Announcement Announcement Module
Collapse
No announcement yet.
Error with Wss4jSecurityInterceptor Page Title Module
Move Remove Collapse
X
Conversation Detail Module
Collapse
  • Filter
  • Time
  • Show
Clear All
new posts

  • Error with Wss4jSecurityInterceptor

    Hi,

    I am trying to insert a Wss4jSecurityInterceptor in my web service configuration because I want to use the WS-Security Authentication for the incoming request.

    Here is the configuration of my interceptor

    <!-- Validate UserToken (WS-Security) using AuthenticationManager defined in spring-security.xml -->
    <bean id="wsSecurityInterceptor "
    class="org.springframework.ws.soap.security.wss4j. Wss4jSecurityInterceptor">
    <property name="validateRequest" value="true" />
    <property name="secureResponse" value="false" />
    <property name="validationActions" value="UsernameToken" />
    <property name="securementActions" value="NoSecurity"/>
    <property name="validationCallbackHandler">
    <bean
    class="org.springframework.ws.soap.security.wss4j. callback.SpringPlainTextPasswordValidationCallback Handler">
    <property name="authenticationManager"
    ref="_authenticationManager" />
    </bean>
    </property>
    </bean>



    When this interceptor is invoked I get the following exception:

    22:26:44.125 DEBUG MessageDispatcherServlet - Line (588) Could not complete request
    java.lang.AbstractMethodError: org.springframework.ws.soap.security.AbstractWsSec urityInterceptor.validateMessage(Lorg/springframework/ws/soap/SoapMessageV

    at org.springframework.ws.soap.security.AbstractWsSec urityInterceptor.handleRequest(AbstractWsSecurityI nterceptor.java:75)
    at org.springframework.ws.server.MessageDispatcher.di spatch(MessageDispatcher.java:207)
    at org.springframework.ws.server.MessageDispatcher.re ceive(MessageDispatcher.java:162)
    at org.springframework.ws.transport.support.WebServic eMessageReceiverObjectSupport.handleConnection(Web ServiceMessageReceiverObjectSupport.java:87)
    at org.springframework.ws.transport.http.WebServiceMe ssageReceiverHandlerAdapter.handle(WebServiceMessa geReceiverHandlerAdapter.java:57)
    at org.springframework.ws.transport.http.MessageDispa tcherServlet.doService(MessageDispatcherServlet.ja va:197)
    at org.springframework.web.servlet.FrameworkServlet.p rocessRequest(FrameworkServlet.java:571)
    at org.springframework.web.servlet.FrameworkServlet.d oPost(FrameworkServlet.java:511)
    at javax.servlet.http.HttpServlet.service(HttpServlet .java:763)
    at javax.servlet.http.HttpServlet.service(HttpServlet .java:856)
    ............................................

    By the way I am using spring-ws-1.5.4 with spring-2.5.5 and spring-security-2.0.3 and BEA Weblogic 9.2.

    thanks

  • #2
    What I have observed is the following:

    If I use the SAAJ implementation of Weblogic 9.2 then
    • if I don't use the Wss4jSecurityInterceptor then the service is executed without any problem
    • if I use the Wss4jSecurityInterceptor then I get the famous "UnsupportedOperationException:This class does not support SAAJ 1.1"

    If I use the SUN SAAJ implementation via the following configuration
    Code:
    <bean id="messageFactory"
    		class="org.springframework.ws.soap.saaj.SaajSoapMessageFactory">		 
    		<property name="messageFactory">
    			<bean class="com.sun.xml.messaging.saaj.soap.MessageFactoryImpl" />
    		</property>
    	</bean>
    then no matter if I use Wss4jSecurityInterceptor or not I get an UnsupportedOperationException when the MessageFactoryImpl.createMessage() method is created in SAAJ.jar for the response to the service invocation.

    Any help will be appreciated.

    Comment


    • #3
      At last after a lot of debugging the problem has been resolved. If you are to use SUN SAAJ, then you should use com.sun.xml.messaging.saaj.soap.ver1_1.SOAPMessage Factory1_1Impl as your message factory and not the com.sun.xml.messaging.saaj.soap.MessageFactoryImpl as mentioned in the Spring WS FAQ.

      The second throws an UnsupportedOperationException when createMessage() method is called without any arguments which by the way is the case when invoked via DefaultMessageContext class in Spring-WS.

      I hope this thread saves time from other that could face the same problem

      Comment


      • #4
        Could you share your dependancies with me ? I don't know where to get

        com.sun.xml.messaging.saaj.soap.ver1_1.SOAPMessage Factory1_1Impl

        Thanks

        Comment


        • #5
          Hi, I had exactly the same issue, but setting the MessageFactory to version which you suggested caused in my case another error.
          java.lang.NoSuchMethodError: javax.xml.soap.SOAPFault.setFaultCode(Ljavax/xml/namespace/QNameV
          at com.sun.xml.messaging.saaj.soap.impl.BodyImpl.addF ault(BodyImpl.java:77)
          at org.springframework.ws.soap.saaj.Saaj11Implementat ion.addFault(Saaj11Implementation.java:147)
          at org.springframework.ws.soap.saaj.SaajSoap11Body.ad dFault(SaajSoap11Body.java:55)
          at org.springframework.ws.soap.saaj.SaajSoap11Body.ad dServerOrReceiverFault(SaajSoap11Body.java:73)
          at org.springframework.ws.soap.server.endpoint.Simple SoapExceptionResolver.resolveExceptionInternal(Sim pleSoapExceptionResolver.java:66)
          at org.springframework.ws.server.endpoint.AbstractEnd pointExceptionResolver.resolveException(AbstractEn dpointExceptionResolver.java:86)
          at org.springframework.ws.server.MessageDispatcher.pr ocessEndpointException(MessageDispatcher.java:311)
          at org.springframework.ws.server.MessageDispatcher.di spatch(MessageDispatcher.java:235)
          at org.springframework.ws.server.MessageDispatcher.re ceive(MessageDispatcher.java:168)
          at org.springframework.ws.transport.support.WebServic eMessageReceiverObjectSupport.handleConnection(Web ServiceMessageReceiverObjectSupport.java:88)
          at org.springframework.ws.transport.http.WebServiceMe ssageReceiverHandlerAdapter.handle(WebServiceMessa geReceiverHandlerAdapter.java:57)
          at org.springframework.ws.transport.http.MessageDispa tcherServlet.doService(MessageDispatcherServlet.ja va:230)
          at org.springframework.web.servlet.FrameworkServlet.p rocessRequest(FrameworkServlet.java:571)
          at org.springframework.web.servlet.FrameworkServlet.d oPost(FrameworkServlet.java:511)
          at javax.servlet.http.HttpServlet.service(HttpServlet .java:763)
          at javax.servlet.http.HttpServlet.service(HttpServlet .java:856)
          at weblogic.servlet.internal.StubSecurityHelper$Servl etServiceAction.run(StubSecurityHelper.java:227)
          at weblogic.servlet.internal.StubSecurityHelper.invok eServlet(StubSecurityHelper.java:125)
          at weblogic.servlet.internal.ServletStubImpl.execute( ServletStubImpl.java:283)
          at weblogic.servlet.internal.TailFilter.doFilter(Tail Filter.java:26)
          at weblogic.servlet.internal.FilterChainImpl.doFilter (FilterChainImpl.java:42)

          Did you had such issue ?

          Comment


          • #6
            Weblogic 8 and 9 supply SAAJ 1.1. Although you have bundled the SAAJ 1.3 in your application and have pointed Spring to use the exact MessageFactory from SAAJ 1.3 JAR, Weblogic still uses its own bundle for the other classes of SAAJ.

            So, for instance, if you open the saaj-impl.jar you have imported in your webapp and check the code of the SOAPFault class, you will see that the specified method ("public abstract void setFaultCode(QName qname)") exists there.

            However if you open the webservices.jar that comes with Weblogic and check the code of the SOAPFault class, you will see that this method doesn't exists, that is why you get the NoSuchMethodError exception.

            To solve this you have to instruct Weblogic classloading to load first the jars found in your WEB-INF. This you can do by setting the following in weblogic.xml

            Code:
            <container-descriptor>
                  <prefer-web-inf-classes>true</prefer-web-inf-classes>
            </container-descriptor>
            Check if this will solve the problem

            Comment


            • #7
              indeed you are right. Changing classloading fixed a problem.
              Thanks a lot !

              Comment


              • #8
                BTW, I saw that you are using authentication manager.
                Do you use JAAS for authentication against weblogic ?
                If so do you have also an issue with loading JAAS login.conf file ?
                I'm using following authmanager config:

                <bean id="NBIAuthManager" class="org.springframework.security.providers.Prov iderManager">
                <property name="providers">
                <list>
                <ref local="NBIAuthenticationProvider"/>
                </list>
                </property>
                </bean>
                <bean id="NBIAuthenticationProvider" class="org.springframework.security.providers.jaas .JaasAuthenticationProvider">
                <property name="loginConfig" value="classpath:jaaslogin.conf"/>
                <property name="loginContextName" value="HSM"/>
                <property name="callbackHandlers">
                <list>
                <bean class="org.springframework.security.providers.jaas .JaasNameCallbackHandler"/>
                <bean class="org.springframework.security.providers.jaas .JaasPasswordCallbackHandler"/>
                </list>
                </property>
                <property name="authorityGranters">
                <list>
                <bean class="com.alu.hsm.webservice.HSMAuthorityGranter"/>
                </list>
                </property>
                </bean>

                I have put jaaslogin.conf file into WEB-INF/classes folder.
                and jaaslogin.conf file is:
                HSM {
                weblogic.security.auth.login.UsernamePasswordLogin Module required debug=true ;
                };

                If I deploy my application in Tomcat it works fine.
                But if I deploy it in Weblogic I got:
                "No Configuration was registered that can handle the configuration named HSM"

                Comment


                • #9
                  Did anyone encounter the same error (UnsupportedOperationException) with Tomcat 6.x and Java 1.5? I tried the proposed solution but I still have it.

                  Comment


                  • #10
                    Tomcat is really strange then loading jar files which have javax. packages inside.
                    I had to put saaj-api-1.3.jar into $TOMCAT_HOME/common/endorsed folder and restart it. Otherwise UnsupportedOperation exception were still there.
                    I used tomcat 5.5, but I think it is the same in tomcat6

                    Comment

                    Working...
                    X