[CXF-5405] WS-RM with anonymous endpoint throwing security policy validation exception for SequenceAck

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.7
• Fix Version/s: 2.6.12, 2.7.9, 3.0.0-milestone2
• Component/s: WS-* Components
• Estimated Complexity: Unknown
• Assignee: Akitoshi Yoshida
• Reporter: Akitoshi Yoshida
• Created: 20/Nov/13 08:35
• Updated: 11/Jul/14 12:50
• Resolved: 20/Jan/14 15:33

Description

When WS-RM with an anonoymous endpoint is used in conjuction with a policy based WS-Security configuration, the sequence acknoledgement response to the client is rejected by the policy validator.

{http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}

X509Token: The received token does not match the token inclusion requirement
org.apache.cxf.ws.policy.PolicyException: These policy alternatives can not be satisfied:

{http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}

X509Token: The received token does not match the token inclusion requirement
at org.apache.cxf.ws.policy.AssertionInfoMap.checkEffectivePolicy(AssertionInfoMap.java:179)
at org.apache.cxf.ws.policy.PolicyVerificationInInterceptor.handle(PolicyVerificationInInterceptor.java:101)
at org.apache.cxf.ws.policy.AbstractPolicyInterceptor.handleMessage(AbstractPolicyInterceptor.java:44)
at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:272)
at org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:835)
at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:1606)

The cause of this issue is in the RM processing to reset the requestor role, whose value will subsequently be used by the policy validator to choose the correct configuration value. The requestor role for the SequenceAck messages should not be reset.