[CXF-3453] WS-Security signed headers fail when schema validation enabled

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.3.1, 2.3.3
• Fix Version/s: 2.4, 2.3.4
• Component/s: WS-* Components
• Assignee: Daniel Kulp
• Reporter: Ross M. Lodge
• Created: 11/Apr/11 20:08
• Updated: 27/Jun/14 20:17
• Resolved: 18/Apr/11 12:39

Description

After turning on schema validation on a web-service with headers that are signed, but not encrypted, the schema validation fails because the "wsu:Id" is not allowed in the schema.

I've seen two forms of this: a complex type header fails with an error saying that the "wsu:Id" attribute isn't allowed, and a simple type header fails saying that no attributes are allowed (except for type, nill, schemaInstance, etc.).

I think this is a bug, as I don't know anything in the WS-Security specs that would prevent signing of simple type headers or prevent subsequent schema validation.

I've worked around this by using complex types and adding "<xsd:anyAttribute namespace="##any" processContents="skip"/>" to those types, but it doesn't seem like this should be necessary, and doesn't fix the simple type problem.

Issue Links

• is related to: CXF-5831 WSUIDValidationHandler is more strict than default behavior of JAXB