Closed ilicalex closed 7 years ago
sfieten
commented
7 years ago Dear @ilicalex, can you please be more specific of the issue you're experiencing as it is not clear to me? The included XML extract does not seem from a AS4 message generated by Holodeck B2B...
ilicalex
commented
7 years ago Dear Mr. Sander Fieten,
Steps to reproduce the problem:
Sender: ex-pm-push-init.xml, receiver: plinovodi.xml
I used the same certificate, but I used public key part to encrypt attachment and private key part to sign the message on sender side. On receiver side, I used public key to check signature and private key to decrypt the content.
The actual cause of the problem was my intention to set P-Mode correctly on receiver side. I captured partner’s SOAP request with wireshark (plinovodi-SOAP.txt contains security part only) and used my infrastructure (holodeckb2b on both sides) to simulate partner’s request. However I am unable to produce partner’s xenc:EncryptedKey part in wsse:security SOAP structure.
Best regards!
POST /msh HTTP/1.1 Content-Type: multipart/related; boundary="MIMEBoundary_01a7ae05ba6da9f4b06102888a8109f8fee1ea4a324462e4"; type="application/soap+xml"; start="0.31a7ae05ba6da9f4b06102888a8109f8fee1ea4a324462e4@apache.org" User-Agent: HolodeckB2B/2.1 Host: geniljas401:9090 Content-Length: 5195
--MIMEBoundary_01a7ae05ba6da9f4b06102888a8109f8fee1ea4a324462e4 Content-Type: application/soap+xml; charset=UTF-8 Content-Transfer-Encoding: binary Content-ID: 0.31a7ae05ba6da9f4b06102888a8109f8fee1ea4a324462e4@apache.org
<?xml version='1.0' encoding='UTF-8'?>
...........I.I..I-......../..... --MIMEBoundary_01a7ae05ba6da9f4b06102888a8109f8fee1ea4a324462e4-- HTTP/1.1 200 OK Server: HolodeckB2B/2.1 Date: Wed, 14 Jun 2017 08:24:26 GMT Transfer-Encoding: chunked Content-Type: application/soap+xml; charset=UTF-8; action="urn:ReceiveResponse"
9d6
<?xml version='1.0' encoding='UTF-8'?>
sfieten
commented
7 years ago HI @ilicalex, I guess the sender's P-Mode does not specify encryption, so I advice to check the P-Mode again. As this seems more a support question then a technical problem in the software I like to point you to http://holodeck-b2b.org/support for more information on getting support.
ilicalex
commented
7 years ago Hi @sfieten, Part of sender's P-Mode is visible in original post (Used P-Mode part). I used encryption as specified in the documentation. Is there any newer version of P-Mode documentation other than one on the holodeckb2b site. If not, this is a technical problem.
sfieten
commented
7 years ago Hi @ilicalex, the P-Mode documentation regarding the security configuration has not changed. I just looked at the P-Mode extract in the description and notice the encryption configuration is in the wrong place. As described in the P-Mode documentation you need to configure the encryption as a descendant of the Initiator/Responder element corresponding to the partner to which the message are sent. In your case this is the Responder.
ilicalex
commented
7 years ago Thank you @sfieten. Based on your hint I was able to get encrypted attachment in signed message.
Sender (initiator) and responder security part on the sender side was:
`
<Role>ZSO</Role>
<SecurityConfiguration>
<Signing>
<KeystoreAlias password="12345678">privateCert</KeystoreAlias>
<KeyReferenceMethod>KeyIdentifier</KeyReferenceMethod>
</Signing>
</SecurityConfiguration>
</Initiator>
Following ENTSOG AS4 profile, I must encrypt the payload (XML attachment). Based on P-Mode documentation (http://holodeck-b2b.org/documentation/p-mode-schema/): “Element tns:EncryptionConfiguration / tns:KeyTransport This OPTIONAL element contains the settings to add the key transport information to the WS-Security header, i.e. to construct the xenc:EncryptedKey element. NOTE: If this element is included in the P-Mode it SHOULD contain at least one child element.” Instead of full XML structure I end up without the second half of the XML structure (xenc:EncryptedKey and xenc:EncryptedData):
Used P-Mode part: `
`