axis 1.4/ wws4j signing and .net problem

[John Farrel]

I've been told I need to send requests to a .net service. They have supplied me with this policy document:

<?xml version="1.0" encoding="utf-8"?>
<policyDocument xmlns="http://schemas.microsoft.com/wse/2003/06/Policy">
  <mappings xmlns:wse="http://schemas.microsoft.com/wse/2003/06/Policy">
 
    <!--
	The following policy describes the policy requirements for the service: 
	https://www.wireline.co.nz .
    -->
	<defaultEndpoint>
		<defaultOperation>
			<request policy="#Sign-X.509" />
			<response policy="" />
			<fault policy="" />
		</defaultOperation>
	</defaultEndpoint>

  </mappings>

  <policies xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://schemas.xmlsoap.org/ws/2002/12/policy" xmlns:wssp="http://schemas.xmlsoap.org/ws/2002/12/secext" xmlns:wse="http://schemas.microsoft.com/wse/2003/06/Policy" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/03/addressing">
    <wsp:Policy wsu:Id="Sign-X.509">
      <!--MessagePredicate is used to require headers. This assertion should be used along with the Integrity assertion when the presence of the signed element is required. NOTE: this assertion does not do anything for enforcement (send-side) policy.-->
      <wsp:MessagePredicate wsp:Usage="wsp:Required" Dialect="http://schemas.xmlsoap.org/2002/12/wsse#part">wsp:Body() wsp:Header(wsa:To) wsp:Header(wsa:Action) wsp:Header(wsa:MessageID) wse:Timestamp()</wsp:MessagePredicate>
      <!--The Integrity assertion is used to ensure that the message is signed with X.509. Many Web services will also use the token for authorization, such as by using the <wse:Role> claim or specific X.509 claims.-->
      <wssp:Integrity wsp:Usage="wsp:Required">
        <wssp:TokenInfo>
          <!--The SecurityToken element within the TokenInfo element describes which token type must be used for Signing.-->
          <wssp:SecurityToken wse:IdentityToken="true">
            <wssp:TokenType>http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3</wssp:TokenType>
          </wssp:SecurityToken>
        </wssp:TokenInfo>
        <wssp:MessageParts Dialect="http://schemas.xmlsoap.org/2002/12/wsse#part">wsp:Body() wsp:Header(wsa:Action) wsp:Header(wsa:FaultTo) wsp:Header(wsa:From) wsp:Header(wsa:MessageID) wsp:Header(wsa:RelatesTo) wsp:Header(wsa:ReplyTo) wsp:Header(wsa:To) wse:Timestamp()</wssp:MessageParts>
      </wssp:Integrity>
    </wsp:Policy>
  </policies>
</policyDocument>

Google tells me I can do this on my out-going messages to get them to use http://schemas.xmlsoap.org/ws/2004/03/addressing

stub._setProperty (
org.apache.axis.message.addressing.Constants.ENV_ADDRESSING_NAMESPACE_URI,
org.apache.axis.message.addressing.Constants.NS_URI_ADDRESSING_2004_03 ) ;

These constants are in the addressing.1.0.jar. The problem I have is that I cannot find this jar for download *anywhere*. not from the Apache website, certainly.

[John Farrel]

Problem solved:

I found an archived copy of wss4j (1.5.0) which includes addressing.1.0.jar. More recent builds do not include this library.

Just before calling the web service, set

((Stub) port)._setProperty(Constants.ENV_ADDRESSING_NAMESPACE_URI, Constants.NS_URI_ADDRESSING_2004_03 ) ;

I needed to sign these elements of the message:

wsp:Body()
wsp:Header(wsa:Action)
wsp:Header(wsa:FaultTo)
wsp:Header(wsa:From)
wsp:Header(wsa:MessageID)
wsp:Header(wsa:RelatesTo)
wsp:Header(wsa:ReplyTo)
wsp:Header(wsa:To)
wse:Timestamp()

so the wsdd needed to change to this:

<deployment xmlns="http://xml.apache.org/axis/wsdd/" xmlns:java="http://xml.apache.org/axis/wsdd/providers/java">
<transport name="http" pivot="javarg.apache.axis.transport.http.HTTPSender"/>
<globalConfiguration >
<parameter name="addressing.sendReplyTo" value="true"/>
<parameter name="enableNamespacePrefixOptimization" value="false"/>
<requestFlow >

<handler type="javarg.apache.axis.message.addressing.handler.AddressingHandler">
<parameter name="referencePropertyNames" value="{Element}{http://schemas.xmlsoap.org/ws/2004/03/addressing}Action;{Element}{http://schemas.xmlsoap.org/ws/2004/03/addressing}MessageID;{Element}{http://schemas.xmlsoap.org/ws/2004/03/addressing}ReplyTo;{Element}{http://schemas.xmlsoap.org/ws/2004/03/addressing}To;{Element}{http://schemas.xmlsoap.org/ws/2004/03/addressing}From"/>
</handler>

<handler type="javarg.apache.ws.axis.security.WSDoAllSender">
<parameter name="action" value="Timestamp Signature"/>
<parameter name="action" value="Timestamp Signature"/>
<parameter name="user" value="username"/>
<parameter name="passwordCallbackClass" value="classname"/>
<parameter name="passwordType" value="PasswordText"/>
<parameter name="signaturePropFile" value="Crypto.properties"/>
<parameter name="signatureKeyIdentifier" value="DirectReference"/>
<parameter name="signatureParts" value="{Element}{http://schemas.xmlsoap.org/ws/2004/03/addressing}Action;{Element}{http://schemas.xmlsoap.org/ws/2004/03/addressing}MessageID;{Element}{http://schemas.xmlsoap.org/ws/2004/03/addressing}ReplyTo;{Element}{http://schemas.xmlsoap.org/ws/2004/03/addressing}To;{Element}{http://schemas.xmlsoap.org/ws/2004/03/addressing}From;{Element}{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Timestamp;{Element}{http://schemas.xmlsoap.org/soap/envelope/}Body"/>
</handler>
</requestFlow >
</globalConfiguration >
</deployment>

[Sarath Vk]

Hi John,

We are also facing the same Issue.Can you please assist us to resolve the issue.

Regards,
Sarath VK