[Web Services] Making a WSS4J client talk to a WSE 3.0 secured web service with x509 certificates

Try SKIKeyIdentifier

If you want to avoid having to create the custom assertion, you can get around the "WSE2007: More than one X509SecurityToken is present in the security header of the incoming message, but only one was expected":

In the axis client config file, change *one* or *both* of the signatureKeyIdentifier/encryptionKeyIdentifier from "DirectReference" to "SKIKeyIdentifier" in WSDoAllSender.

The drawback of this approach is that SKIKeyIdentifier does not include the certificate in the SOAP, it creates a reference. You'll need to have the public certificates installed on the server (.Net/WSE) for this to work.

Re: Try SKIKeyIdentifier

Thanks. I'll test it out, and see how that works.

Axis2/Rampart client with WCF service

Thanks for the article Erland. It helped me no end. I've now got a working config for an Axis2/Rampart client with a Windows Communication Foundation (WCF) service using Mutual X509 Certificates:
http://www.shellysaunders.co.uk/Blog/tabid/65/EntryID/2/Default.aspx

Re:Axis2/Rampart client with WCF service

Nice work, Shelly. I'll add a link to your config.

Updated version

I've just updated the blogpost after testing some of Brook H.'s stuff. And it works nicely! Thanks Brook!

Both client and server in axis

This is good but i want both client and server to be written in axis and securing it with wss4j

Implementing Message Layer Security with X.509 Certificates in WSE 3.0

Hello,

I am Implementing Message Layer Security with X.509 Certificates in WSE 3.0. Services are developed in .net 2.0 and interface is java platform. I successfully implemented for .net client and .net server and it is working fine. so, we hosted the services and gave to url and certificated(.pfx files) to the java team. Now what the problem they are facing is, they need user name and password to proceed further but we didn\'t set the user name and password in your configuration and not even password is set for the .pfx files. please find the policy file below and give me suggestion. Thanks in advance.

Ravi.
<policies xmlns=\"http://schemas.microsoft.com/wse/2005/06/policy\">
<extensions>
<extension name=\"authorization\" type=\"Microsoft.Web.Services3.Design.AuthorizationAssertion, Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" />
<extension name=\"mutualCertificate11Security\" type=\"Microsoft.Web.Services3.Design.MutualCertificate11Assertion, Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" />
<extension name=\"x509\" type=\"Microsoft.Web.Services3.Design.X509TokenProvider, Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" />
<extension name=\"requireActionHeader\" type=\"Microsoft.Web.Services3.Design.RequireActionHeaderAssertion, Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" />
</extensions>
<policy name=\"ServerCert\">
<mutualCertificate11Security establishSecurityContext=\"true\" renewExpiredSecurityContext=\"true\" requireSignatureConfirmation=\"true\" messageProtectionOrder=\"SignBeforeEncrypt\" requireDerivedKeys=\"true\" ttlInSeconds=\"86400\">
<serviceToken>
<x509 storeLocation=\"LocalMachine\" storeName=\"My\" findValue=\"CN=ABCServer\" findType=\"FindBySubjectDistinguishedName\" />
</serviceToken>
<protection>
<request signatureOptions=\"IncludeAddressing, IncludeTimestamp, IncludeSoapBody\" encryptBody=\"true\" />
<response signatureOptions=\"IncludeAddressing, IncludeTimestamp, IncludeSoapBody\" encryptBody=\"true\" />
<fault signatureOptions=\"IncludeAddressing, IncludeTimestamp, IncludeSoapBody\" encryptBody=\"false\" />
</protection>
</mutualCertificate11Security>
<requireActionHeader />
</policy>
</policies>

requireactionheader assertion

I have a JAVA client comsuming a .NET WSE3.0 enabled webservice. The webservice contains the requireActionHeader assertion in the secuirty policy file. What does the JAVA client need to do to fulfil this assertion? I see you have the same assertion in the example above but what specifically does the client need to include for this?

requireactionheader assertion

I have a JAVA client comsuming a .NET WSE3.0 enabled webservice. The webservice contains the requireActionHeader assertion in the secuirty policy file. What does the JAVA client need to do to fulfil this assertion? I see you have the same assertion in the example above but what specifically does the client need to include for this?

I have .Net client using a java webservice in CXF. I cant get path is exception when I get the response back from the webservice. Any help is greatly appreciated.

Microsoft.Web.Services3.Security.SecurityFault: Referenced security token could not be retrieved ---> System.Exception: WSE590: Failed to resolve the following Key Info <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"><wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><ds:X509Data xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509IssuerSerial>
<ds:X509IssuerName>CN=GreyhoundTicketing</ds:X509IssuerName>
<ds:X509SerialNumber>-151607773298184276178099932590328839740</ds:X509SerialNumber>
</ds:X509IssuerSerial>
</ds:X509Data></wsse:SecurityTokenReference></KeyInfo>.

Thanks

What kind of skiMode did you set? Looks like the java web service is using serial number. Can you configure the java web service to use thumbprint sha-1? Or did you configure your client to use serial number as skiMode. Is the serial number correct? (negative?)

The serial number is coming through correctly and I have set the skimode to IssuerSerial on my side, but still see the same error

I downgraded to WSE 2.0, could you send me your app.config and policyCache.config if you have it. Thanks for your help.