Rampart
  1. Rampart
  2. RAMPART-198

Rampart 1.4 assumes WSS10 or WSS11 to be present in the policy

    Details

    • Type: Bug Bug
    • Status: Resolved
    • Priority: Minor Minor
    • Resolution: Fixed
    • Affects Version/s: 1.4
    • Fix Version/s: 1.5.1
    • Component/s: rampart-policy
    • Labels:
      None

      Description

      Rampart 1.4 assumes WSS10 or WSS11 to be present in the policy. This is not a mandatory requirement and we must use defaults if those assertions are not present.

      http://wso2.org/library/3415

      Exception:java.lang.NullPointerException
      java.lang.NullPointerException
      at org.apache.rampart.util.RampartUtil.setKeyIdentifierType(RampartUtil.java:1141)
      at org.apache.rampart.builder.BindingBuilder.getSignatureBuider(BindingBuilder.java:243)
      at org.apache.rampart.builder.AsymmetricBindingBuilder.doSignature(AsymmetricBindingBuilder.java:626)
      at org.apache.rampart.builder.AsymmetricBindingBuilder.doSignBeforeEncrypt(AsymmetricBindingBuilder.java:413)
      at org.apache.rampart.builder.AsymmetricBindingBuilder.build(AsymmetricBindingBuilder.java:93)
      at org.apache.rampart.MessageBuilder.build(MessageBuilder.java:147)
      at org.apache.rampart.handler.RampartSender.invoke(RampartSender.java:64)
      at org.apache.axis2.engine.Phase.invoke(Phase.java:317)
      at org.apache.axis2.engine.AxisEngine.invoke(AxisEngine.java:264)
      at org.apache.axis2.engine.AxisEngine.send(AxisEngine.java:429)
      at org.apache.axis2.description.OutInAxisOperationClient.send(OutInAxisOperation.java:401)
      at org.apache.axis2.description.OutInAxisOperationClient.executeImpl(OutInAxisOperation.java:228)
      at org.apache.axis2.client.OperationClient.execute(OperationClient.java:163)
      at com.my.ws.test.JmeterserviceSecStub.addition(JmeterserviceSecStub.java:240)
      at com.my.ws.test.TestClient.main(TestClient.java:57)

      The code appears to want a Wss10 or Wss11 Assertion in the list of assertions on the message context.
      But there are none so this line causes a null pointer:

      public class RampartUtil
      ...
      public static void setKeyIdentifierType(RampartPolicyData rpd, WSSecBase secBase,org.apache.ws.secpolicy.model.Token token) {
      ....
      if (wss.isMustSupportRefKeyIdentifier()) {

      Adding this to the policy fixes the error:

      <sp:Wss10 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
      <wsp:Policy>
      <sp:MustSupportRefKeyIdentifier/>
      <sp:MustSupportRefIssuerSerial/>
      </wsp:Policy>
      </sp:Wss10>

        Activity

        Hide
        asela pathberiya added a comment -

        Verified in trunk.

        Show
        asela pathberiya added a comment - Verified in trunk.
        Hide
        S.Uthaiyashankar added a comment -

        This problem is no longer available in the trunk. Hence resolving the issue. Please reopen, if this still re-creatable.

        Show
        S.Uthaiyashankar added a comment - This problem is no longer available in the trunk. Hence resolving the issue. Please reopen, if this still re-creatable.
        Hide
        anand kadu added a comment -

        I am using Axis2 1.5.4 and rampart 1.6.0 .But I am still facing this issue in security. I am getting following exception
        Exception in thread "main" java.lang.NullPointerException
        at org.apache.rampart.util.RampartUtil.setKeyIdentifierType(RampartUtil.java:1333)
        at org.apache.rampart.builder.AsymmetricBindingBuilder.doSignBeforeEncrypt(AsymmetricBindingBuilder.java:526)
        at org.apache.rampart.builder.AsymmetricBindingBuilder.build(AsymmetricBindingBuilder.java:90)
        at org.apache.rampart.MessageBuilder.build(MessageBuilder.java:147)
        at org.apache.rampart.handler.RampartSender.invoke(RampartSender.java:65)
        at org.apache.axis2.engine.Phase.invoke(Phase.java:318)
        at org.apache.axis2.engine.AxisEngine.invoke(AxisEngine.java:254)
        at org.apache.axis2.engine.AxisEngine.send(AxisEngine.java:419)
        at org.apache.axis2.description.OutInAxisOperationClient.send(OutInAxisOperation.java:402)
        at org.apache.axis2.description.OutInAxisOperationClient.executeImpl(OutInAxisOperation.java:229)
        at org.apache.axis2.client.OperationClient.execute(OperationClient.java:165)
        at org.infosys.www.finacle.ACCTSServiceStub.transceive(ACCTSServiceStub.java:181)
        at sampleaxis2project.Main.main(Main.java:107)

        Show
        anand kadu added a comment - I am using Axis2 1.5.4 and rampart 1.6.0 .But I am still facing this issue in security. I am getting following exception Exception in thread "main" java.lang.NullPointerException at org.apache.rampart.util.RampartUtil.setKeyIdentifierType(RampartUtil.java:1333) at org.apache.rampart.builder.AsymmetricBindingBuilder.doSignBeforeEncrypt(AsymmetricBindingBuilder.java:526) at org.apache.rampart.builder.AsymmetricBindingBuilder.build(AsymmetricBindingBuilder.java:90) at org.apache.rampart.MessageBuilder.build(MessageBuilder.java:147) at org.apache.rampart.handler.RampartSender.invoke(RampartSender.java:65) at org.apache.axis2.engine.Phase.invoke(Phase.java:318) at org.apache.axis2.engine.AxisEngine.invoke(AxisEngine.java:254) at org.apache.axis2.engine.AxisEngine.send(AxisEngine.java:419) at org.apache.axis2.description.OutInAxisOperationClient.send(OutInAxisOperation.java:402) at org.apache.axis2.description.OutInAxisOperationClient.executeImpl(OutInAxisOperation.java:229) at org.apache.axis2.client.OperationClient.execute(OperationClient.java:165) at org.infosys.www.finacle.ACCTSServiceStub.transceive(ACCTSServiceStub.java:181) at sampleaxis2project.Main.main(Main.java:107)
        Hide
        Robert Dodier added a comment -

        Can someone please reopen this bug report? The bug is still present.

        I am working with Axis2 1.6.1 and Rampart 1.6.1. I get the exception shown below.

        Inspecting RampartUtil.java, I see that around line 1333 there is the same faulty logic as ever (checks for WSS10 and WSS11 but has no fallback if both of those come up with nothing). I looked at the SVN history for RampartUtil.java, and, indeed, for the entire Rampart project, but there is nothing about fixing RAMPART-198. Since there was apparently no action taken, it appears to be simply the case that the person who closed it couldn't reproduce the bug.

        Putting in the Wss10 XML fragment shown in the original report does make this error go away (although then I run into a different error).

        java.lang.NullPointerException
        at org.apache.rampart.util.RampartUtil.setKeyIdentifierType(RampartUtil.java:1333)
        at org.apache.rampart.builder.AsymmetricBindingBuilder.doSignBeforeEncrypt(AsymmetricBindingBuilder.java:526)
        at org.apache.rampart.builder.AsymmetricBindingBuilder.build(AsymmetricBindingBuilder.java:90)
        at org.apache.rampart.MessageBuilder.build(MessageBuilder.java:147)
        at org.apache.rampart.handler.RampartSender.invoke(RampartSender.java:65)
        at org.apache.axis2.engine.Phase.invokeHandler(Phase.java:340)
        at org.apache.axis2.engine.Phase.invoke(Phase.java:313)
        at org.apache.axis2.engine.AxisEngine.invoke(AxisEngine.java:262)
        at org.apache.axis2.engine.AxisEngine.send(AxisEngine.java:427)
        at org.apache.axis2.receivers.AbstractInOutMessageReceiver.invokeBusinessLogic(AbstractInOutMessageReceiver.java:43)
        at org.apache.axis2.receivers.AbstractMessageReceiver.receive(AbstractMessageReceiver.java:110)
        at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:181)
        at org.apache.axis2.transport.http.HTTPTransportUtils.processHTTPPostRequest(HTTPTransportUtils.java:172)
        at org.apache.axis2.transport.http.AxisServlet.doPost(AxisServlet.java:146)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:857)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
        at java.lang.Thread.run(Thread.java:679)

        Show
        Robert Dodier added a comment - Can someone please reopen this bug report? The bug is still present. I am working with Axis2 1.6.1 and Rampart 1.6.1. I get the exception shown below. Inspecting RampartUtil.java, I see that around line 1333 there is the same faulty logic as ever (checks for WSS10 and WSS11 but has no fallback if both of those come up with nothing). I looked at the SVN history for RampartUtil.java, and, indeed, for the entire Rampart project, but there is nothing about fixing RAMPART-198 . Since there was apparently no action taken, it appears to be simply the case that the person who closed it couldn't reproduce the bug. Putting in the Wss10 XML fragment shown in the original report does make this error go away (although then I run into a different error). java.lang.NullPointerException at org.apache.rampart.util.RampartUtil.setKeyIdentifierType(RampartUtil.java:1333) at org.apache.rampart.builder.AsymmetricBindingBuilder.doSignBeforeEncrypt(AsymmetricBindingBuilder.java:526) at org.apache.rampart.builder.AsymmetricBindingBuilder.build(AsymmetricBindingBuilder.java:90) at org.apache.rampart.MessageBuilder.build(MessageBuilder.java:147) at org.apache.rampart.handler.RampartSender.invoke(RampartSender.java:65) at org.apache.axis2.engine.Phase.invokeHandler(Phase.java:340) at org.apache.axis2.engine.Phase.invoke(Phase.java:313) at org.apache.axis2.engine.AxisEngine.invoke(AxisEngine.java:262) at org.apache.axis2.engine.AxisEngine.send(AxisEngine.java:427) at org.apache.axis2.receivers.AbstractInOutMessageReceiver.invokeBusinessLogic(AbstractInOutMessageReceiver.java:43) at org.apache.axis2.receivers.AbstractMessageReceiver.receive(AbstractMessageReceiver.java:110) at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:181) at org.apache.axis2.transport.http.HTTPTransportUtils.processHTTPPostRequest(HTTPTransportUtils.java:172) at org.apache.axis2.transport.http.AxisServlet.doPost(AxisServlet.java:146) at javax.servlet.http.HttpServlet.service(HttpServlet.java:637) at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:857) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588) at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) at java.lang.Thread.run(Thread.java:679)

          People

          • Assignee:
            S.Uthaiyashankar
            Reporter:
            Pete K
          • Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Time Tracking

              Estimated:
              Original Estimate - 1h
              1h
              Remaining:
              Remaining Estimate - 1h
              1h
              Logged:
              Time Spent - Not Specified
              Not Specified

                Development