[CXF-7308] Weblogic 12.1.3 + CXF 3.0.3

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Workaround
• Affects Version/s: 3.0.3
• Labels: newbie security
• Estimated Complexity: Unknown
• Assignee: Unassigned
• Reporter: Tomas Garcia
• Created: 31/Mar/17 10:45
• Updated: 03/Jan/20 21:25
• Resolved: 15/May/17 19:19

Description

Hi,

I have the same problem that was registered in CXF-7245, but with earlier versions of Weblogic (12.1.3) and CXF (3.0.3).

I am using a security interceptor for signature verification, a WSS4JInInterceptor. It works fine on Tomcat, but in Weblogic:

[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG WSProviderConfig:346 - The provider STRTransform was added at position: 15
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG WSProviderConfig:346 - The provider AttachmentContentSignatureTransform was added at position: 16
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG WSProviderConfig:346 - The provider AttachmentCompleteSignatureTransform was added at position: 17
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG WSS4JInInterceptor:226 - WSS4JInInterceptor: enter handleMessage()
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG Loader:115 - Trying to find [C:\Users\T12021\certs/AXUDE/AXUDE_WS_PSINATURAS/axude_ws_psinaturas.jks] using weblogic.utils.classloaders.ChangeAwareClassLoader@2dec5a0 finder: weblogic.utils.classloaders.CodeGenClassFinder@90ebae0 annotation: AXUDE_WS_PSINATURAS-ear#01.02.00-SNAPSHOT@AXUDE_WS_PSINATURAS class loader.
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG Loader:58 - Trying to find [C:\Users\T12021\certs/AXUDE/AXUDE_WS_PSINATURAS/axude_ws_psinaturas.jks] using weblogic.utils.classloaders.ChangeAwareClassLoader@2dec5a0 finder: weblogic.utils.classloaders.CodeGenClassFinder@90ebae0 annotation: AXUDE_WS_PSINATURAS-ear#01.02.00-SNAPSHOT@AXUDE_WS_PSINATURAS class loader.
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG Loader:89 - Trying to find [C:\Users\T12021\certs/AXUDE/AXUDE_WS_PSINATURAS/axude_ws_psinaturas.jks] using ClassLoader.getSystemResource().
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG Merlin:226 - The KeyStore C:\Users\T12021\certs/AXUDE/AXUDE_WS_PSINATURAS/axude_ws_psinaturas.jks of type jks has been loaded
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG Merlin:296 - CA certs have been loaded
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG SignatureProcessor:115 - Found signature element
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG Merlin:821 - Direct trust for certificate with [...]
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG SignatureTrustValidator:111 - Certificate path has been verified for certificate with subject [...]
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG SignatureProcessor:379 - Verify XML Signature
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG SignatureProcessor:428 - XML Signature verification has failed
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG SignatureProcessor:431 - Signature Validation check: true
[10.3.36.27-1490954621515] - 31-03-2017 12:03:41 DEBUG SignatureProcessor:441 - Reference #id-1910 check: false

Thanks