7 Replies Latest reply on Apr 4, 2013 6:32 PM by Jerson Viveros

    General security error (WSSecurityEngine: No crypto property file supplied to verify signature)

    michajil_tigrow Newbie

      Hi

      I'm trying to add WS Security to existing web service. I'm following https://docs.jboss.org/author/display/JBWS/WS-Security - part with the X509 Certificates.

      The web service seems to be secured, but when I try to call it from soapui (I encrypt and sign the message first) i get

       

      General security error (WSSecurityEngine: No crypto property file supplied to verify signature)

       

      So my guess is that my crypto properties file that I specified jaxws-endpoint-config.xml are not read. I have put them under META-INF, right beside jaxws-endpoint-config.xml file.

      Does anybody have any idea what might be wrong?

        • 1. Re: General security error (WSSecurityEngine: No crypto property file supplied to verify signature)
          Alessio Soldano Master

          You most likely have errors in the path to the jks and props file; keep in mind that a resource lookup using the deployment classloader is executed to get files.

          I've added a testcase on the jbws-cxf testsuite to show what you should do: http://viewvc.jboss.org/cgi-bin/viewvc.cgi/jbossws?view=revision&revision=16981

          • 2. Re: General security error (WSSecurityEngine: No crypto property file supplied to verify signature)
            stephen b Newbie

            You might have forgotten to add @EndpointConfig annotation in your service Implementation class or if you have the annotation the configFile path is in the wrong path.

             

            Example:

             

            @EndpointConfig(configFile = "WEB-INF/jaxws-endpoint-config.xml", configName = "MyService WS-Security Endpoint Settings")

            class MyServiceImpl implements MyService {

             

            }

            • 3. Re: General security error (WSSecurityEngine: No crypto property file supplied to verify signature)
              Jerson Viveros Newbie

              Hello Friends!!

               

              I'm trying to implements the example of sign and encryption with jboss ws and i'm getting the same error.

              The server my jboss-as-7.1.1.Final log this error:

               

              17:53:25,585 WARNING [org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor] (http--127.0.0.1-8080-1) : org.apache.ws.security.WSSecurityException: General security error (WSSecurityEngine: No crypto property file supplied to verify signature)

                   at org.apache.ws.security.message.token.X509Security.getX509Certificate(X509Security.java:100)

                   at org.apache.ws.security.processor.BinarySecurityTokenProcessor.getCertificatesTokenReference(BinarySecurityTokenProcessor.java:128)

                   at org.apache.ws.security.processor.BinarySecurityTokenProcessor.handleToken(BinarySecurityTokenProcessor.java:75)

                   at org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396)

                   at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:276)

                   at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:98)

                   at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)

                   at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)

                   at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:236)

                   at org.jboss.wsf.stack.cxf.RequestHandlerImpl.handleHttpRequest(RequestHandlerImpl.java:95)

                   at org.jboss.wsf.stack.cxf.transport.ServletHelper.callRequestHandler(ServletHelper.java:156)

                   at org.jboss.wsf.stack.cxf.CXFServletExt.invoke(CXFServletExt.java:87)

                   at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:225)

                   at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:145)

                   at javax.servlet.http.HttpServlet.service(HttpServlet.java:754) [jboss-servlet-api_3.0_spec-1.0.0.Final.jar:1.0.0.Final]

                   at org.jboss.wsf.stack.cxf.CXFServletExt.service(CXFServletExt.java:135)

                   at org.jboss.wsf.spi.deployment.WSFServlet.service(WSFServlet.java:140) [jbossws-spi.jar:2.1.1.Final]

                   at javax.servlet.http.HttpServlet.service(HttpServlet.java:847) [jboss-servlet-api_3.0_spec-1.0.0.Final.jar:1.0.0.Final]

                   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:329) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:275) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:161) [jbossweb-7.0.13.Final.jar:]

                   at org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:153) [jboss-as-web-7.1.1.Final.jar:7.1.1.Final]

                   at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:155) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:368) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:877) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:671) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:930) [jbossweb-7.0.13.Final.jar:]

                   at java.lang.Thread.run(Thread.java:722) [rt.jar:1.7.0_15]

               

               

              17:53:25,593 WARNING [org.apache.cxf.phase.PhaseInterceptorChain] (http--127.0.0.1-8080-1) Interceptor for {http://www.jboss.org/jbossws/ws-extensions/wssecuritypolicy}SecurityService has thrown exception, unwinding now: org.apache.cxf.binding.soap.SoapFault: General security error (WSSecurityEngine: No crypto property file supplied to verify signature)

                   at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.createSoapFault(WSS4JInInterceptor.java:800)

                   at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:332)

                   at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:98)

                   at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)

                   at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)

                   at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:236)

                   at org.jboss.wsf.stack.cxf.RequestHandlerImpl.handleHttpRequest(RequestHandlerImpl.java:95)

                   at org.jboss.wsf.stack.cxf.transport.ServletHelper.callRequestHandler(ServletHelper.java:156)

                   at org.jboss.wsf.stack.cxf.CXFServletExt.invoke(CXFServletExt.java:87)

                   at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:225)

                   at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:145)

                   at javax.servlet.http.HttpServlet.service(HttpServlet.java:754) [jboss-servlet-api_3.0_spec-1.0.0.Final.jar:1.0.0.Final]

                   at org.jboss.wsf.stack.cxf.CXFServletExt.service(CXFServletExt.java:135)

                   at org.jboss.wsf.spi.deployment.WSFServlet.service(WSFServlet.java:140) [jbossws-spi.jar:2.1.1.Final]

                   at javax.servlet.http.HttpServlet.service(HttpServlet.java:847) [jboss-servlet-api_3.0_spec-1.0.0.Final.jar:1.0.0.Final]

                   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:329) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:275) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:161) [jbossweb-7.0.13.Final.jar:]

                   at org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:153) [jboss-as-web-7.1.1.Final.jar:7.1.1.Final]

                   at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:155) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:368) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:877) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:671) [jbossweb-7.0.13.Final.jar:]

                   at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:930) [jbossweb-7.0.13.Final.jar:]

                   at java.lang.Thread.run(Thread.java:722) [rt.jar:1.7.0_15]

              Caused by: org.apache.ws.security.WSSecurityException: General security error (WSSecurityEngine: No crypto property file supplied to verify signature)

                   at org.apache.ws.security.message.token.X509Security.getX509Certificate(X509Security.java:100)

                   at org.apache.ws.security.processor.BinarySecurityTokenProcessor.getCertificatesTokenReference(BinarySecurityTokenProcessor.java:128)

                   at org.apache.ws.security.processor.BinarySecurityTokenProcessor.handleToken(BinarySecurityTokenProcessor.java:75)

                   at org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396)

                   at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:276)

                   ... 26 more

               

              I dont know why. The structure of my source including bob.properies and bob.jkx and the @EndConfig anottation is in the same way the user-guide say:

               

              pruebajbossws.png

               

               

              I'm new in jboss.

              I want to know, what do you mean with:

               

              "keep in mind that a resource lookup using the deployment classloader is executed to get files"

               

              How can I configure my deployment classloader?

               

              And on the other hand:

               

              How can I use the testcase on the jbws-cxf testsuite?

               

              Thanks in advance for your help!!!

              • 4. Re: General security error (WSSecurityEngine: No crypto property file supplied to verify signature)
                stephen b Newbie

                Can you provide details on the directory structure and files in your war file? It matters where your properties and JKS files are located.

                • 5. Re: General security error (WSSecurityEngine: No crypto property file supplied to verify signature)
                  Jerson Viveros Newbie

                  img1.png

                   

                  img2.png

                   

                   

                   

                  war

                       -META-INF

                       -WEB-INF

                            -lib

                            -wsdl

                            -classes

                                 -org

                                 -bob.jks

                                 -bob.properties

                            -jaxws-endpoint-config.xml

                            -jboss-web.xml

                            -web.xml

                  • 6. Re: General security error (WSSecurityEngine: No crypto property file supplied to verify signature)
                    Jerson Viveros Newbie

                    I've already found the problem:

                     

                    In the ServiceImpl I was importing this class:

                     

                    import org.jboss.ws.annotation.EndpointConfig;

                     

                    This is the wrong class. Because I have to import:

                     

                    import org.jboss.ws.api.annotation.EndpointConfig;

                     

                    This class is in jbossws-api.jar.

                     

                    The problem was that like I'm developing in Netbeans, and in Netbeans you can't add the jboss 7, you have to add the jboss 6 to your project, and when i used the short cut to bring me the imports in the ServiceImpl, it brang me the wrong class.

                     

                    Now I have other problem. This is the new Exception:

                     

                    12:53:01,514 WARNING [org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor] (http--127.0.0.1-8080-1) : org.apache.ws.security.WSSecurityException: The signature or decryption was invalid

                              at org.apache.ws.security.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:150) [wss4j.jar:1.6.8]

                              at org.apache.ws.security.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:65) [wss4j.jar:1.6.8]

                              at org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396) [wss4j.jar:1.6.8]

                              at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:276)

                              at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:98)

                              at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)

                              at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)

                              at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:236)

                              at org.jboss.wsf.stack.cxf.RequestHandlerImpl.handleHttpRequest(RequestHandlerImpl.java:95)

                              at org.jboss.wsf.stack.cxf.transport.ServletHelper.callRequestHandler(ServletHelper.java:156)

                              at org.jboss.wsf.stack.cxf.CXFServletExt.invoke(CXFServletExt.java:87)

                              at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:225)

                              at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:145)

                              at javax.servlet.http.HttpServlet.service(HttpServlet.java:754) [jboss-servlet-api_3.0_spec-1.0.0.Final.jar:1.0.0.Final]

                              at org.jboss.wsf.stack.cxf.CXFServletExt.service(CXFServletExt.java:135)

                              at org.jboss.wsf.spi.deployment.WSFServlet.service(WSFServlet.java:140) [jbossws-spi.jar:2.1.1.Final]

                              at javax.servlet.http.HttpServlet.service(HttpServlet.java:847) [jboss-servlet-api_3.0_spec-1.0.0.Final.jar:1.0.0.Final]

                              at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:329) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:275) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:161) [jbossweb-7.0.13.Final.jar:]

                              at org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:153) [jboss-as-web-7.1.1.Final.jar:7.1.1.Final]

                              at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:155) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:368) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:877) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:671) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:930) [jbossweb-7.0.13.Final.jar:]

                              at java.lang.Thread.run(Thread.java:722) [rt.jar:1.7.0_15]

                    Caused by: java.lang.ClassCastException: org.apache.ws.security.WSPasswordCallback cannot be cast to org.apache.ws.security.WSPasswordCallback

                              at org.jboss.jbossws.ws_extensions.wssecuritypolicy.KeystorePasswordCallback.handle(KeystorePasswordCallback.java:27) [classes:]

                              at org.apache.ws.security.components.crypto.Merlin.getPassword(Merlin.java:1380) [wss4j.jar:1.6.8]

                              at org.apache.ws.security.components.crypto.Merlin.getPrivateKey(Merlin.java:653) [wss4j.jar:1.6.8]

                              at org.apache.ws.security.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:129) [wss4j.jar:1.6.8]

                              ... 29 more

                     

                     

                    12:53:01,522 WARNING [org.apache.cxf.phase.PhaseInterceptorChain] (http--127.0.0.1-8080-1) Interceptor for {http://www.jboss.org/jbossws/ws-extensions/wssecuritypolicy}SecurityService has thrown exception, unwinding now: org.apache.cxf.binding.soap.SoapFault: The signature or decryption was invalid

                              at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.createSoapFault(WSS4JInInterceptor.java:798)

                              at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:332)

                              at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:98)

                              at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)

                              at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)

                              at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:236)

                              at org.jboss.wsf.stack.cxf.RequestHandlerImpl.handleHttpRequest(RequestHandlerImpl.java:95)

                              at org.jboss.wsf.stack.cxf.transport.ServletHelper.callRequestHandler(ServletHelper.java:156)

                              at org.jboss.wsf.stack.cxf.CXFServletExt.invoke(CXFServletExt.java:87)

                              at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:225)

                              at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:145)

                              at javax.servlet.http.HttpServlet.service(HttpServlet.java:754) [jboss-servlet-api_3.0_spec-1.0.0.Final.jar:1.0.0.Final]

                              at org.jboss.wsf.stack.cxf.CXFServletExt.service(CXFServletExt.java:135)

                              at org.jboss.wsf.spi.deployment.WSFServlet.service(WSFServlet.java:140) [jbossws-spi.jar:2.1.1.Final]

                              at javax.servlet.http.HttpServlet.service(HttpServlet.java:847) [jboss-servlet-api_3.0_spec-1.0.0.Final.jar:1.0.0.Final]

                              at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:329) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:275) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:161) [jbossweb-7.0.13.Final.jar:]

                              at org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:153) [jboss-as-web-7.1.1.Final.jar:7.1.1.Final]

                              at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:155) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:368) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:877) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:671) [jbossweb-7.0.13.Final.jar:]

                              at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:930) [jbossweb-7.0.13.Final.jar:]

                              at java.lang.Thread.run(Thread.java:722) [rt.jar:1.7.0_15]

                    Caused by: org.apache.ws.security.WSSecurityException: The signature or decryption was invalid

                              at org.apache.ws.security.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:150) [wss4j.jar:1.6.8]

                              at org.apache.ws.security.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:65) [wss4j.jar:1.6.8]

                              at org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396) [wss4j.jar:1.6.8]

                              at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:276)

                              ... 26 more

                    Caused by: java.lang.ClassCastException: org.apache.ws.security.WSPasswordCallback cannot be cast to org.apache.ws.security.WSPasswordCallback

                              at org.jboss.jbossws.ws_extensions.wssecuritypolicy.KeystorePasswordCallback.handle(KeystorePasswordCallback.java:27) [classes:]

                              at org.apache.ws.security.components.crypto.Merlin.getPassword(Merlin.java:1380) [wss4j.jar:1.6.8]

                              at org.apache.ws.security.components.crypto.Merlin.getPrivateKey(Merlin.java:653) [wss4j.jar:1.6.8]

                              at org.apache.ws.security.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:129) [wss4j.jar:1.6.8]

                              ... 29 more

                     

                     

                     

                     

                    Any Ideas, to solve this!!!

                    Thanks in advance!

                    and please excuse me for my english, is not very well!!

                    • 7. Re: General security error (WSSecurityEngine: No crypto property file supplied to verify signature)
                      Jerson Viveros Newbie

                      OK. I solved it!!

                       

                      After i solved the exception:

                      WSSecurityEngine: No crypto property file supplied to verify signature

                       

                      I got this Exception:

                       

                      12:26:34,651 ERROR [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/ExampJbossWSSecurity1].[TestService]] (http--127.0.0.1-8080-1) Servlet.service() para servlet TestService lanzó excepción: java.lang.ClassNotFoundException: org.apache.ws.security.WSPasswordCallback from [Module "deployment.ExampJbossWSSecurity1.war:main" from Service Module Loader]

                                at org.jboss.modules.ModuleClassLoader.findClass(ModuleClassLoader.java:190)

                                at org.jboss.modules.ConcurrentClassLoader.performLoadClassUnchecked(ConcurrentClassLoader.java:468)

                                at org.jboss.modules.ConcurrentClassLoader.performLoadClassChecked(ConcurrentClassLoader.java:456)

                                at org.jboss.modules.ConcurrentClassLoader.performLoadClass(ConcurrentClassLoader.java:398)

                                at org.jboss.modules.ConcurrentClassLoader.loadClass(ConcurrentClassLoader.java:120)

                                at org.jboss.jbossws.ws_extensions.wssecuritypolicy.KeystorePasswordCallback.handle(KeystorePasswordCallback.java:27) [classes:]

                                at org.apache.ws.security.components.crypto.Merlin.getPassword(Merlin.java:1380)

                                at org.apache.ws.security.components.crypto.Merlin.getPrivateKey(Merlin.java:653)

                                at org.apache.ws.security.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:129)

                                at org.apache.ws.security.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:65)

                                at org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396)

                                at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:276)

                      ......

                       

                      I decided to add the library wss4j.jar  to my war, but it was a mistake... because I got the new difficult exception:

                       

                      12:53:01,514 WARNING [org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor] (http--127.0.0.1-8080-1) : org.apache.ws.security.WSSecurityException: The signature or decryption was invalid

                                at org.apache.ws.security.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:150) [wss4j.jar:1.6.8]

                                at org.apache.ws.security.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:65) [wss4j.jar:1.6.8]

                                at org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:396) [wss4j.jar:1.6.8]

                                at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:276)

                                at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:98)

                                at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)

                                at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)

                                at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:236)

                                at org.jboss.wsf.stack.cxf.RequestHandlerImpl.handleHttpRequest(RequestHandlerImpl.java:95)

                                at org.jboss.wsf.stack.cxf.transport.ServletHelper.callRequestHandler(ServletHelper.java:156)

                                at org.jboss.wsf.stack.cxf.CXFServletExt.invoke(CXFServletExt.java:87)

                                at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:225)

                                at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:145)

                                at javax.servlet.http.HttpServlet.service(HttpServlet.java:754) [jboss-servlet-api_3.0_spec-1.0.0.Final.jar:1.0.0.Final]

                                at org.jboss.wsf.stack.cxf.CXFServletExt.service(CXFServletExt.java:135)

                                at org.jboss.wsf.spi.deployment.WSFServlet.service(WSFServlet.java:140) [jbossws-spi.jar:2.1.1.Final]

                                at javax.servlet.http.HttpServlet.service(HttpServlet.java:847) [jboss-servlet-api_3.0_spec-1.0.0.Final.jar:1.0.0.Final]

                                at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:329) [jbossweb-7.0.13.Final.jar:]

                                at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:248) [jbossweb-7.0.13.Final.jar:]

                                at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:275) [jbossweb-7.0.13.Final.jar:]

                                at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:161) [jbossweb-7.0.13.Final.jar:]

                                at org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:153) [jboss-as-web-7.1.1.Final.jar:7.1.1.Final]

                                at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:155) [jbossweb-7.0.13.Final.jar:]

                                at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [jbossweb-7.0.13.Final.jar:]

                                at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [jbossweb-7.0.13.Final.jar:]

                                at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:368) [jbossweb-7.0.13.Final.jar:]

                                at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:877) [jbossweb-7.0.13.Final.jar:]

                                at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:671) [jbossweb-7.0.13.Final.jar:]

                                at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:930) [jbossweb-7.0.13.Final.jar:]

                                at java.lang.Thread.run(Thread.java:722) [rt.jar:1.7.0_15]

                      Caused by: java.lang.ClassCastException: org.apache.ws.security.WSPasswordCallback cannot be cast to org.apache.ws.security.WSPasswordCallback

                                at org.jboss.jbossws.ws_extensions.wssecuritypolicy.KeystorePasswordCallback.handle(KeystorePasswordCallback.java:27) [classes:]

                                at org.apache.ws.security.components.crypto.Merlin.getPassword(Merlin.java:1380) [wss4j.jar:1.6.8]

                                at org.apache.ws.security.components.crypto.Merlin.getPrivateKey(Merlin.java:653) [wss4j.jar:1.6.8]

                                at org.apache.ws.security.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:129) [wss4j.jar:1.6.8]

                                ... 29 more

                       

                      So you can see, it was mistake after mistake....

                      well, The solution to the exception:

                       

                      12:26:34,651 ERROR [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/ExampJbossWSSecurity1].[TestService]] (http--127.0.0.1-8080-1) Servlet.service() para servlet TestService lanzó excepción: java.lang.ClassNotFoundException: org.apache.ws.security.WSPasswordCallback from [Module "deployment.ExampJbossWSSecurity1.war:main" from Service Module Loader]

                        at org.jboss.modules.ModuleClassLoader.findClass(ModuleClassLoader.java:190)

                        at org.jboss.modules.ConcurrentClassLoader.performLoadClassUnchecked(ConcurrentClassLoader.java:468)

                       

                      WAS to add in  my METAINF.MANIFEST.MF:

                       

                      Dependencies: org.apache.ws.security

                       

                       

                      That was all!!!

                       

                      Finally I got to encrypt and sign my message with jboss 7.1.1 and jboss ws:

                       

                       

                      Well something like this I read from my snifer, tcpdump.

                       

                      <soap:Envelope xmlns:soap="http://schemas xmlsoap org/soap/envelope/"><soap:Header><wsse:Security xmlns:wsse="http://docs oasis-open org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1 0 xsd" xmlns:wsu="http://docs oasis-open org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1 0 xsd" soap:mustUnderstand="1"><wsse:BinarySecurityToken EncodingType="http://docs oasis-open org/wss/2004/01/oasis-200401-wss-soap-message-security-1 0#Base64Binary" ValueType="http://docs oasis-open org/wss/2004/01/oasis-200401-wss-x509-token-profile-1 0#X509v3" wsu:Id="X509-4321472A4B2EBAC44913651138677292">MIIB/jCCAWcCBEaul+owDQYJKoZIhvcNAQEEBQAwRjETMBEGA1UEChMKYXBhY2hlLm9yZzEfMB0GA1UECxMWTk9UIEZPUiBQUk9EVUNUSU9OIFVTRTEOMAwGA1UEAxMFYWxpY2UwHhcNMDcwNzMxMDIwMTE0WhcNMzQxMjE2MDIwMTE0WjBGMRMwEQYDVQQKEwphcGFjaGUub3JnMR8wHQYDVQQLExZOT1QgRk9SIFBST0RVQ1RJT04gVVNFMQ4wDAYDVQQDEwVhbGljZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA+0WE5RPyWU8bMLeytlFN0LSs32S6rmZbu9Qw2ohFoR0X6aQKk1LVbMPiRwsAFEDwIuf+z6sRTe9HGx0txXrBOaYswCddIZf4VXnMRmXrCWBggb1HB0pwjYHLeW3+QIQgFEU5tJPy8jQCI+x4UcgGImqvRyZQDVDP6iY/fJhZpkCAwEAATANBgkqhkiG9w0BAQQFAAOBgQBnOwsgA8i0QY8g5pSUk+i2IuBMNe1AQW4JwCPSJfl3dssHh/EjFb8JGVW6yo0sEQq4Ala/CHjUvHQGJnNJr8VPHzqRywug3VpmJp/9txSNLJsjIiOWbr2H3Mxl85CjH1sJnFAjohXZ0Mq5VRKR0sEbhALPyvTA2lAerEsVHe3jsg==</wsse:BinarySecurityToken><wsu:Timestamp wsu:Id="TS-1"><wsu:Created>2013-04-04T22:17:47 665Z</wsu:Created><wsu:Expires>2013-04-04T22:22:47 665Z</wsu:Expires></wsu:Timestamp><xenc:EncryptedKey xmlns:xenc="http://www w3 org/2001/04/xmlenc#" Id="EK-4321472A4B2EBAC44913651138676961"><xenc:EncryptionMethod Algorithm="http://www w3 org/2001/04/xmlenc#rsa-1_5"></xenc:EncryptionMethod><ds:KeyInfo xmlns:ds="http://www w3 org/2000/09/xmldsig#"><wsse:SecurityTokenReference><ds:X509Data><ds:X509IssuerSerial><ds:X509IssuerName>CN=bob,OU=NOT FOR PRODUCTION USE,O=apache org</ds:X509IssuerName><ds:X509SerialNumber>1185847255<ds:X509SerialNumber></ds:X509IssuerSerial></ds:X509Data></wsse:SecurityTokenReference></ds:KeyInfo><xenc:CipherData><xenc:CipherValue>pQ74vV9JM3gagc7mJN7WfIUDwVIC3Z9yl4vQDHfwk6J7pGgdmFQqEgLCSX52/+79CID1uhKHnJ4sdmllWaPoU8UK9dUyxzch1ub9rUNb9aAOrbdZl3j2Jh10WlIDMiSo9qZxRI3tessXJPOAzvD7KCULKRUME6SFqZRkOV1Qto=</xenc:CipherValue></xenc:CipherData></xenc:EncryptedKey><ds:Signature xmlns:ds="http://www w3 org/2000/09/xmldsig#" Id="SIG-3"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www w3 org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www w3 org/2001/10/xml-exc-c14n#" PrefixList="soap"></ec:InclusiveNamespaces></ds:CanonicalizationMethod><ds:SignatureMethod Algorithm="http:/www w3 org/2000/09/xmldsig#rsa-sha1"></ds:SignatureMethod><ds:Reference URI="#Id-31829426"><ds:Transforms><ds:Transform Algorithm="http://www w3 org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www w3 org/2001/10/xml-exc-c14n#" PrefixList=""></ec:InclusiveNamespaces></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www w3 org/2000/09/xmldsig#sha1"></ds:DigestMethod><ds:DigestValue>rEQZUVIEUWwHxJLhFUsTaQECG9U=</ds:DigestValue></ds:Reference><ds:Reference URI="#TS-1"><ds:Transforms><ds:Transform Algorithm="http://www w3 org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www w3 org/2001/10/xml-excc14n#" PrefixList="wsse soap"></ec:InclusiveNamespaces></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www w3 org/2000/09/xmldsig#sha1"></ds:DigestMethod><ds:DigestValue>9mFvfvJPhqhrGHcxGh4MBVsxZCA=</ds:DigestValue></ds:Reference><ds:Reference URI="#Id-31829426"><ds:Transforms><ds:Transform Algorithm="http://www w3 org/2001/10xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www w3 org/2001/10/xml-exc-c14n#" PrefixList=""></ec:InclusiveNamespaces></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www w3 org/2000/09/xmldsig#sha1"></ds:DigestMethod><ds:DigestValue>rEQZUVIEUWwHxJLhFUsTaQECG9U=</ds:DigestValue></ds:Reference><ds:Reference URI="#X509-4321472A4B2EBAC44913651138677292"><ds:Transforms><ds:Transform Algorithm="http://www w3 org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www w3 org/2001/10/xml-exc-c14n#" PrefixList="soap"></ec:InclusiveNamespaces></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www w3 org/2000/09/xmldsig#sha1"></ds:DigestMethod><ds:DigestValue>Rnp5O00bf3kbT0W6yNjehv+V4qQ=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>eWGK1YhPRj36afkaDk/+2gWhTq/JBOYYvidelbp5fzCE0/5meVZXiR/0pu2T1C6cNZKaQVtbw79tnybtsW9Icdh/JaPeycxFq7dCGicjDuwJZl5QOUiawF5m4ym4BR1643HYbGwPaXT711fZiKLad+vKiGG6dk0TQpqcQmiK64k=</ds:SignatureValue><ds:KeyInfo Id="KI-4321472A4B2EBAC44913651138677323"><wsse:SecurityTokenReference wsu:Id="STR-4321472A4B2EBAC44913651138677324"><wsse:Reference URI="#X509-4321472A4B2EBAC44913651138677292" ValueType="http:/docs oasis-open org/wss/2004/01/oasis-200401-wss-x509-token-profile-1 0#X509v3"></wsse:Reference></wsse:SecurityTokenReference></ds:KeyInfo></ds:Signature><xenc:ReferenceList xmlns:xenc="http://www w3 org/2001/04/xmlenc#"><xenc:DataReference URI="#ED-2"></xenc:DataReference></xenc:ReferenceList></wsse:Security></soap:Header><soap:Body xmlns:wsu="http://docs oasis-open org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1 0 xsd" wsu:Id="Id-31829426"><xenc:EncryptedData xmlns:xenc="http://www w3 org/2001/04/xmlenc#" Id="ED-2" Type="http://www w3 org/2001/04/xmlenc#Content"><xenc:EncryptionMethod Algorithm="http://www w3 org/2001/04/xmlenc#tripledes-cbc"></xenc:EncryptionMethod><ds:KeyInfo xmlns:ds="http://www w3 org/2000/09/xmldsig#"><wsse:SecurityTokenReference xmlns:wsse="http://docs oasis-open org/wss/2004/01/oasis-200401-wss-wssecuritysecext-1 0 xsd" xmlns:wsse11="http://docs oasis-open org/wss/oasis-wss-wssecurity-secext-1 1 xsd" wsse11:TokenType="http://docs oasis-open org/wss/oasis-wss-soap-message-security-1 1#EncryptedKey"><wsse:Reference URI="#EK-4321472A4B2EBAC44913651138676961"></wsse:Reference></wsse:SecurityTokenReference></ds:KeyInfo><xenc:CipherData><xenc:CipherValue>MHxPvlK5sxSczMZi3DGYCL+kt+VYXMNeGf9bXP1Eb0ky/ImS4ZJkM2DAhUTuusSxA9yVu54F7J90hcAtdEv19MUPyvEfrG0VbLg0wg7Jn9AAhZzub/7YxN/HnYPrnTSQsnXMEHSCmWDhiP/49Sb8EA==</xenc:CipherValue></xenc:CipherData></xenc:EncryptedData></soap:Body></soap:Envelope>

                       

                       

                      -------------------------------------------------------------------------------------

                       

                       

                       

                       

                      <soap:Envelope xmlns:soap="http://schemas xmlsoap org/soap/envelope/"><soap:Header><wsse:Security xmlns:wsse="http://docs oasis-open org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1 0 xsd" xmlns:wsu="http://docs oasis-open org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1 0 xsd" soap:mustUnderstand="1"><wsse:BinarySecurityToken EncodingType="http://docs oasis-open org/wss/2004/01/oasis-200401-wss-soap-message-security-1 0#Base64Binary" ValueType="http://docs oasis-open org/wss/2004/01/oasis-200401-wss-x509-token-profile-1 0#X509v3" wsu:Id="9F4F82DCA38BB8A9F513651138678047">MIIB/jCCAWcCBEaul+owDQYJKoZIhvcNAQEEBQAwRjETMBEGA1UEChMKYXBhY2hlLm9yZzEfMB0GA1UECxMWTk9UIEZPUiBQUk9EVUNUSU9OIFVTRTEOMAwGA1UEAxMFYWxpY2UwHhcNMDcwNzMxMDIwMTE0WhcNMzQxMjE2MDIwMTE0WjBGMRMwEQYDVQQKEwphcGFjaGUub3JnMR8wHQYDVQQLExZOT1QgRk9SIFBST0RVQ1RJT04gVVNFMQ4wDAYDVQQDEwVhbGljZTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA+0WE5RPyWU8bMLeytlFN0LSs32S6rmZbu9Qw2ohFoR0X6aQKk1LVbMPiRwsAFEDwIuf+z6sRTe9HGx0txXrBOaYswCddIZf4VXnMRmXrCWBggb1HB0pwjYHLeW3+QIQgFEU5tJPy8jQCI+x4UcgGImqvRyZQDVDP6iY/fJhZpkCAwEAATANBgkqhkiG9w0BAQQFAAOBgQBnOwsgA8i0QY8g5pSUk+i2IuBMNe1AQW4JwCPSJfl3dssHh/EjFb8JGVW6yo0sEQq4Ala/CHjUvHQGJnNJr8VPHzqRywug3VpmJp/9txSNLJsjIiOWbr2H3Mxl85CjH1sJnFAjohXZ0Mq5VRKR0sEbhALPyvTA2lAerEsVHe3jsg==</wsse:BinarySecurityToken><wsu:Timestamp wsu:Id="TS-4"><wsu:Created>2013-04-04T22:17:47 803Z</wsu:Created><wsu:Expires>2013-04-04T22:22:47 803Z</wsu:Expires></wsu:Timestamp><xenc:EncryptedKey xmlns:xenc="http://www w3 org/2001/04/xmlenc#" Id="EK-9F4F82DCA38BB8A9F513651138678046"><xenc:EncryptionMethod Algorithm="http://www w3 org/2001/04xmlenc#rsa-1_5"/><ds:KeyInfo xmlns:ds="http://www w3 org/2000/09/xmldsig#"><wsse:SecurityTokenReference><wsse:Reference URI="#9F4F82DCA38BB8A9F513651138678047" ValueType="http://docs oasis-open org/wss/2004/01/oasis-200401-wss-x509-token-profile-1 0#X509v3"/></wsse:SecurityTokenReference></ds:KeyInfo><xenc:CipherData><xenc:CipherValue>n3qtuD9X6VNORK+V9RPFd4SiSG8+iIw3qFvPTcFC+hBdvekN0fdOmQ80I/Bi/KxHs0rGrWRDhZyj1mKEW8HDOjcQeZ69sDytaG4pcOQpdi5g9H2EVmdg0jlBc9wTpFTbw+SqROb+SS4DLy9g/0TK3QRfi0VNWsWV9rq2JZ5FrFc=</xenc:CipherValue></xenc:CipherData></xenc:EncryptedKey><ds:Signature xmlns:ds="http://www w3 org/2000/09/xmldsig#" Id="SIG-6"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www w3 org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www w3 org/2001/10/xml-exc-c14n#" PrefixList="soap"/></ds:CanonicalizationMethod><ds:SignatureMethod Algorithm="http://www w3 org/2000/09xmldsig#rsa-sha1"/><ds:Reference URI="#Id-6644594"><ds:Transforms><ds:Transform Algorithm="http://www w3 org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www w3 org/2001/10/xml-exc-c14n#" PrefixList=""/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www w3 org/2000/09/xmldsig#sha1"/><ds:DigestValue>8XHe7MGDcqmbsJ8dJq7ZG80ZtE=</ds:DigestValue></ds:Reference><ds:Reference URI="#TS-4"><ds:Transforms><ds:Transform Algorithm="http://www w3 org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www w3 org/2001/10/xml-exc-c14n#" PrefixList="wsse soap"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www w3 org/2000/09xmldsig#sha1"/><ds:DigestValue>ZuKpA7YK+i9vISINjXW38SFicz8=</ds:DigestValue></ds:Reference><ds:Reference URI="#Id-6644594"><ds:Transforms><ds:Transform Algorithm="http://www w3 org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www w3 org/2001/10/xml-exc-c14n#" PrefixList=""/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http:/www w3 org/2000/09/xmldsig#sha1"/><ds:DigestValue>8XHe7MGDcqmbsJ8/dJq7ZG80ZtE=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>fQ+EpJJ/4djudgB6tjJEZgLuQW6pmGqqZ0+0FjPMji2G2rKWeFkPasAp7qv0eqQEHFtEFB6XS1WQl441nvBNkyVssOGH5UVFe1U7lOwUC3TmBBvo33W11kEp796I8L464YVkaQcBK6vFsxyJ7t6EOayIWQZUMPOFrWWH2R7+GBw=</ds:SignatureValue><ds:KeyInfo Id="KI-9F4F82DCA38BB8A9F513651138678069"><wsse:SecurityTokenReference wsu:Id="STR-9F4F82DCA38BB8A9F5136511386780610"><ds:X509Data><ds:X509IssuerSerial><ds:X509IssuerName>CN=bob,OU=NOT FOR PRODUCTION USE,O=apache org<ds:X509IssuerName><ds:X509SerialNumber>1185847255<ds:X509SerialNumber><ds:X509IssuerSerial></ds:X509Data></wsse:SecurityTokenReference></ds:KeyInfo></ds:Signature><xenc:ReferenceList xmlns:xenc="http://www w3 org/2001/04/xmlenc#"><xenc:DataReference URI="#ED-5"/></xenc:ReferenceList></wsse:Security></soap:Header><soap:Body xmlns:wsu="http://docs oasis-open org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1 0 xsd" wsu:Id="Id-6644594"><xenc:EncryptedData xmlns:xenc="http://www w3 org/2001/04/xmlenc#" Id="ED-5" Type="http://www w3 org/2001/04/xmlenc#Content"><xenc:EncryptionMethod Algorithm="http://www w3 org/2001/04/xmlenc#tripledes-cbc"/><ds:KeyInfo xmlns:ds="http://www w3 org/2000/09/xmldsig#"><wsse:SecurityTokenReference xmlns:wsse="http://docs oasis-open org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1 0 xsd" xmlns:wsse11="http://docs oasis-open org/wss/oasis-wsswssecurity-secext-1 1 xsd" wsse11:TokenType="http://docs oasis-open org/wss/oasis-wss-soap-message-security-1 1#EncryptedKey"><wsse:Reference URI="#EK-9F4F82DCA38BB8A9F513651138678046"/><wsse:SecurityTokenReference></ds:KeyInfo><xenc:CipherData><xenc:CipherValue>8Ayk5cwVQotvM34rJKhR49aIctaHUYgKFBAaQL+jr+J0VNEbWDisLo0p6R8zstj9GhTvCwbmVi/RrkAl49Hx7h8YCPrKrXF760j2G48LVp5VqpisVWYObfQkmAJ0W8rIysDs062zeQstGeUbrFWv5lpfc3tLKBywo3sagnTPgN5ynb2ptTjivYxxiW8mavvl/ZIYZG0SLiF2FuWiepZ44vNEUE9WnYuB</xenc:CipherValue></xenc:CipherData><xenc:EncryptedData></soap:Body></soap:Envelope>

                       

                       

                      Well I think, I have to learn to configure the keystore, and properties to my soapUI.