Apache CXF - Configure WSS4JInInterceptor

Question

I'm using Apache CXF + WS-Security in my project when connecting to the server.

When server's response is received I must validate the signature of SignatureConfirmation, Timestamp, SOAP-body with server's public key, which is included as BinarySecurityToken in SOAP header. After that I need to decrypt the symmetrical key with my own certificate's private key and eventually decrypt the SOAP body.

Here is the diagram with the request-flow:

How should I configure my WSS4JInInterceptor to do that? Here is what I have now:

// for outgoing messages: Signature and Timestamp validation
        outProps.put(WSHandlerConstants.ACTION, WSHandlerConstants.SIGNATURE + " " + WSHandlerConstants.TIMESTAMP);
        outProps.put(WSHandlerConstants.USER, "sss");
        outProps.put(WSHandlerConstants.PW_CALLBACK_CLASS, ClientKeystorePasswordCallbackHandler.class.getName());
        outProps.put(WSHandlerConstants.SIG_PROP_FILE, "client_sec.properties");
        outProps.put(WSHandlerConstants.SIG_KEY_ID, "DirectReference");
        outProps.put(WSHandlerConstants.SIGNATURE_PARTS, "{}{http://www.w3.org/2003/05/soap-envelope}Body;{}{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Timestamp;{}{http://kontaktinfo.difi.no/wsdl/oppslagstjeneste-16-02}Oppslagstjenesten}");
        outProps.put(WSHandlerConstants.SIG_ALGO, "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
        outProps.put(WSHandlerConstants.SIG_DIGEST_ALGO, "http://www.w3.org/2001/04/xmlenc#sha256");


        // for incoming messages: Signature and Timestamp validation. Response is Encrypted
        inProps.put(WSHandlerConstants.ACTION, WSHandlerConstants.SIGNATURE + " " + WSHandlerConstants.TIMESTAMP + " " + WSHandlerConstants.ENCRYPT);
        inProps.put(WSHandlerConstants.SIG_KEY_ID, "DirectReference");
        inProps.put(WSHandlerConstants.PW_CALLBACK_CLASS, ClientKeystorePasswordCallbackHandler.class.getName());
        inProps.put(WSHandlerConstants.SIG_PROP_FILE, "server_sec.properties");
        inProps.put(WSHandlerConstants.DEC_PROP_FILE, "client_sec.properties");

        wss4JInInterceptor = new WSS4JInInterceptor(inProps);
        wss4JOutInterceptor = new WSS4JOutInterceptor(outProps);

server_sec.properties

org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
org.apache.ws.security.crypto.merlin.keystore.type=jks
org.apache.ws.security.crypto.merlin.keystore.password=changeit
org.apache.ws.security.crypto.merlin.keystore.alias=test
org.apache.ws.security.crypto.merlin.file=certs/server.jks

client_sec.properties:

org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
org.apache.ws.security.crypto.merlin.keystore.type=PKCS12
org.apache.ws.security.crypto.merlin.keystore.password=changeit
org.apache.ws.security.crypto.merlin.keystore.alias=sss
org.apache.ws.security.crypto.merlin.file=certs/sss_client.p12

After I receive the response I get the error:

SEVERE: Servlet.service() for servlet [rest] in context with path [] threw exception [Request processing failed; nested exception is javax.xml.ws.soap.SOAPFaultException: Error during certificate path validation: No trusted certs found] with root cause
org.apache.wss4j.common.ext.WSSecurityException: Error during certificate path validation: No trusted certs found
    at org.apache.wss4j.common.crypto.Merlin.verifyTrust(Merlin.java:780)
    at org.apache.wss4j.dom.validate.SignatureTrustValidator.verifyTrustInCerts(SignatureTrustValidator.java:108)
    at org.apache.wss4j.dom.validate.SignatureTrustValidator.validate(SignatureTrustValidator.java:64)
    at org.apache.wss4j.dom.processor.SignatureProcessor.handleToken(SignatureProcessor.java:189)
    at org.apache.wss4j.dom.engine.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:344)
    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessageInternal(WSS4JInInterceptor.java:280)
    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:184)
    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:93)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
    at org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:798)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:1670)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponse(HTTPConduit.java:1551)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1348)
    at org.apache.cxf.io.CacheAndWriteOutputStream.postClose(CacheAndWriteOutputStream.java:56)
    at org.apache.cxf.io.CachedOutputStream.close(CachedOutputStream.java:216)
    at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)
    at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:651)
    at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
    at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:514)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:423)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:324)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:277)
    at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:96)
    at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:139)
    at com.sun.proxy.$Proxy74.getPeople(Unknown Source)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
    at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:423)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1079)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:625)
    at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:745)

The first problem I see is CXF expects server certificate to be a keystone file, but I have it as Binary Security Token included in the response. Extracting it into a file is not an option, of course.

How should I configure my InInterceptor so it can verify and decrypt server's response?

UPDATE 1:

root CA certificate is added to JRE/lib/security/cacerts
Intermediate certificate is in the keystore used by the in-interceptor

Here is the server response I'm trying to verify and decrypt:



   
      
         
            
            
               
                  
                     
                        CN=Buypass Class 3 Test4 CA 3,O=Buypass AS-983163327,C=NO
                        1111111111111111111
                     
                  
               
            
            
               VSZMFYsHgVWPhhhBjcmITh2ElsViaRhmyVcLlyC9/iAh/gpIT1mhqocYRr3uDUZUVjNZba8wfRbVYTPAz/Kxix7faZ8+F23ANyhhKmrwxgn2SJdOVjYRYiVZZ/lgufYO4jFDnbkDjHeNxY6FZ/nxdB25OX18v5sWPkXtJQLKm3wQS6gQ8xc7K48lnIZDiKDGs0AyY4wCQ8rd0sI/odFma9h7661rs9Ei0WtzWU8reuhd/YGcaShY7qNnG/EguItnd4H4uEpgH09tCCge3R3vIw7LYK+qa5n97UVKe6ZZcRENZgyDR0PYx7bA+wcmGbHgZUivbc3FhJGwvXjGUu+3Xw==
            
            
               
            
         
         MIIFDzCCA/egAwIBAgILCDNWTvJPbvLPzFQwDQYJKoZIhvcNAQELBQAwSzELMAu390STHWF1hjeDUZ8ep4u3cO0bwKHsdkrp/JIWQ6q8PpIJHcCDrz/tIKn2JLpxbQe9AR6KWDDzgfyRxoCyulOcnXoVH+CeSfieQ3WapR5VymxpPDA+jC6fccPfBDpKrOso4WpFFvwJbyEhxDAgJAXzwx1R3CrTFAfku8cck0h3v5E4
         
            
               
               
               
                  
                     
                  
                  
                  vUNvEQQFUqrUScQTwDrfVl+SEd/T5f/8RegkbE/Hcig=
               
               
                  
                     
                  
                  
                  dv6BjR/TX8x1eYnlLyHCZQCQcdpOQ8o8CDE5mmCEYCw=
               
               
                  
                     
                  
                  
                  +F0GP7N7OlRpKR1yMRHn7F8ZYhCoPqDeDvjNMiQ5bHU=
               
            
            EAclVc0VHMFZtPFGCzwGrvMhp4W4Rmzf2Jke0oZeRcVKNpx88FSCfiCaEx5EaSs8zisbm8dQ7tDSWGnOWgVw1i6S0BXrq5g7Vn2+YZxmKJdJVxwtFAvCl9mXWF7gSgPVX8OYPmSFQ7I9cGaUr8/Sh5o3qClmNez/H4jOSgGXx6zXHqqG3FSkgaXaf0dfY6CgybTff2WG5dfnIdP4tfvllbNfzJa6Lgx8gsGZfG6J1c71mhBSo4ogejW64D0yjWBSGIdsrnAvgZZpXUs3ecR1za+GGUb9UhKLYoaiZZ1XO5fwOZM9TwXkmOwIG8mLbiXMnbsVmC5lyI5ARyZzrDRTmg==
            
               
                  
               
            
         
         
            2016-03-22T10:44:15.693Z
            2016-03-22T10:45:15.693Z
         
         
      
   
   
      
         
         
            
               
            
         
         
            Zl4kpoGYlFRXJ453SZIHxR4VVdzMCfnfTQogResKRu1PO8vHt6Azkc3/q0R0duPdUuttwQDGOUls+jw==

Apache CXF - Configure WSS4JInInterceptor

0 Answers