[RAMPART-346] Rampart should encrypt soap request body by default, and it seems that doesn't do that

• Type: Question
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 1.5.1
• Component/s: rampart-policy
• Environment: ubuntu 10.04, Tomcat 6.0, Axis2
• Assignee: Unassigned
• Reporter: Enrico Viappiani
• Created: 17/Dec/11 18:34
• Updated: 19/Dec/11 13:52
• Resolved: 19/Dec/11 13:52

Description

All where fine except for the body that isn't encrypted, also no error messages, so i can't figure out where the issue is!
Rampart shouldn't encrypt the body of the Soap message by default with the Encrypt tag? Am i wrong? Thanks

from axis2.xml:

1. <module ref="rampart"></module>
3. <parameter name="OutflowSecurity">
4. <action>
5. <items>UsernameToken Encrypt Timestamp Signature</items>
6. <user>service</user>
7. <passwordCallbackClass>it.unipr.aotlab.PWCBHandler</passwordCallbackClass>
8. <encryptionUser>client</encryptionUser>
9. <encryptionPropFile>service.properties</encryptionPropFile>
10. <signaturePropFile>service.properties</signaturePropFile>
11. <signatureKeyIdentifier>IssuerSerial</signatureKeyIdentifier>
12. </action>
13. </parameter>
15. <parameter name="InflowSecurity">
16. <action>
17. <items>UsernameToken Encrypt Timestamp Signature</items>
18. <passwordCallbackClass>it.unipr.aotlab.PWCBHandler</passwordCallbackClass>
19. <decryptionPropFile>service.properties</decryptionPropFile>
20. <signaturePropFile>service.properties</signaturePropFile>
21. <signatureKeyIdentifier>IssuerSerial</signatureKeyIdentifier>
22. </action>
23. </parameter>

from service.properties:

org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin

org.apache.ws.security.crypto.merlin.keystore.type=jks

org.apache.ws.security.crypto.merlin.keystore.password=servicestorekey

org.apache.ws.security.crypto.merlin.file=service.jks

this is the Soap request catched by SOAPMonitor:

1. <?xml version='1.0' encoding='utf-8'?><soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><soapenv:Header xmlns:wsa="http://www.w3.org/2005/08/addressing"><wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soapenv:mustUnderstand="true"><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="Signature-64">
2. <ds:SignedInfo>
3. <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
4. <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
5. <ds:Reference URI="#id-65">
6. <ds:Transforms>
7. <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
8. </ds:Transforms>
9. <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
10. <ds:DigestValue>CDFLN83TOs5+SlNOrZNpIQn2Pq0=</ds:DigestValue>
11. </ds:Reference>
12. </ds:SignedInfo>
13. <ds:SignatureValue>
14. W+KlXPZhJrurB8I2gxrI9f98ivLYTh/0B1A8p5lCe+Bhv2uLN8ZOQJObysOgVHyDxKrYqa3MscB8
15. d1IcVUnXgnquG7ensMi6dtc+8njqk1IRmhB3WYuPW85kopYfSK/0F4ryWPZmgmNQrucTbMsY4I9b
16. UJ7OKWkSQXINYm4KuUg=
17. </ds:SignatureValue>
18. <ds:KeyInfo Id="KeyId-5356F8146A2D7E4B97132404649292164">
19. <wsse:SecurityTokenReference xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="STRId-5356F8146A2D7E4B97132404649292165"><ds:X509Data>
20. <ds:X509IssuerSerial>
21. <ds:X509IssuerName>CN=Enrico Viappiani,OU=casa,O=casa,L=reggio emilia,ST=RE,C=IT</ds:X509IssuerName>
22. <ds:X509SerialNumber>1323271624</ds:X509SerialNumber>
23. </ds:X509IssuerSerial>
24. </ds:X509Data></wsse:SecurityTokenReference>
25. </ds:KeyInfo>
26. </ds:Signature><wsu:Timestamp xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Timestamp-63"><wsu:Created>2011-12-16T14:41:32.920Z</wsu:Created><wsu:Expires>2011-12-16T14:46:32.920Z</wsu:Expires></wsu:Timestamp><xenc:EncryptedKey Id="EncKeyId-5356F8146A2D7E4B97132404649291962"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" /><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
27. <wsse:SecurityTokenReference><ds:X509Data>
28. <ds:X509IssuerSerial>
29. <ds:X509IssuerName>CN=Enrico Viappiani,OU=casa,O=casa,L=reggio emilia,ST=RE,C=IT</ds:X509IssuerName>
30. <ds:X509SerialNumber>1323271546</ds:X509SerialNumber>
31. </ds:X509IssuerSerial>
32. </ds:X509Data></wsse:SecurityTokenReference>
33. </ds:KeyInfo><xenc:CipherData><xenc:CipherValue>ZI5mjekZBXYfQeHBu1xKj4DTUwFV2cWpD8P8g9f8v3qJRGSjYhTuWcOMX11D3TRv9kcBgy7ung2DO6/sw244VSrCiI02pLZHyY9T2vuC+PBffnitFL+jgeNtA74DKw9vC4KEVCVbkXrKUqpWZ1ATNxumR1FN2ViJlviYHOwLVD8=</xenc:CipherValue></xenc:CipherData><xenc:ReferenceList><xenc:DataReference URI="#EncDataId-62" /></xenc:ReferenceList></xenc:EncryptedKey><wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-61"><wsse:Username>client</wsse:Username><wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">ndQ8vXUsELCdgTcADoSuI+N4eKU=</wsse:Password><wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">fXRZlMmfiujFfHDZjNJUGA==</wsse:Nonce><wsu:Created>2011-12-16T14:41:32.918Z</wsu:Created></wsse:UsernameToken></wsse:Security><wsa:To>http://localhost:8080/HospitalWS/services/HospitalService</wsa:To><wsa:MessageID>urn:uuid:8CE6524CD8C698CF7E1324046493019</wsa:MessageID><wsa:Action>urn:RequestList</wsa:Action></soapenv:Header><soapenv:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="id-65"><ns1:RequestList xmlns:ns1="http://aotlab.unipr.it"><ns1:user><User>
34. <CF>vppnrc84l16h223l</CF>
35. <password>viappio</password>
36. </User></ns1:user></ns1:RequestList></soapenv:Body></soapenv:Envelope>