[SWS-345] WSS4J interceptor creates creates invalid digest for SAAJ messages Created: 01/May/08  Updated: 05/May/08  Resolved: 05/May/08

Status: Closed
Project: Spring Web Services
Component/s: None
Affects Version/s: 1.5
Fix Version/s: 1.5.2

Type: Bug Priority: Critical
Reporter: Arjen Poutsma Assignee: Arjen Poutsma
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified


When using SAAJ and WSS4J on for outgoing messages, the digest created is incorrect, which results in signature verification failures. This is due to the fact that the Document exposed via SOAPMessage.getSOAPPart() is out of sync. Calling SOAPMessage.saveChanges() fixes this.

Comment by Arjen Poutsma [ 01/May/08 ]

As a workaround, you can use the AxiomSoapMessageFactory.

Comment by Arjen Poutsma [ 01/May/08 ]


Comment by Patrick Haren [ 04/May/08 ]


I am still seeing signature verification problems with version 1.5.1 in combination with SaajSoapMessageFactory.
The AxiomSoapMessageFactory workaround continues to work okay.
I am using spring-ws-1.5.1.jar from 04 May 2008, 1:47PM.

Comment by Arjen Poutsma [ 04/May/08 ]

What kind of problems, i.e. what is the exception and/or fault that you get?

Comment by Arjen Poutsma [ 04/May/08 ]

Definitely something weird going on here. The test I wrote for this (testSignAndValidate() in SaajWss4jMessageInterceptorSignTest) works fine, but it does not appear to work in deployed applications. Reopening for 1.5.2.

Let's hope we fix this one for good this time .

Comment by Arjen Poutsma [ 05/May/08 ]

Ok, I've given it another shot, with a different approach this time. I've also improved the tests, and tried this approach in a test project. It all works for me.

Patrick, could you try a snapshot tomorrow? See http://static.springframework.org/spring-ws/site/downloads/snapshots.html

Comment by Patrick Haren [ 05/May/08 ]

I just tried the snapshot (spring-ws-1.5.2-20080505.174403-1.zip) with a SaajSoapMessageFactory bean. Looks like it is working okay.
FYI, my test is against a WebSphere 6.1 web-service, using WebSphere's jax-rpc runtime, so the interoperability is looking good!

Comment by Arjen Poutsma [ 05/May/08 ]

Great! Thanks for checking this out, Patrick.

I guess it makes sense to speed up the release for this fix, so I've set 1.5.2 to be released at the end of next week.

Generated at Thu Oct 18 11:22:52 UTC 2018 using JIRA 7.9.2#79002-sha1:3bb15b68ecd99a30eb364c4c1a393359bcad6278.