[CXF-6900] invalid signature in case of soap fault

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.3
• Fix Version/s: 3.1.7
• Component/s: WS-* Components

Environment

windows 2008 jdk 1.6.0_45

• Estimated Complexity: Unknown
• Assignee: Colm O hEigeartaigh
• Reporter: david leruse
• Created: 14/May/16 07:59
• Updated: 14/Oct/16 14:21
• Resolved: 24/May/16 13:14

Description

Hello,

Having signature verification problems on the cxf client-side with a .NET Ws-fed protected webservice, I ask you a little help...
Here is a summary of the problem :
Most of the time, communication works well excepted when we got a soap fault message.
Indeed signature validation works usually well excepted when
we receive a fault message inside the body of the soap message. Even In this boundary case, signature verification works well excepted for one element, the fault message (see the enclosed server7.log file).

After digging a bit, i've found that the calculated digest couldn't be equal to the claimed one because the content of the message given to the DigesterOutpustrream is not well canonicalized or normalized.

Partial decrypted msg

...
<s:Body u:Id="_3">
<Fault xmlns="http://www.w3.org/2003/05/soap-envelope"><Code><Value>DataNotFoundFault</Value></Code><Reason><Text xml:lang="nl-BE">ContextContactInfo with Id '1' does not exist.</Text></Reason><Detail><DataNotFoundFault xmlns="http://schemas.riziv.fgov.be/contact/2015/08/faults" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><ErrorCode>ContextContactInfoNotFound</ErrorCode><Message>ContextContactInfo with Id '1' does not exist.</Message></DataNotFoundFault></Detail></Fault>
</s:Body>
...

Predigested input :

<s:Body xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" u:Id="_3"><env:Fault><Code xmlns="http://www.w3.org/2003/05/soap-envelope"><Value>DataNotFoundFault</Value></Code><Reason xmlns="http://www.w3.org/2003/05/soap-envelope"><Text xml:lang="nl-BE">ContextContactInfo with Id '1' does not exist.</Text></Reason><env:Detail><DataNotFoundFault xmlns="http://schemas.riziv.fgov.be/contact/2015/08/faults"><ErrorCode>ContextContactInfoNotFound</ErrorCode><Message>ContextContactInfo with Id '1' does not exist.</Message></DataNotFoundFault></env:Detail></env:Fault></s:Body>

Could you please check this problem and give me an advice ?

The library used are :

cxf 3.0.3
wss4j 2.0.2
xmlsec 2.0.2

on a jdk 1.6.0_45

Thanks in advance
David L

Issue Links

• is related to: SANTUARIO-442 invalid signature in case of soap fault
• relates to: SANTUARIO-442 invalid signature in case of soap fault