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
>             <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
>             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>                <wsse:SecurityTokenReference>
>                   <ds:X509Data>
>                      <ds:X509IssuerSerial>
>                         <ds:X509IssuerName>Some Issuer</ds:X509IssuerName>
>                         <ds:X509SerialNumber>Some Serial Number</ds:X509SerialNumber>
>                      </ds:X509IssuerSerial>
>                   </ds:X509Data>
>                </wsse:SecurityTokenReference>
>             </ds:KeyInfo>
>             <xenc:CipherData>
>                <xenc:CipherValue>UtcgDv+Fbo3lPnuuHMYl7jD90WOdMcfnIEAic3BnVJM/dhqbmt/LsNoS3dRMQPJZwoseuXXPX/vJgPK+oMDhDGKjPXAynwU9XFoYWAVPeHj0rq5x9zwDd3rrmm4E4cD12AIeXTg/42J6HDx+NhCtSYcDeUUJqscb0EQDJXoZ99P3uo7UhTUyIFgiy6wYyBVtmfmXPIYjxqOg+cSEN1erVFiPlSl6uZlw7ZQOuXj38QVWGJIYKjWDOsN5zIU3qXFxaQUgViTmxOoIMjLp1HQAP9Ttcl0WTIjdbomM9dNvuPNNa/9Y/44sbEqGzwYy0XrmbCMgWBtia0mgJzxU4Lfj7A==</xenc:CipherValue>
>             </xenc:CipherData>
>             <xenc:ReferenceList>
>                <xenc:DataReference URI="#ED-3"/>
>             </xenc:ReferenceList>
>          </xenc:EncryptedKey>
>          <wsse:UsernameToken wsu:Id="UsernameToken-2">
>             <wsse:Username>Some User Name</wsse:Username>
>             <xenc:EncryptedData Id="ED-3" Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
>                <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
>                <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>                   <wsse:SecurityTokenReference wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd">
>                      <wsse:Reference URI="#EK-2891A1F499E94EA11A13831255443381"/>
>                   </wsse:SecurityTokenReference>
>                </ds:KeyInfo>
>                <xenc:CipherData>
>                   <xenc:CipherValue>o3h3NrJHxVVMl6qNjZ4thRaaNMkXMmSkfgXidp9lgkQO62EsmTEuve6J1jYGCWsRGwC9ro7YTP9Ms21veox8JD9yeDQJjQIHeatDVb9NKp1AKZZDn5Kt3KAfEZfwp1EScJaTh3KrpD/AihBj8IYPyvCtRViuAsWGxbj9aSxTsW+ht35rlSK0fU0P7gRg17IsoeURhbafNOouX18wOzyZruizo55GUYvXBWmqqa5/5k2oV8elaqQRnhSz2EkQ7D5dmGUOGEG1OoMbfbZADha3mbRYTnDzP3cKf4sn4Fvx2JF+OEXhp3ZbUfqXtx2WWxlAreguqmVu04wMlQhYkUTKSJ3qRG7LMhlHHQTM8VhLHRafmKua8WALbCJfjG5mcXNF28HA6eeNJjWlA2wsozmFLS3yncEX7fKDeURHX5eHjL8yE+QtmMvH32EbN7nwsIvVz1qCvm1jsuqo81crpxOAm2N4uDGldJCjH7POaMQG90jK1y8f1LFyH+SPh6zwcQhDbZ2LP8Pt6/UGiiikm1Uiq5ZDwfChUz9+ULd2iwbNo/7jHWNhEllhF2n1McTDNPrHl7UTIQBSubY/F2qjjk3Vww==</xenc:CipherValue>
>                </xenc:CipherData>
>             </xenc:EncryptedData>
>          </wsse:UsernameToken>
>          <wsu:Timestamp wsu:Id="TS-1">
>             <wsu:Created>2013-10-30T09:32:24.283Z</wsu:Created>
>             <wsu:Expires>2015-12-30T09:37:24.283Z</wsu:Expires>
>          </wsu:Timestamp>
>       </wsse:Security>
>    </soap:Header>
> So the issue is the same Header works like charm when I use WSS4JInInterceptor. But when i try to use WSS4JStaxInInterceptor. I get NullPointer Exception. The exception occurs during the org.apache.cxf.binding.soap.interceptor.ReadHeadersInterceptor phase. The exception occurs at  the below line of 
> if (xmlReader.getEventType() == XMLStreamConstants.START_ELEMENT 
>                 || xmlReader.nextTag() == XMLStreamConstants.START_ELEMENT)
> StackTrace as below.
> java.lang.NullPointerException
> 	at org.apache.wss4j.stax.impl.securityToken.X509IssuerSerialTokenImpl.getAlias(X509IssuerSerialTokenImpl.java:60)
> 	at org.apache.wss4j.stax.impl.securityToken.X509SecurityTokenImpl.getKey(X509SecurityTokenImpl.java:80)
> 	at org.apache.xml.security.stax.impl.securityToken.AbstractInboundSecurityToken.getSecretKey(AbstractInboundSecurityToken.java:125)
> 	at org.apache.xml.security.stax.impl.processor.input.XMLEncryptedKeyInputHandler$1$1.getSecret(XMLEncryptedKeyInputHandler.java:216)
> 	at org.apache.xml.security.stax.impl.processor.input.XMLEncryptedKeyInputHandler$1$1.getKey(XMLEncryptedKeyInputHandler.java:116)
> 	at org.apache.xml.security.stax.impl.securityToken.AbstractInboundSecurityToken.getSecretKey(AbstractInboundSecurityToken.java:125)
> 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> 	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
> 	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> 	at java.lang.reflect.Method.invoke(Method.java:601)
> 	at org.apache.wss4j.stax.impl.securityToken.SecurityTokenFactoryImpl$1.invoke(SecurityTokenFactoryImpl.java:436)
> 	at $Proxy235.getSecretKey(Unknown Source)
> 	at org.apache.xml.security.stax.impl.processor.input.AbstractDecryptInputProcessor.processEvent(AbstractDecryptInputProcessor.java:221)
> 	at org.apache.xml.security.stax.impl.processor.input.AbstractDecryptInputProcessor.processNextHeaderEvent(AbstractDecryptInputProcessor.java:138)
> 	at org.apache.xml.security.stax.impl.InputProcessorChainImpl.processHeaderEvent(InputProcessorChainImpl.java:188)
> 	at org.apache.wss4j.stax.impl.processor.input.OperationInputProcessor.processNextHeaderEvent(OperationInputProcessor.java:51)
> 	at org.apache.xml.security.stax.impl.InputProcessorChainImpl.processHeaderEvent(InputProcessorChainImpl.java:188)
> 	at org.apache.wss4j.stax.impl.processor.input.SecurityHeaderInputProcessor$InternalSecurityHeaderBufferProcessor.processNextHeaderEvent(SecurityHeaderInputProcessor.java:244)
> 	at org.apache.xml.security.stax.impl.InputProcessorChainImpl.processHeaderEvent(InputProcessorChainImpl.java:188)
> 	at org.apache.wss4j.stax.impl.processor.input.SecurityHeaderInputProcessor.processNextEvent(SecurityHeaderInputProcessor.java:86)
> 	at org.apache.xml.security.stax.impl.InputProcessorChainImpl.processEvent(InputProcessorChainImpl.java:193)
> 	at org.apache.xml.security.stax.impl.XMLSecurityStreamReader.next(XMLSecurityStreamReader.java:78)
> 	at org.apache.wss4j.stax.impl.WSSecurityStreamReader.next(WSSecurityStreamReader.java:45)
> 	at org.apache.xml.security.stax.impl.XMLSecurityStreamReader.getEventType(XMLSecurityStreamReader.java:395)
> 	at org.apache.cxf.binding.soap.interceptor.ReadHeadersInterceptor.handleMessage(ReadHeadersInterceptor.java:138)
> 	at org.apache.cxf.binding.soap.interceptor.ReadHeadersInterceptor.handleMessage(ReadHeadersInterceptor.java:60)
> 	at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:263)



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org