javaee / metro-wsit

https://javaee.github.io/metro-wsit/
Other
9 stars 24 forks source link

Trust Interop against MS 3.5 Scenario based Transport Bindingfails with message An error occurred when verifying security for the message #1511

Closed glassfishrobot closed 13 years ago

glassfishrobot commented 13 years ago

Scenario

Interop Scenario 1 jsr109interop-s-m-m Interop Scenario 1 interop-s-s-m Interop Scenario 1 interop-s-m-m

SOAP LOG

trying MS server.... Dec 9, 2010 8:29:54 PM [com.sun.xml.ws.policy.parser.PolicyConfigParser] parse INFO: WSP5018: Loaded WSIT configuration from file: file:/home/test4u/anand/tango-3.5/tango/qe-tests/wstrust/interop/src/scenario1-s-m/etc/client-config/wsit-client.xml. Service URL=https://yinyang.india.sun.com:443/Security_Federation_FederatedService_Indigo/Symmetric.svc/Scenario_1_IssuedTokenOverTransport_UsernameOverTransport STS URL=https://null:nullnull Dec 9, 2010 8:29:56 PM [com.sun.xml.ws.policy.parser.PolicyConfigParser] parse INFO: WSP5018: Loaded WSIT configuration from file: file:/home/test4u/anand/tango-3.5/tango/qe-tests/wstrust/interop/src/scenario1-s-m/etc/client-config/wsit-client.xml. Dec 9, 2010 8:29:56 PM com.sun.xml.ws.security.opt.impl.util.CertificateRetriever setServerCertInTheContext INFO: WSS0824: The certificate found in the server wsdl or by server cert property is valid, so using it --[HTTP request - https://yinyang.india.sun.com/Security_Federation_SecurityTokenService_Indigo/Symmetric.svc/Scenario_1_IssuedTokenOverTransport_UsernameOverTransport]-- Accept: application/soap+xml, multipart/related Content-Type: application/soap+xml; charset=utf-8;action="http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue" User-Agent: Metro/2.1-b19 (trunk-6629; 2010-12-03T15:51:18+0000) JAXWS-RI/2.2.2-promoted-b02 JAXWS/2.2 <?xml version='1.0' encoding='UTF-8'?>https://yinyang.india.sun.com/Security_Federation_SecurityTokenService_Indigo/Symmetric.svc/Scenario_1_IssuedTokenOverTransport_UsernameOverTransporthttp://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue

[http://www.w3.org/2005/08/addressing/anonymous](http://www.w3.org/2005/08/addressing/anonymous)

uuid:7622efb6-57a0-49cf-a624-38bc07cf02642010-12-09T14:59:56Z</wsu:Created>2010-12-09T15:04:56Z</wsu:Expires></wsu:Timestamp>Alice</wsse:Username>abcd!1234</wsse:Password></wsse:UsernameToken></wsse:Security></S:Header>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</wst:RequestType>https://yinyang.india.sun.com:443/Security_Federation_FederatedService_Indigo/Symmetric.svc/Scenario_1_IssuedTokenOverTransport_UsernameOverTransport</wsa:Address></wsa:EndpointReference></wsp:AppliesTo>urn:oasis:names:tc:SAML:1.0:assertion</wst:TokenType>http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey</wst:KeyType>256</wst:KeySize>XeOw1O5F3hfykNrXBINplrhcalIpu3wz3islI9tfpLI=</wst:BinarySecret></wst:Entropy>http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1</wst:ComputedKeyAlgorithm></wst:RequestSecurityToken></S:Body></S:Envelope>-------------------- keyStore is : ../../certs/xws-security/etc/client-keystore.jks keyStore type is : JKS keyStore provider is : init keystore init keymanager of type SunX509


found key for : alice chain [0] = [ [ Version: V3 Subject: CN=Alice, OU=OASIS Interop Test Cert, O=OASIS Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5

Key: Sun RSA public key, 1024 bits modulus: 114223138481062383818743472854345446729415521820579721478671411120076686448918620302220709845014730631814478188984612465856840519852245805751892337820823145686311359090114506894126920369485682523288840662511969165284005936035859388250282090838456799125935768645086141305672131191153192376610593502582005436827 public exponent: 65537 Validity: [From: Sat Mar 19 05:30:00 IST 2005, To: Tue Mar 20 05:29:59 IST 2018] Issuer: CN=OASIS Interop Test CA, O=OASIS SerialNumber: [ 33a6047f b155631f ed672117 8150a899]

Certificate Extensions: 5 [1]: ObjectId: 2.5.29.14 Criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: 0A E2 5D 13 50 76 75 41 5D D5 D9 0B 65 2C D0 E6 ..].PvuA]...e,.. 0010: F8 FA 31 88 ..1. ] ]

[2]: ObjectId: 2.5.29.35 Criticality=false AuthorityKeyIdentifier [ KeyIdentifier [ 0000: C0 9D 28 FC C1 EB 35 A1 1D D6 AA AA A0 1C 1A 4D ..(...5........M 0010: C2 49 0F 0F .I.. ]

]

[3]: ObjectId: 2.5.29.31 Criticality=false CRLDistributionPoints [ [ CRLIssuer:[URIName: http://interop.bbtest.net/crl/ca.crl] ]]

[4]: ObjectId: 2.5.29.15 Criticality=true KeyUsage [ DigitalSignature Key_Encipherment Data_Encipherment ]

[5]: ObjectId: 2.5.29.19 Criticality=false BasicConstraints:[ CA:false PathLen: undefined ]

] Algorithm: [SHA1withRSA] Signature: 0000: 05 3A A9 3A 9B D6 FB AC AB 2D 7C 94 94 FD B1 25 .:.:.....-.....% 0010: B1 24 A2 15 C7 23 93 96 C0 A5 A5 78 E6 FD 86 59 .$...#.....x...Y 0020: 21 5A 7B 54 6A 57 DC 14 E2 40 81 4C 87 DF 44 D3 !Z.TjW...@.L..D. 0030: A4 79 5D CF 1D 7E BC AD 8B 3F 38 68 50 52 98 1C .y]......?8hPR.. 0040: 4D 48 C9 0B E8 90 13 76 26 31 4E EB 80 50 BA 40 MH.....v&1N..P.@ 0050: 8A 9D 98 65 74 B4 4F C4 68 5F 91 37 71 42 07 5F ...et.O.h.7qB. 0060: E6 B0 8A FF 08 77 C5 5B 19 08 D4 DF B8 C3 66 94 .....w.[......f. 0070: 03 3A 94 E0 20 F1 07 6E 0D A8 77 58 56 69 10 0D .:.. ..n..wXVi.. 0080: 2C DA 7C 10 68 23 50 4C D3 23 24 2F 2D 6A FD 42 ,...h#PL.#$/-j.B 0090: 06 BE BE 13 91 40 9B 03 D7 3F BA 49 C6 7F 45 C3 .....@...?.I..E. 00A0: D3 97 47 2A 9B 44 0E 2F DB 2E D8 A5 B1 A4 1B 61 ..G*.D./.......a 00B0: 88 F5 4B CE 1F 0E 92 1A F7 F8 15 14 AD 84 C3 0E ..K............. 00C0: DF 96 1B A6 29 06 B0 B8 B1 DE F0 2C 5D 65 A2 E2 ....)......,]e.. 00D0: BC 1F 54 E6 33 40 AD 0E 14 F3 62 F5 13 02 51 D4 ..T.3@....b...Q. 00E0: 87 D3 A9 BD B8 B5 9C 92 20 B1 8E 8B 34 15 03 83 ........ ...4... 00F0: 64 4F 65 E0 04 C6 CB DB 3D 84 D5 70 AF 23 89 4F dOe.....=..p.#.O

]


trustStore is: ../../certs/xws-security/etc/client-truststore.jks trustStore type is : JKS trustStore provider is : init truststore adding as trusted cert: Subject: CN=WssIP, OU=OASIS Interop Test Cert, O=OASIS Issuer: CN=OASIS Interop Test CA, O=OASIS Algorithm: RSA; Serial number: 0x6fa53a6de7386475bde93e4dd80fcd75 Valid from Thu Oct 27 05:30:00 IST 2005 until Sun Oct 28 05:29:59 IST 2018

adding as trusted cert: Subject: CN=OASIS Interop Test CA, O=OASIS Issuer: CN=OASIS Interop Test Root, O=OASIS Algorithm: RSA; Serial number: 0x59a0b145edc835c494f15349e3f1deac Valid from Sat Mar 19 05:30:00 IST 2005 until Wed Mar 20 05:29:59 IST 2019

adding as trusted cert: Subject: CN=Bob, OU=OASIS Interop Test Cert, O=OASIS Issuer: CN=OASIS Interop Test CA, O=OASIS Algorithm: RSA; Serial number: 0x6038eedbfeac9bbec89d87d3abae71f8 Valid from Sat Mar 19 05:30:00 IST 2005 until Tue Mar 20 05:29:59 IST 2018

adding as trusted cert: Subject: CN=OASIS Interop Test Root, O=OASIS Issuer: CN=OASIS Interop Test Root, O=OASIS Algorithm: RSA; Serial number: 0x530867e26ba26a4436ecbca9f1cfb58d Valid from Sat Mar 19 05:30:00 IST 2005 until Fri Mar 20 05:29:59 IST 2020

trigger seeding of SecureRandom done seeding SecureRandom %% No cached client session

glassfishrobot commented 13 years ago

Reported by anand_mishra

glassfishrobot commented 13 years ago

jdg6688 said: Please when you file an issue with an QA test fall, don't just copy and paste the stack trace. Provide the following information at minimal:

1. Is it an regression.

2. When did you start to see the fail.

3. With which builds of Metro and Glassfish you tested it start to fail.

4. Test with the latest Hudson build for Metro before you file the issue

5. Check if you have filed the same issue before.

glassfishrobot commented 13 years ago

anand_mishra said: Issues which i had filed are Metro 2.1 regressions.

As we have started analyzing the results recently, build in which i have see these issue first is b18 of metro, before that the test execution for test run was not stable as we have shifted to Hundson from Test4u for Metro2.1.

These issues i have filed on the basis of b19 of metro.

Please let me know if you need more info issues or any other help

glassfishrobot commented 13 years ago

jdg6688 said: The stack trace is for which case.

You listed 3 test cases failed. Can you attached the stack trace fro each of the 3 cases and indicate clearly which is for which.

glassfishrobot commented 13 years ago

jdg6688 said: The issue is fixed and verified with .Net 3.5 endpoint.

For the .Net 4.0 endpoint, one need to configure for the audience URI:

System.IdentityModel.Tokens.SecurityTokenException: The AudienceUri in the SamlAssertion cannot be validated. This can be resolved by making configuration changes to the 'issuedTokenAuthentication' element in the 'serviceBehaviors' section. You can add valid uris using the 'allowedAudienceUris' element. This check can also be changed using the 'audienceUriMode' attribute. At runtime setting the IssuedTokenAuthentication object's properties: AllowedAudienceUris and AudienceUriMode will have similar results.

glassfishrobot commented 13 years ago

Was assigned to anand_mishra

glassfishrobot commented 7 years ago

This issue was imported from java.net JIRA WSIT-1511

glassfishrobot commented 13 years ago

Marked as fixed on Monday, December 20th 2010, 1:18:47 am