[RAMPART-432] Axis2 BSP compliance

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.7.0
• Fix Version/s: 1.8.0
• Component/s: rampart-policy
• Labels: bsp-compliance rampart
• Environment: Windows for client
• Assignee: Robert Lazarski
• Reporter: jesusincamedio
• Created: 26/Apr/16 07:17
• Updated: 30/Oct/24 15:25
• Resolved: 30/Oct/24 15:25

Description

Hi,
We have this exception in a SOAP comunication:

org.apache.axis2.AxisFault: An invalid security token was provided (Bad ValueType "")
at org.apache.rampart.handler.RampartReceiver.setFaultCodeAndThrowAxisFault(RampartReceiver.java:180)
at org.apache.rampart.handler.RampartReceiver.invoke(RampartReceiver.java:95)
at org.apache.axis2.engine.Phase.invokeHandler(Phase.java:335)
at org.apache.axis2.engine.Phase.invoke(Phase.java:308)
at org.apache.axis2.engine.AxisEngine.invoke(AxisEngine.java:250)
at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:156)
at org.apache.axis2.description.OutInAxisOperationClient.handleResponse(OutInAxisOperation.java:357)
at org.apache.axis2.description.OutInAxisOperationClient.send(OutInAxisOperation.java:414)
at org.apache.axis2.description.OutInAxisOperationClient.executeImpl(OutInAxisOperation.java:225)
at org.apache.axis2.client.OperationClient.execute(OperationClient.java:150)
...................................................
Caused by: org.apache.ws.security.WSSecurityException: An invalid security token was provided (Bad ValueType "")
at org.apache.ws.security.str.BSPEnforcer.checkBinarySecurityBSPCompliance(BSPEnforcer.java:59)
at org.apache.ws.security.str.SignatureSTRParser.processPreviousResult(SignatureSTRParser.java:487)
at org.apache.ws.security.str.SignatureSTRParser.parseSecurityTokenReference(SignatureSTRParser.java:132)
at org.apache.ws.security.processor.SignatureProcessor.handleToken(SignatureProcessor.java:169)
at org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:402)
at org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:309)
at org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:254)
at org.apache.rampart.RampartEngine.process(RampartEngine.java:161)
at org.apache.rampart.handler.RampartReceiver.invoke(RampartReceiver.java:92)
... 15 more

After searching for information the cause of the error could be:

• BSP-compliance

In CXF people can disable this feature but in rampart-axis2 it seems there is no way to do that.

¿Is there any way to disable bsp-compliance though policy file??? or java code???or any way in the world???????

Thanks for your attention,