Uploaded image for project: 'Spring Web Services'
  1. Spring Web Services
  2. SWS-345

WSS4J interceptor creates creates invalid digest for SAAJ messages

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: 1.5
    • Fix Version/s: 1.5.2
    • Component/s: None
    • Labels:
      None

      Description

      When using SAAJ and WSS4J on for outgoing messages, the digest created is incorrect, which results in signature verification failures. This is due to the fact that the Document exposed via SOAPMessage.getSOAPPart() is out of sync. Calling SOAPMessage.saveChanges() fixes this.

        Activity

        Hide
        arjen.poutsma Arjen Poutsma added a comment -

        As a workaround, you can use the AxiomSoapMessageFactory.

        Show
        arjen.poutsma Arjen Poutsma added a comment - As a workaround, you can use the AxiomSoapMessageFactory.
        Hide
        arjen.poutsma Arjen Poutsma added a comment -

        Fixed.

        Show
        arjen.poutsma Arjen Poutsma added a comment - Fixed.
        Hide
        harenp Patrick Haren added a comment -

        Arjen,

        I am still seeing signature verification problems with version 1.5.1 in combination with SaajSoapMessageFactory.
        The AxiomSoapMessageFactory workaround continues to work okay.
        I am using spring-ws-1.5.1.jar from 04 May 2008, 1:47PM.

        Show
        harenp Patrick Haren added a comment - Arjen, I am still seeing signature verification problems with version 1.5.1 in combination with SaajSoapMessageFactory. The AxiomSoapMessageFactory workaround continues to work okay. I am using spring-ws-1.5.1.jar from 04 May 2008, 1:47PM.
        Hide
        arjen.poutsma Arjen Poutsma added a comment -

        What kind of problems, i.e. what is the exception and/or fault that you get?

        Show
        arjen.poutsma Arjen Poutsma added a comment - What kind of problems, i.e. what is the exception and/or fault that you get?
        Hide
        arjen.poutsma Arjen Poutsma added a comment -

        Definitely something weird going on here. The test I wrote for this (testSignAndValidate() in SaajWss4jMessageInterceptorSignTest) works fine, but it does not appear to work in deployed applications. Reopening for 1.5.2.

        Let's hope we fix this one for good this time .

        Show
        arjen.poutsma Arjen Poutsma added a comment - Definitely something weird going on here. The test I wrote for this (testSignAndValidate() in SaajWss4jMessageInterceptorSignTest) works fine, but it does not appear to work in deployed applications. Reopening for 1.5.2. Let's hope we fix this one for good this time .
        Hide
        arjen.poutsma Arjen Poutsma added a comment -

        Ok, I've given it another shot, with a different approach this time. I've also improved the tests, and tried this approach in a test project. It all works for me.

        Patrick, could you try a snapshot tomorrow? See http://static.springframework.org/spring-ws/site/downloads/snapshots.html

        Show
        arjen.poutsma Arjen Poutsma added a comment - Ok, I've given it another shot, with a different approach this time. I've also improved the tests, and tried this approach in a test project. It all works for me. Patrick, could you try a snapshot tomorrow? See http://static.springframework.org/spring-ws/site/downloads/snapshots.html
        Hide
        harenp Patrick Haren added a comment -

        Arjen,
        I just tried the snapshot (spring-ws-1.5.2-20080505.174403-1.zip) with a SaajSoapMessageFactory bean. Looks like it is working okay.
        FYI, my test is against a WebSphere 6.1 web-service, using WebSphere's jax-rpc runtime, so the interoperability is looking good!

        Show
        harenp Patrick Haren added a comment - Arjen, I just tried the snapshot (spring-ws-1.5.2-20080505.174403-1.zip) with a SaajSoapMessageFactory bean. Looks like it is working okay. FYI, my test is against a WebSphere 6.1 web-service, using WebSphere's jax-rpc runtime, so the interoperability is looking good!
        Hide
        arjen.poutsma Arjen Poutsma added a comment -

        Great! Thanks for checking this out, Patrick.

        I guess it makes sense to speed up the release for this fix, so I've set 1.5.2 to be released at the end of next week.

        Show
        arjen.poutsma Arjen Poutsma added a comment - Great! Thanks for checking this out, Patrick. I guess it makes sense to speed up the release for this fix, so I've set 1.5.2 to be released at the end of next week.

          People

          • Assignee:
            arjen.poutsma Arjen Poutsma
            Reporter:
            arjen.poutsma Arjen Poutsma
          • Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved: