[CXF-7979] Issues when an operation's input and output should have different policies

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 3.3.0
• Component/s: JAX-WS Runtime

Environment

Tested with CXF 3.3.0, a reproducing example and unit test can be found here: https://github.com/netmikey/cxf-security-test

• Estimated Complexity: Unknown
• Assignee: Colm O hEigeartaigh
• Reporter: Mike M.
• Created: 21/Feb/19 14:51
• Updated: 18/Sep/23 18:49
• Resolved: 22/Mar/19 16:25

Description

We think we might have found an issue in the way WSDL-Embedded WebService Security Policies are interpreted at runtime.

We are in contract-first mode, but don't use generated JAXB bindings. We use a @WebServiceProvider implementation as a dynamic server and use javax.xml.ws.Dispatch to build a dynamic client.

The issue happens when we try to apply different WSS-Policies to an operation's wsdl:input and wsdl:output, so e.g. having the request secured but the response non-secured.

We see different behavior depending on where we put the wsp:PolicyReference within the WSDL, but we didn't manage to make it work: either the client doesn't encrypt the request at all, or the server encrypts the response as well.

I created a small but fully functional project on GitHub that contains a unit test which demonstrates the behavior (be sure to check the project's README).

Please have a look at: https://github.com/netmikey/cxf-security-test