Rampart Axis2 multiple <wsse:Security> headers in request (error)

2.3k views Asked by At

So, I am developing a web service using rampart and axis2 in eclipse. I am trying to implement a simple username/password authentication scheme, but I have some issues.

My code is basically working now, but in my SOAP request the is added 3 (!) times:

        <wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-1">
           <wsse:Username>test</wsse:Username>
           <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">pass</wsse:Password>
        </wsse:UsernameToken>
        <wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-2">
           <wsse:Username>test</wsse:Username>
           <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">pass</wsse:Password>
        </wsse:UsernameToken>
        <wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-3">
           <wsse:Username>test</wsse:Username>
           <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">pass</wsse:Password>
        </wsse:UsernameToken>

The response I am getting is correct though, so I really dont understand why the same header element is added three times. Can anybody help?

My services.xml looks like this:

Please Type your service description here

<wsp:Policy wsu:Id="UTOverTransport"
    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
    xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
    <wsp:ExactlyOne>
        <wsp:All>
            <sp:SignedSupportingTokens
                xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                <wsp:Policy>
                    <sp:UsernameToken
                        sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient" />
                </wsp:Policy>
            </sp:SignedSupportingTokens>
            <ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy">
                <ramp:passwordCallbackClass>sec.PWCBHandler</ramp:passwordCallbackClass>
            </ramp:RampartConfig>

        </wsp:All>
    </wsp:ExactlyOne>
</wsp:Policy>


<messageReceivers>
    <messageReceiver mep="http://www.w3.org/2004/08/wsdl/in-only" class="org.apache.axis2.rpc.receivers.RPCInOnlyMessageReceiver" />
    <messageReceiver  mep="http://www.w3.org/2004/08/wsdl/in-out"  class="org.apache.axis2.rpc.receivers.RPCMessageReceiver"/>
</messageReceivers>
<parameter name="ServiceClass" locked="false">sec.add</parameter>

And on the client side, my axis2.xml looks like this:

<wsp:Policy wsu:Id="UTOverTransport" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
    <wsp:ExactlyOne>
      <wsp:All>
        <sp:SignedSupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
            <wsp:Policy>
                <sp:UsernameToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient" />
          </wsp:Policy>
        </sp:SignedSupportingTokens>
        <ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy"> 
            <ramp:user>test</ramp:user>
            <ramp:passwordCallbackClass>sec.PWCBHandler</ramp:passwordCallbackClass>
        </ramp:RampartConfig>
      </wsp:All>
    </wsp:ExactlyOne>
</wsp:Policy>

My Client.java is implemented like this:

public void invokeService(){

    ConfigurationContext ctx;
    try {
        ctx = ConfigurationContextFactory.createConfigurationContextFromFileSystem(this.path, null);
        AddStub stub = new AddStub(ctx,this.EPR);

        ServiceClient client = stub._getServiceClient();
        Options o = client.getOptions();
                    o.setUsername("test");
                    o.setPassword("pass");
        client.engageModule("rampart");

        AddStub.AddNumbers add = new AddStub.AddNumbers();
        add.setA(this.a);
        add.setB(this.b);

        System.out.println("Requesting");
        AddStub.AddNumbersResponse response = stub.addNumbers(add);
        System.out.println(response.get_return());

    } catch (AxisFault e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } 
    catch (RemoteException e) {
        e.printStackTrace();
    }
}
0

There are 0 answers