3 Replies Latest reply on Dec 23, 2013 9:43 AM by imjorge

In Interceptors not running for a CXF web service on JBoss 7.1.1

imjorge Dec 19, 2013 11:31 AM

Hi,

tl;dr; in interceptors are not run and, as such, ws-security is not enforced. this happens in jboss 7.1.1.

I have a project, part of a large solution, that consists of a war with cxf web services. The project is built with cxf and spring and includes, in the beans configuration file, references to interceptors to process the ws-security headers. The problem is that those headers are not being processed and, as such, I get a SOAP response stating:

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">

<soap:Body>

<soap:Fault>

<soap:Code>

<soap:Value>soap:MustUnderstand</soap:Value>

</soap:Code>

<soap:Reason>

<soap:Text xml:lang="en">MustUnderstand headers: [{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Security] are not understood.</soap:Text>

</soap:Reason>

</soap:Fault>

</soap:Body>

</soap:Envelope>

Which indicates, IMO, that the interceptors were not run. I have reduced this project to a simple hello world sample (source and war in attach).

Here is the WEB-INF\web.xml:

<?xml version="1.0" encoding="ISO-8859-1"?>

<!DOCTYPE web-app

PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"

"http://java.sun.com/dtd/web-app_2_3.dtd">

<web-app>

<context-param>

<param-name>contextConfigLocation</param-name>

<param-value>/WEB-INF/classes/applicationContext.xml</param-value>

</context-param>

<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>

</listener>

<servlet-name>CXFServlet</servlet-name>

<servlet-class>org.apache.cxf.transport.servlet.CXFServlet</servlet-class>

</servlet>

<servlet-mapping>

<servlet-name>CXFServlet</servlet-name>

<url-pattern>/*</url-pattern>

</servlet-mapping>

</web-app>

The WEB-INF\jboss-deployment-structure.xml:

<?xml version="1.0" encoding="utf-8"?>

<jboss-deployment-structure xmlns="urn:jboss:deployment-structure:1.1">

</imports>

</exports>

</module>

</imports>

</exports>

</module>

</imports>

</exports>

</module>

</dependencies>

</deployment>

</jboss-deployment-structure>

I can call the web service, given that no ws-security soap headers are present. This SOAP envelope results in a valid SOAP response:

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:web="http://webservices.hello.test.jorge.com/">

<soap:Body>

<web:sayHello>

</web:sayHello>

</soap:Body>

</soap:Envelope>

But not this:

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:web="http://webservices.hello.test.jorge.com/">

<soap:Header>

<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soap:mustUnderstand="1">

<wsse:UsernameToken xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-1234567890">

<wsse:Username xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">11</wsse:Username>

<wsse:Password xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">p</wsse:Password>

</wsse:UsernameToken>

</wsse:Security>

</soap:Header>

<soap:Body>

<web:sayHello>

</web:sayHello>

</soap:Body>

</soap:Envelope>

The web service is hardcoded (in this sample) to allow username 11 with password p.

My next step would be debugging the CXF stack, since I have not found any difference between this sample and the online documentation.

The stack is composed by:

jboss 7.1.1
jbossws-cxf-4.1.1 (the most recent version of jbossws-cxf that is compatible with jboss 7.1.1, according to JBossWS - Supported Target Containers)
cxf (modules) 2.6.4
spring 3.0.7.RELEASE
asm 3.3.1

Ideas on what may be wrong?

helloworldws-1.0.0-SNAPSHOT.war 810.1 KB
helloworldws.zip 8.2 KB

1. Re: In Interceptors not running for a CXF web service on JBoss 7.1.1

imjorge Dec 23, 2013 7:13 AM (in response to imjorge)
Hi, after digging into jbossws-cxf source code, jboss source code; debugging like crazy; hacking in general; i got to understand what needs to be done for this to work. i am on an hurry to enjoy the weekend so i will come back with a full description in the meantime. just giving the word out so no one spends more time than i did with this. thanks.

Basically these are the steps to make this work:
move the spring application context file (in the example applicationContext.xml) into WEB-INF\jbossws-cxf.xml;
the jbossws-cxf.xml must not contain relative <import> to other files because it is loaded from an InputStream inside cxf and it causes an exception;
CXFServlet does not need to be defined in web.xml;
<listener> org.springframework.web.context.ContextLoaderListener defined in web.xml is not required -- only if you are doing something with Spring context elsewhere;
do not include cxf <import> in jbossws-cxf.xml (like <import resource="classpath:META-INF/cxf/cxf.xml" />), if you do you will get exceptions complaining about endpoints not being defined in jbossws-cxf.xml;
do not include <cxf:bus> in jbossws-cxf.xml, if you do you will get exceptions complaining about endpoints not being defined in jbossws-cxf.xml;
a previous workaround (around an NPE in the web services implementation) is no longer required -- you can safely remove extends SpringBeanAutowiringSupport, @AutoWired and @PostConstruct from the webservices implementation
wss4j 1.6 has changed the logic for password callback processing, instead of validating the password (provided by the calling code) it must provide as result the password for comparison

Here is the revised WEB-INF\jbossws-cxf.xml that works:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cxf="http://cxf.apache.org/core"
       xmlns:jaxws="http://cxf.apache.org/jaxws" xmlns:soap="http://cxf.apache.org/bindings/soap"
       xsi:schemaLocation="http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd
                           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
                           http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd
                           http://cxf.apache.org/bindings/soap http://cxf.apache.org/schemas/configuration/soap.xsd">

<bean id="helloWorldImpl" class="com.jorge.test.hello.webservices.HelloWorldImpl">
</bean>

<jaxws:endpoint id="hello"
                  implementorClass="com.jorge.test.hello.webservices.HelloWorldImpl"
                  implementor="#helloWorldImpl"
                  address="/hello">

    <jaxws:binding>
      <soap:soapBinding version="1.2" />
    </jaxws:binding>

    <jaxws:inInterceptors>
      <ref bean="busInInterceptor" />
      <bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor" />
      <ref bean="wss4jInConfiguration" />
    </jaxws:inInterceptors>

    <jaxws:properties>
      <entry key="schema-validation-enabled" value="true" />
      <entry key="mtom-enabled" value="true" />
    </jaxws:properties>
</jaxws:endpoint>

<bean id="wss4jInConfiguration"
        class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
    <property name="properties">
      <map>
        <entry key="action" value="UsernameToken" />
        <entry key="passwordType" value="PasswordText" />
        <entry key="passwordCallbackRef">
        <ref bean="serverPasswordCallback" />
        </entry>
      </map>
    </property>
</bean>

<bean id="serverPasswordCallback" class="com.jorge.test.hello.security.ServerPasswordCallback">
</bean>
</beans>

A working (revised) example is in attach.

Example SOAP request:

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:web="http://webservices.hello.test.jorge.com/">
   <soap:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soap:mustUnderstand="1">
<wsse:UsernameToken xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-1234567890">
<wsse:Username xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">11</wsse:Username>
<wsse:Password xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">p</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
   </soap:Header>
   <soap:Body>
      <web:sayHello>
         <user>test</user>
      </web:sayHello>
   </soap:Body>
</soap:Envelope>

Example SOAP response:

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
   <soap:Body>
      <ns2:sayHelloResponse xmlns:ns2="http://webservices.hello.test.jorge.com/">
         <return>hello world test</return>
      </ns2:sayHelloResponse>
   </soap:Body>
</soap:Envelope>

If this has helped you in anyway, I would love to hear from you.

helloworldws-1.0.0-SNAPSHOT.war 809.5 KB

helloworldws-working.zip 7.8 KB
Actions
2. Re: In Interceptors not running for a CXF web service on JBoss 7.1.1

asoldano Dec 23, 2013 8:55 AM (in response to imjorge)

Jorge, thanks a lot for having contributed your solution back to the community. I appreciate this.
The high level explanation of your issue (which I would have commented here anyway) is that you were not deploying an application configured the correct way for running with JBossWS; so you were referring the CXFServlet in web.xml, etc.
I'm probably going to write some doc (or perhaps start with a FAQ) on migrating existing CXF app from a servlet container to JBoss AS / WFLY with JBossWS.
Thanks!
Actions
3. Re: In Interceptors not running for a CXF web service on JBoss 7.1.1

imjorge Dec 23, 2013 9:43 AM (in response to asoldano)

Yap. This was in fact a migration issue. What got me wondering was the fact that, apparently, everything was working but not the interceptors. Now, looking back, I probably guess that JBoss was introspecting the classes and the jax-ws annotations and the stuff on the OLD configuration beans was simply put into a in-memory only bus + endpoints. My guess, tough. Furthermore, I hope you get to write those FAQ/tutorial/other because I have not found so much information on the correct jboss way of developing web services (with CXF I mean) on JBoss 7.
Actions

Go to original post