How to consume a WS-Security Webservice? - web-services

Question

I am trying to consume a WS-Security protected webservice but I am facing some problems. It is a CMDBuild webservice. I have read the CMDBuild Webservices Manual, but I had no success consuming it yet.
I used two ways to try to consume the webservices: SoapUI and Java using Apache CXF. I will describe what I have done to try to consume the webservice with both methods.
First of all, I installed the CMDB application successfully and I can access the WSDL normally. If you need to take a look into WSDL, you can see it here. I know that I have to send a username token, but what I don't know is where I have to put the username token and how I do that.
All methods provided in the webservice can be used upon authentication
in the CMDBuild system. The authentication is performed upon the WSS
Username Token profile 1.0 specification with digest password.
Other question is how I can obtain this username token and the digest password. What I have is the application username and password which I use to access the application GUI.
SoapUI
When I try to consume any method of webservice using SoapUI, the response is always the same:
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
<soap:Body>
<soap:Fault>
<soap:Code>
<soap:Value>soap:Sender</soap:Value>
<soap:Subcode>
<soap:Value xmlns:ns1="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">ns1:InvalidSecurity</soap:Value>
</soap:Subcode>
</soap:Code>
<soap:Reason>
<soap:Text xml:lang="en">An error was discovered processing the <wsse:Security> header</soap:Text>
</soap:Reason>
</soap:Fault>
</soap:Body>
</soap:Envelope>
Here, the XML request (generated by SoapUI):
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:soap1="http://soap.services.cmdbuild.org">
<soap:Header/>
<soap:Body>
<soap1:getCardList>
<!--Optional:-->
<soap1:className></soap1:className>
<!--Zero or more repetitions:-->
<soap1:attributeList>
<!--Optional:-->
<soap1:code></soap1:code>
<!--Optional:-->
<soap1:name></soap1:name>
<!--Optional:-->
<soap1:value></soap1:value>
</soap1:attributeList>
<!--Optional:-->
<soap1:queryType>
<!--Optional:-->
<soap1:filter>
<!--Optional:-->
<soap1:name></soap1:name>
<!--Optional:-->
<soap1:operator>?</soap1:operator>
<!--Zero or more repetitions:-->
<soap1:value></soap1:value>
</soap1:filter>
<!--Optional:-->
<soap1:filterOperator>
<!--Optional:-->
<soap1:operator></soap1:operator>
<!--Zero or more repetitions:-->
<soap1:subquery/>
</soap1:filterOperator>
</soap1:queryType>
<!--Zero or more repetitions:-->
<soap1:orderType>
<!--Optional:-->
<soap1:columnName></soap1:columnName>
<!--Optional:-->
<soap1:type></soap1:type>
</soap1:orderType>
<!--Optional:-->
<soap1:limit></soap1:limit>
<!--Optional:-->
<soap1:offset></soap1:offset>
<!--Optional:-->
<soap1:fullTextQuery></soap1:fullTextQuery>
</soap1:getCardList>
</soap:Body>
</soap:Envelope>
Apache CXF
Using Java, I tried with Apache CXF and I generated the classes automatically (wsdl2java). After that, I code a little bit:
public class Main {
public static void main(String[] args) throws MalformedURLException {
Map<String, Object> inProps = new HashMap<String, Object>();
inProps.put(WSHandlerConstants.ACTION, WSHandlerConstants.USERNAME_TOKEN);
inProps.put(WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_TEXT);
Proxy315Service srv = new Proxy315Service(new URL("http://example.com.br:8080/cmdbuild/services/soap/Webservices?wsdl"));
Webservices services = srv.getProxy315Port();
EndpointImpl jaxWsEndpoint = (EndpointImpl) EndpointImpl.publish("http://example.com.br:8080/cmdbuild/services/soap/Webservices", services);
Endpoint cxfEndpoint = jaxWsEndpoint.getServer().getEndpoint();
WSS4JInInterceptor wssIn = new WSS4JInInterceptor(inProps);
cxfEndpoint.getInInterceptors().add(wssIn);
Map<String, Object> outProps = new HashMap<String, Object>();
outProps.put(WSHandlerConstants.ACTION, WSHandlerConstants.USERNAME_TOKEN);
outProps.put(WSHandlerConstants.USER, "gchaves");
outProps.put(WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_TEXT);
WSS4JOutInterceptor wssOut = new WSS4JOutInterceptor(outProps);
cxfEndpoint.getOutInterceptors().add(wssOut);
MenuSchema menu = services.getMenuSchema();
System.out.println(menu.getDescription());
}
}
Output:
Exception in thread "main" javax.xml.ws.WebServiceException: Could not find service named {http://proxy.sun.com/}Proxy315Service in wsdl http://example.com.br:8080/cmdbuild/services/soap/Webservices?wsdl
at org.apache.cxf.jaxws.ServiceImpl.initializePorts(ServiceImpl.java:161)
at org.apache.cxf.jaxws.ServiceImpl.<init>(ServiceImpl.java:149)
at org.apache.cxf.jaxws.spi.ProviderImpl.createServiceDelegate(ProviderImpl.java:101)
at javax.xml.ws.Service.<init>(Unknown Source)
at com.sun.proxy.Proxy315Service.<init>(Proxy315Service.java:40)
at com.example.main.Main.main(Main.java:26)

Answer 1

Here is example that works for me:
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:soap1="http://soap.services.cmdbuild.org">
<soap:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soap:mustUnderstand="1">
<wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-2">
<wsse:Username>admin</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">admin</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</soap:Header>
<soap:Body>
<soap1:getCardList>
<!--Optional:-->
<soap1:className>Monitor</soap1:className>
<!--Zero or more repetitions:-->
<soap1:attributeList>
<!--Optional:-->
<!--Optional:-->
</soap1:attributeList>
<!--Optional:-->
<soap1:queryType>
<!--Optional:-->
<soap1:filter>
<!--Optional:-->
<soap1:name>Brand</soap1:name>
<!--Optional:-->
<soap1:operator>EQUALS</soap1:operator>
<!--Zero or more repetitions:-->
<soap1:value>HP</soap1:value>
</soap1:filter>
<!--Optional:-->
</soap1:queryType>
<!--Zero or more repetitions:-->
<soap1:orderType>
<!--Optional:-->
<soap1:columnName>Code</soap1:columnName>
<!--Optional:-->
<soap1:type>ASC</soap1:type>
</soap1:orderType>
<!--Optional:-->
<soap1:limit>0</soap1:limit>
<!--Optional:-->
<soap1:offset>0</soap1:offset>
<!--Optional:-->
<soap1:fullTextQuery>*</soap1:fullTextQuery>
</soap1:getCardList>
</soap:Body>
</soap:Envelope>

Answer 2

Although it is too late, this answer may help others.
See this link that explains how to use soapUI to consume ws-security enabled web services. You should just double click on the project (In soapUI) and configure outgoing wss. And in soap message (xml part) you should add wss header as it is described in the above link.