CODEWITHSUNDEEP
soapws-securitywss4j
Frank
Frank

Reputation: 399

WSS4J does not parse SOAP message

I have code like this:

private WSSecurityEngine engine = new WSSecurityEngine();
private CallbackHandler callbackHandler = new UsernamePasswordCallbackHandler();

@Test
public void testWss4jEngine() {

    InputStream in = getClass().getClassLoader().getResourceAsStream("soap/soapWithUsernameTokenRequest.xml");

    DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
    DocumentBuilder docBuilder;
    Document doc = null;
    try {
        docBuilder = builderFactory.newDocumentBuilder();

        doc = docBuilder.parse(in);

    } catch (Exception e) {
        LOG.error("Error parsing incoming request. Probably it is not a valid XML/SOAP message.", e);

        return;
    }

    List<WSSecurityEngineResult> results = null;

    try {
        results = engine.processSecurityHeader(doc, null, callbackHandler, null);
    } catch (WSSecurityException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }

    // the following line raises a NullPointerException
    WSSecurityEngineResult actionResult = WSSecurityUtil.fetchActionResult(results, WSConstants.UT);
    UsernameToken receivedToken = (UsernameToken) actionResult.get(WSSecurityEngineResult.TAG_USERNAME_TOKEN);
    Assert.assertTrue(receivedToken != null);
}

The SOAP message from the file that is passed to the WSS4j engine is:

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<SOAP-ENV:Header>
    <wsse:Security
        xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
        xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
        SOAP-ENV:mustUnderstand="1">
        <wsse:UsernameToken wsu:Id="UsernameToken-2">
            <wsse:Username>wernerd</wsse:Username>
            <wsse:Password
                Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">+dCtKLCG5+uDxNM8tLh8BSQSqgY=</wsse:Password>
            <wsse:Nonce
                EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">lZlpivFFQ3nhpp2Wf6pu+g==</wsse:Nonce>
            <wsu:Created>2012-07-10T15:25:46.627Z</wsu:Created>
        </wsse:UsernameToken>
    </wsse:Security>
</SOAP-ENV:Header>
<SOAP-ENV:Body>
    <tem:Add xmlns:tem="http://tempuri.org/">
        <tem:a>1</tem:a>
        <tem:b>2</tem:b>
    </tem:Add>
</SOAP-ENV:Body>

In my opinion it is a fully compliant WS-Security UsernameToken message!

However, the engine.processSecurityHeader() does not return any security result. The results variable remains null which then raises a NPE in the next line. Here is the stack trace:

java.lang.NullPointerException
at org.apache.ws.security.util.WSSecurityUtil.fetchActionResult(WSSecurityUtil.java:845)
at de.justworks.wssproxy.servlet.test.WssProxyServletTestIT.testWss4jEngine(WssProxyServletTestIT.java:121)
at org.apache.maven.surefire.testng.TestNGExecutor.run(TestNGExecutor.java:76)

Anyone has any idea what I am doing wrong?

Thanks Frank

Upvotes: 2

Views: 1919

Answers (1)

Frank
Frank

Reputation: 399

Hooray!

Found the problem.

It's the setting

builderFactory.setNamespaceAware(true)

that you have to set for the document builder factory!

Cheers! Frank

Upvotes: 5

Related Questions