Uploaded image for project: 'Rampart'
  1. Rampart
  2. RAMPART-387

Rampart reports SAML Token Missing In Request

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 1.6.2
    • Fix Version/s: 1.6.4, 1.7.0
    • Component/s: rampart-core
    • Labels:
    • Environment:
      Windows 7 64; Axis2/Rampart deployment in Tomcat

      Description

      When sending a message containing a SAML Token generated by Rampart's STS service, the module PolicyBasedResultsValidator.handleSupportingTokens() throws a RampartException with
      message "samlTokenMissing".

      I believe the error is due to only attempting to validate an unsigned token. The token created by the STS service is signed as it must be by WS Security requirements.
      Starting at line 323 one sees:

      else if (token instanceof IssuedToken)
      {
      //TODO is is enough to check for ST_UNSIGNED results ??
      WSSecurityEngineResult samlResult = WSSecurityUtil.fetchActionResult(results, WSConstants.ST_UNSIGNED);
      if (samlResult == null)

      { throw new RampartException("samlTokenMissing"); }

      There needs to be a check for ST_SIGNED.
      I do not know how to build the distribution or I would try this myself.

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              gyannea Brian Reinhold
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: