SAML Assertion ID already in cache -- returning SC_FORBIDDEN

We are using WLS 10.3 and getting a SAML Assertion IDI already in cache -- returning SC_FORBIDDEN.
Any clue as to how or why this would happen or resolution.
Also we are in a Managed Server Cluster Environemnt.
thanks
ft

Hi Hao,
Regarding claims based issue, I suggest you refer to experts from the following forum to get professional support:
Claims based access platform (CBA), code-named Geneva Forum
http://social.msdn.microsoft.com/Forums/vstudio/en-US/home?forum=Geneva
Thank you for your understanding and support.
Best Regards,
Amy

Similar Messages

  • Invoke a Webservice that return a SAML assertion

    Dear Developers,
    how can i invoke a Synchronous Webservices(AuthenticateUserService) that reteurn an authentication assertion (SAML assertion) and then use this authentication assertion to invoke another service.
    the AuthenticateUserService has one web service method "login" with the following parameter: loginRequest (with the attributes user and pass which are necessary for logon)
    loginResponse (with the response attribute authentication assertion and response message
    authentication assertion will be use to invoke another WebService
    thanks in advance

    Sorry my entity is like this...
    @Entity
    @Table(name = "V_I_ORGANISATIONS")
    Class InternalOrganisationImpl implements InternalOrganisation{
        @Id
        @Column(name = "IO_ID")
        @ManyToOne(cascade=javax.persistence.CascadeType.ALL)
        private Long id;
        @OneToOne
        @JoinColumn(name = "IO_PARENT_ID")
        private InternalOrganisation parent;
        @OneToMany(mappedBy="parent", fetch=FetchType.LAZY)
        private List<InternalOrganisation> children;
        public List<InternalOrganisation> getChildrenOrganisation(Long id){
            return children;
    }This example is fo a hierarchical table/entity but for other case, the problem is tha same...
    No dao there in of course!
    When I do this i've an error "reference to an unknow entity ... *InternalOrganisation*" (problem is the getChildren method)
    Yes it's normal as InternalOrganisation is an interface.
    So it's not possible to cretae inteface for entities?
    But how to create a webservices that return entities as those entities contains jpa annotations?
    Edited by: paf.be on May 16, 2008 9:54 AM

  • Parse a SAML assertion

    I want to parse a SAML assertion from an Identity Provider and use some
    of the data for identity injection. Anyway, the java identity injection
    plug-in can not access the SAML assertion, it can only access the
    username and password using the ExternalDataFillerContext object.
    Is it possible to extend tha authentication class to parse the SAML
    assertion and write out the data to the customisation profile? Which
    method or property returns the SAML assertion?
    Thank you,
    Alessandro
    afolli
    afolli's Profile: http://forums.novell.com/member.php?userid=6964
    View this thread: http://forums.novell.com/showthread.php?t=398904

    Hi. Thanks for the answer.
    I have two federated domains. The user requests a resource on domainA
    and he's redirected to IdpA for authentication. The user authenticate on
    IdpB and returns back. At this point I need to extract some info from
    the SAML assertion returned by IdpB.
    Do you think it's possible?
    Thanks,
    Alessandro
    mumasankar;1926007 Wrote:
    > The assertions are not stored on the session. It is little confusing
    > when you say you want to parse a SAML assertion from authentication
    > class. Usually, after authentication is done (after authentication class
    > finished exectuing), the response will be generated by the IDP and
    > assertion cration is part of the response.
    >
    > Can you please give details of your use case ?
    >
    > Regards,
    > Uma.
    afolli
    afolli's Profile: http://forums.novell.com/member.php?userid=6964
    View this thread: http://forums.novell.com/showthread.php?t=398904

  • Saml assertion error

    Hi,
    My composite app will be invoked by x party from soapui. the input soap request has samlassertion contains
    <saml:Assertion .... Issuer="testone.com" ...xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" ...>
    <saml:Conditions NotBefore="... NotOnOrAfter="...>
    <saml:AudienceRestrictionCondition>
    <saml:Audience>https://ws.test.com/</saml:Audience>
    </saml:AudienceRestrictionCondition>
    </saml:Conditions>
    <saml:AuthenticationStatement AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password" AuthenticationInstant="...">
    <saml:Subject>
    <saml:NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName" NameQualifier="testdmn.com">testuser</saml:NameIdentifier>
    <saml:SubjectConfirmation>
    <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:holder-of-key</saml:ConfirmationMethod>
    <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
    <wsse:SecurityTokenReference wsu:Id="TestCert" wsse11:TokenType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">
    <wsse:Reference URI="#....>
    </wsse:SecurityTokenReference>
    </KeyInfo>
    </saml:SubjectConfirmation>
    </saml:Subject>
    </saml:AuthenticationStatement>
    <Signature ...
    I added saml service policy at soa suite composite, if saml authentication succeed then I will call some ecternal service from my bpel in composite.
    If I execute the app from soapui I am getting the following error:
    Found invalid name identifier in SAML assertion. Can not find the specified user in id store: testuser
    Since I want to do saml authentication by consuming the samlassertion is it enough to configure saml identity asserter only or do I also need saml credential mapper?
    Also where exactly I can specify the user, audience, NameQualifier, certificate info which I am getting from saml assertion?
    Please specify any extra configuration do I require to execute this.
    Please provide your inputs as it is urgent for me. Thanks in advance.

    Hi Mahesh,
    There is no scope request parameter needed. It is hard to know precisely what is the issue without the trace of your call, such as provided, for example, by Fiddler. For example, here is a call that I made showing traced through Fiddler showing how this flow works. My suspicion is that you may have a typo in the grant_type parameter, which should be urn:ietf:params:oauth:grant-type:saml2-bearer with the colons escaped as below.
    The HTTP request:
    POST https://jamN.sapjam.com/api/v1/auth/token HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Java/1.7.0_45
    Host: jamN.sapjam.com
    Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
    Connection: keep-alive
    Content-Length: 3202
    client_id=i7Gb...x8D3vZ4&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Asaml2-bearer&assertion=PEFzc...W9uPg%3D%3D
    The HTTP response:
    HTTP/1.1 200 OK
    Date: Thu, 27 Nov 2014 22:13:44 GMT
    Server: Apache
    ETag: "f5caac8abf77eeb7cff782242d8d0f31"
    Cache-Control: max-age=0, private, must-revalidate
    X-Request-Id: 54ffb30f21bf2258e0f1607b5124da08
    X-Runtime: 0.247811
    X-Rack-Cache: invalidate, pass
    Status: 200 OK
    Vary: Accept-Encoding
    Connection: close
    Content-Type: application/json; charset=utf-8
    Content-Length: 59
    {"access_token":"As3Uv...hVMswcBV"}
    Thanks,
    Bo

  • Verify signature on SAML assertion

    I've already asked this question on StackOverflow (http://stackoverflow.com/questions/25394137/verify-signature-on-saml-assertion), but I'm hoping to get a better response here. I'm trying to validate some SAML that looks like this:
    <samlp2:Response Destination="http://www.testhabaGoba.com" ID="ResponseId_934151edfe060ceec3067670c2f0f1ea" IssueInstant="2013-09-24T14:33:29.507Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp2="urn:oasis:names:tc:SAML:2.0:protocol">
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    </ds:Signature>
    <saml2:Assertion ID="SamlAssertion-05fd8af7f2c9972e69cdbca612d3f3b8" IssueInstant="2013-09-24T14:33:29.496Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    </ds:Signature>
    </saml2:Assertion>
    </samlp2:Response>
    The signature on the response always passes, but the signature on the assertion always fails. Even when I use a SAML that doesn't sign the response the assertion signature fails. Here's a condensed version of the code I'm using:
    foreach (XmlElement node in xmlDoc.SelectNodes("//*[local-name()='Signature']"))
    {// Verify this Signature block
    SignedXml signedXml = new SignedXml(node.ParentNode as XmlElement);
    signedXml.LoadXml(node);
    KeyInfoX509Data x509Data = signedXml.Signature.KeyInfo.OfType<KeyInfoX509Data>().First();
    // Verify certificate
    X509Certificate2 cert = x509Data.Certificates[0] as X509Certificate2;
    log.Info(string.Format("Cert s/n: {0}", cert.SerialNumber));
    VerifyX509Chain(cert);// Custom method
    // Check for approval
    X509Store store = new X509Store(StoreName.TrustedPublisher, StoreLocation.LocalMachine);
    store.Open(OpenFlags.ReadOnly);
    X509Certificate2Collection collection = store.Certificates.Find(X509FindType.FindBySerialNumber, cert.SerialNumber, true);
    Debug.Assert(collection.Count == 1);// Standing in for brevity
    // Verify signature
    signedXml.CheckSignature(cert, true);
    Everything works except the CheckSignature method. It's the only thing that fails and it always fails the SAML assertion. What am I doing wrong?

    Hello Matthew T. Ricks,
    Personally after reading your post I don't think this issue is related to this forum "Discuss and ask questions about the C# programming language, IDE, libraries, samples, and tools."
    The problem is due to SAML assertion fail and I read something like this
    http://docs.oracle.com/cd/E21455_01/common/tutorials/authn_saml_xml_sig.html to konw what is SAML and how it works. I will recommend you consult SAML related forum to ask this question.
    Regards,
    Barry
    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click
    HERE to participate the survey.

  • Help regarding SAML Assertion

    Can any one tell me what SAML assertion is all about?? and I just want to try out sample steps pertaining to SAML assertion in my policy editor.
    So Can any one of you kindly tell me a simple use case that you have tried out with SAML assertion. In the sense what all steps are to be added in the request pipeline ... and what are the configuration points in each step....
    I am stuck up with this usecase.
    Can any one of you owsm gurus can teach me with this...
    and at the same time can you guys suggest to me a sample document where I can get a usecase pertaining to SAML Assertion and WS-Security

    Thanks for your prompt reply Yogesh. I have created the keystore using the keytool utility. (say keystore location=C:\helloworld.jks and keystorepassword=welcome1)This is what the password that I created.
    Firstly,
    Creating keystore: I have used the commad some thing like;
    C:\>keytool -v -genkey -keyalg RSA -keysize 1024 -keystore owsm_client -storepas
    s clientpass -alias client -keypass client
    What is your first and last name?
    [Unknown]: manoj
    What is the name of your organizational unit?
    [Unknown]: ebi
    What is the name of your organization?
    [Unknown]: wipro
    What is the name of your City or Locality?
    [Unknown]: bangalore
    What is the name of your State or Province?
    [Unknown]: karnataka
    What is the two-letter country code for this unit?
    [Unknown]: IN
    Is CN="manoj ", OU=ebi, O=wipro, L=bangalore, ST=karnataka, C=IN correct?
    [no]:
    Is CN="manoj ", OU=ebi, O=wipro, L=bangalore, ST=karnataka, C=IN correct?
    [no]:
    What is your first and last name?
    [manoj ]: manoj
    What is the name of your organizational unit?
    [ebi]: ebi
    What is the name of your organization?
    [wipro]: wipro
    What is the name of your City or Locality?
    [bangalore]: bangalore
    What is the name of your State or Province?
    [karnataka]: karnataka
    What is the two-letter country code for this unit?
    [IN]: IN
    Is CN=manoj, OU=ebi, O=wipro, L=bangalore, ST=karnataka, C=IN correct?
    [no]: yes
    Generating 1,024 bit RSA key pair and self-signed certificate (MD5WithRSA)
    for: CN=manoj, OU=ebi, O=wipro, L=bangalore, ST=karnataka, C=IN
    [Storing owsm_client]
    C:\>keytool -keystore Helloworld.jks -genkey -keyalg RSA -alias Helloworld -dnam
    e "cn=IN, ou=ebi, o=wipro, L=bangalore, ST=karnataka"
    Enter keystore password: welcome1
    Enter key password for <Helloworld>
    (RETURN if same as keystore password): welcome1
    This is what I did. So I guess creation part of the keystore is done.
    Now I ll tell you the steps that I have used:
    In my request pipeline (gateway):
    1>extract credentials
    2>file authenticate(against .htpasswd)
    3>insert saml token 1.0 vouches
    (Key store location is specified above)a nd signature method was RSA-MD5)
    After this I committed the policy and then tried to test my page.
    The fault that it was throwing was: FAULT MESSAGE: Signing error:FAULT CODE: InvalidSecurity FAULT MESSAGE: Signature key not found
    can you please tell me why is the signature key not found despite of creating a java key store. Is is possible that the signature key is not found because of that certificate?
    can you please tell me what kind of certificate that I should take from verisign SSL test certificate or anything else.
    I hope you would revert to me as soon as possible and could you kindly send me the link where I might get that test certificate.
    I do have some doubts in policy editor options:
    what does that "assertion issuer " do
    what is that "subject format" (I made it as unspecified. If so how do I send that format)
    what does this do User Attributes for attribute statements string[]
    what does this do Corresponding namespace URIs for the user attributes string[]
    ----------------------------------------------------------------------------------------------------------------------- I am thinking of a scenario something like this.
    In the test page I ll be sending the request
    The policy manager of the gateway intercepts and does the following:
    1)it ll extract credentials(based on standard user name and token(WS-Basic))
    2)It authenticates the user against a file(.htpasswd)
    3)upon successful authentication,the next step would be Inserting saml token1.0 sender's vouches)step
    This ends the gateway part.........
    The request is then passed to the webservice and the request is intercepted by the serveragent before sending the request to the webservice.
    The serveragent does the following:
    3)verifies saml token that is created by the gateway before and upon successful verification it sends the request to the webservice.
    So I think (correct me if I am wrong) I need to make the policies in the request pipelines of the gateway and the serveragent. I don't want to lay any policy on the response message as of now.
    Could you tell me if this scenario works fine with owsm?
    could you tell me what is that keystore doing for me?
    Hope you would do the needful and revert to me as soon as possible
    Thanks and regards
    Mahes

  • Static values in SAML assertion

    In Saml 1.0, will it be possible to include static values in SAML assertion?

    These are two different queries. The static list:
    select * from tab_1 where
    (col_1) in (1,2,3) means return all rows where COL_1 = 1 or COL_1 = 2 or COL_1 = 3. The syntax only allows one column as the argument in this sort of IN.
    The variable list:
    select * from tab_1 where
    (col_1,col_2) in (select col_1,col_2 from tab_2)means return all rows where TAB_1.COL_1 = TAB_2.COL_1 and TAB_1.COL_2 = TAB_2.COL_2. In this case the number on arguments on the left hand side of the IN must match the number of arguments on the righthand side of the argument.
    In other words this is not valid syntax either: select * from tab_1 where
    (col_1,col_2) in (select col_1 from tab_2)If you want to test two columns against a static list you need separate clauses for each of them.
    You may find the documentation helpful.
    expression lists: http://download-west.oracle.com/docs/cd/B10501_01/server.920/a96540/expressions14a.htm#1029285
    membership conditions: http://download-west.oracle.com/docs/cd/B10501_01/server.920/a96540/conditions5a.htm#1013449
    Cheers, APC

  • How to get SAMl assertion from SOAP Header and propagate user context to BW

    Hello to all,
    we implemented this scenario:
    3rdparty System to SAP PI 7.11 to SAP BW.
    sync. communication via SOAP Sender adapter and Receiver XI PROXY.
    We get a SAMl assertion in the SOAP Header from the 3rd-Party System.
    The SAP BW System could not read the Header information.
    How can we get the information of the SOAP Header in the PI System and send the usercontext via XI Proxy to the SAP BW system?
    Can we read the Header information in the SOAP adapter and mapping it to another field in the payload or Headerinformation which could read in the backend system in the proxy class?
    Thanks for your help and regards
    Martin

    Dear Fox,
    Thanks for your reply.
    Is it mandatory to have the Header elements and the message defined in the Mediator wsdl?
    At present I have not defined it in the WSDL.
    Thanks,
    Subin

  • SAML assertion.

    Hi Folks,
    I needed your expert advice here related to the OWSM error in the SOA log:
    Caused by: FAULT CODE: InvalidSecurityToken FAULT MESSAGE: Found invalid condition "not before" in SAML assertion. Current Time:Fri Feb 22 06:59:18 EST 2013, clockSkew:360000 milli seconds, NotBefore Time:Fri Feb 22 07:12:29 EST 2013
    My test SOA server on Windows based box is integrated correctly into the Oracle Fusion Apps. The tasks in my SOA server need to be seen on Oracle Fusion Apps Worklist, but due to clockSkew the above error is hit. Could you please advise a resolution? I tried Windows "net time" command to time sync my server time with that of the Fusion Apps server. But, that did not work as it was a Linux box.
    SOA log trace:
    [2013-02-22T06:55:19.363-05:00] [soa_server1] [ERROR] [OWS-04115] [oracle.webservices.service] [tid: [ACTIVE].ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 004p^wCfGg29xWGpIwP5if0006SK000H4B,1:23756:2:1] [APP: soa-infra] [URI: /homePage/faces/AtkHomePageWelcome] An error occurred for port: {http://xmlns.oracle.com/bpel/workflow/taskQueryService}TaskQueryServicePort: oracle.fabric.common.PolicyEnforcementException: InvalidSecurity : error in processing the WS-Security security header.
    [2013-02-22T06:59:18.613-05:00] [soa_server1] [ERROR] [WSM-07618] [oracle.wsm.resources.enforcement] [tid: [ACTIVE].ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 004p^wQwJi29xWGpIwP5if0006SK000GFk,1:23758:3:1] [WSM_POLICY_NAME: oracle/wss_saml_or_username_token_service_policy] [WEBSERVICE_PORT.name: TaskQueryServicePort] [APP: soa-infra] [J2EE_MODULE.name: integration/services/TaskQueryService] [WEBSERVICE.name: TaskQueryService] [J2EE_APP.name: soa-infra] [URI: /homePage/faces/AtkHomePageWelcome] Failed to execute the assertion "WSSecurity SAML Token" in the conditional policy. InvalidSecurityToken : The security token is not valid.[[
    oracle.wsm.common.sdk.WSMException: InvalidSecurityToken : The security token is not valid.
         at oracle.wsm.security.policy.scenario.executor.Wss10SamlTokenScenarioExecutor.receiveRequest(Wss10SamlTokenScenarioExecutor.java:156)
         at oracle.wsm.security.policy.scenario.executor.SecurityScenarioExecutor.execute(SecurityScenarioExecutor.java:562)
         at oracle.wsm.policyengine.impl.runtime.AssertionExecutor.execute(AssertionExecutor.java:41)
         at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeSimpleAssertion(WSPolicyRuntimeExecutor.java:669)
         at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeXorAssertion(WSPolicyRuntimeExecutor.java:480)
         at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeAndAssertion(WSPolicyRuntimeExecutor.java:340)
         at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.execute(WSPolicyRuntimeExecutor.java:294)
         at oracle.wsm.policyengine.impl.PolicyExecutionEngine.execute(PolicyExecutionEngine.java:102)
         at oracle.wsm.agent.WSMAgent.processCommon(WSMAgent.java:1001)
         at oracle.wsm.agent.WSMAgent.processRequest(WSMAgent.java:470)
         at oracle.fabric.common.BindingSecurityInterceptor.processRequest(BindingSecurityInterceptor.java:94)
         at oracle.integration.platform.common.InterceptorChainImpl.processRequest(InterceptorChainImpl.java:128)
         at oracle.integration.platform.common.mgmt.InterceptorChainManager.processRequest(InterceptorChainManager.java:276)
         at oracle.j2ee.ws.server.mgmt.runtime.SuperServerInterceptorPipeline.handleRequest(SuperServerInterceptorPipeline.java:165)
         at oracle.j2ee.ws.server.provider.management.AbstractProviderInterceptorPipeline.executeRequestInterceptorChain(AbstractProviderInterceptorPipeline.java:576)
         at oracle.j2ee.ws.server.provider.ProviderProcessor.executeInterceptorRequestChain(ProviderProcessor.java:921)
         at oracle.j2ee.ws.server.WebServiceProcessor.processRequest(WebServiceProcessor.java:231)
         at oracle.j2ee.ws.server.WebServiceProcessor.doService(WebServiceProcessor.java:193)
         at oracle.j2ee.ws.server.WebServiceServlet.doPost(WebServiceServlet.java:485)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
         at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
         at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
         at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:301)
         at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
         at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
         at oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119)
         at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:315)
         at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:442)
         at oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:103)
         at oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:171)
         at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
         at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
         at oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:139)
         at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
         at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3730)
         at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3696)
         at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
         at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
         at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2273)
         at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2179)
         at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1490)
         at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
         at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
    Caused by: oracle.wsm.security.SecurityException: WSM-00008 : Web service authentication failed.
         at oracle.wsm.security.jps.JpsManager.authenticate(JpsManager.java:240)
         at oracle.wsm.security.jps.JpsManager.samlAuthenticate(JpsManager.java:377)
         at oracle.wsm.security.policy.scenario.processor.WssSaml11TokenProcessor.authenticateSamlToken(WssSaml11TokenProcessor.java:313)
         at oracle.wsm.security.policy.scenario.processor.WssSaml11TokenProcessor.authenticate(WssSaml11TokenProcessor.java:221)
         at oracle.wsm.security.policy.scenario.processor.WssSamlTokenProcessor.verify(WssSamlTokenProcessor.java:598)
         at oracle.wsm.security.policy.scenario.processor.WssSamlTokenProcessor.verify(WssSamlTokenProcessor.java:572)
         at oracle.wsm.security.policy.scenario.executor.Wss10SamlTokenScenarioExecutor.receiveRequest(Wss10SamlTokenScenarioExecutor.java:137)
         ... 43 more
    Caused by: javax.security.auth.login.LoginException
         at oracle.security.jps.internal.jaas.module.saml.JpsAbstractSAMLLoginModule.login(JpsAbstractSAMLLoginModule.java:122)
         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
         at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
         at java.lang.reflect.Method.invoke(Method.java:597)
         at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
         at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
         at javax.security.auth.login.LoginContext$5.run(LoginContext.java:706)
         at javax.security.auth.login.LoginContext.invokeCreatorPriv(LoginContext.java:703)
         at javax.security.auth.login.LoginContext.login(LoginContext.java:575)
         at oracle.wsm.security.jps.JpsManager.authenticate(JpsManager.java:235)
         ... 49 more
    Caused by: FAULT CODE: InvalidSecurityToken FAULT MESSAGE: Found invalid condition "not before" in SAML assertion. Current Time:Fri Feb 22 06:59:18 EST 2013, clockSkew:360000 milli seconds, NotBefore Time:Fri Feb 22 07:12:29 EST 2013.
         at oracle.security.jps.internal.jaas.module.saml.SAMLUtils.verifyNotBefore(SAMLUtils.java:92)
         at oracle.security.jps.internal.jaas.module.saml.JpsSAMLVerifier.verifyConditions(JpsSAMLVerifier.java:223)
         at oracle.security.jps.internal.jaas.module.saml.JpsSAMLVerifier.verify(JpsSAMLVerifier.java:124)
         at oracle.security.jps.internal.jaas.module.saml.JpsSamlAssertor.verify(JpsSamlAssertor.java:90)
         at oracle.security.jps.internal.jaas.module.saml.JpsSamlAssertor.assertToken(JpsSamlAssertor.java:67)
         at oracle.security.jps.internal.jaas.module.saml.JpsAbstractSAMLLoginModule.login(JpsAbstractSAMLLoginModule.java:102)
         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
         at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
         at java.lang.reflect.Method.invoke(Method.java:597)
         at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
         at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
         at javax.security.auth.login.LoginContext$5.run(LoginContext.java:707)
         at javax.security.auth.login.LoginContext.invokeCreatorPriv(LoginContext.java:703)
         at javax.security.auth.login.LoginContext.login(LoginContext.java:575)
         at oracle.wsm.security.jps.JpsManager.authenticate(JpsManager.java:235)
         at oracle.wsm.security.jps.JpsManager.samlAuthenticate(JpsManager.java:377)
         at oracle.wsm.security.policy.scenario.processor.WssSaml11TokenProcessor.authenticateSamlToken(WssSaml11TokenProcessor.java:313)
         at oracle.wsm.security.policy.scenario.processor.WssSaml11TokenProcessor.authenticate(WssSaml11TokenProcessor.java:224)
         at oracle.wsm.security.policy.scenario.processor.WssSamlTokenProcessor.verify(WssSamlTokenProcessor.java:598)
         at oracle.wsm.security.policy.scenario.processor.WssSamlTokenProcessor.verify(WssSamlTokenProcessor.java:574)
         at oracle.wsm.security.policy.scenario.executor.Wss10SamlTokenScenarioExecutor.receiveRequest(Wss10SamlTokenScenarioExecutor.java:141)
         at oracle.wsm.security.policy.scenario.executor.SecurityScenarioExecutor.execute(SecurityScenarioExecutor.java:562)
         at oracle.wsm.policyengine.impl.runtime.AssertionExecutor.execute(AssertionExecutor.java:41)
         at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeSimpleAssertion(WSPolicyRuntimeExecutor.java:669)
         at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeXorAssertion(WSPolicyRuntimeExecutor.java:480)
         at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeAndAssertion(WSPolicyRuntimeExecutor.java:340)
         at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.execute(WSPolicyRuntimeExecutor.java:295)
         at oracle.wsm.policyengine.impl.PolicyExecutionEngine.execute(PolicyExecutionEngine.java:102)
         at oracle.wsm.agent.WSMAgent.processCommon(WSMAgent.java:1001)
         at oracle.wsm.agent.WSMAgent.processRequest(WSMAgent.java:470)
         at oracle.fabric.common.BindingSecurityInterceptor.processRequest(BindingSecurityInterceptor.java:94)
         at oracle.integration.platform.common.InterceptorChainImpl.processRequest(InterceptorChainImpl.java:128)
         at oracle.integration.platform.common.mgmt.InterceptorChainManager.processRequest(InterceptorChainManager.java:276)
         at oracle.j2ee.ws.server.mgmt.runtime.SuperServerInterceptorPipeline.handleRequest(SuperServerInterceptorPipeline.java:165)
         at oracle.j2ee.ws.server.provider.management.AbstractProviderInterceptorPipeline.executeRequestInterceptorChain(AbstractProviderInterceptorPipeline.java:576)
         at oracle.j2ee.ws.server.provider.ProviderProcessor.executeInterceptorRequestChain(ProviderProcessor.java:921)
         at oracle.j2ee.ws.server.WebServiceProcessor.processRequest(WebServiceProcessor.java:232)
         at oracle.j2ee.ws.server.WebServiceProcessor.doService(WebServiceProcessor.java:194)
         at oracle.j2ee.ws.server.WebServiceServlet.doPost(WebServiceServlet.java:485)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:821)
         at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
         at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
         at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:301)
         at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:27)
         at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:57)
         at oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119)
         at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:315)
         at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:442)
         at oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:103)
         at oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:171)
         at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
         at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:57)
         at oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:139)
         at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:57)
         ... 9 more
    [2013-02-22T06:59:18.613-05:00] [soa_server1] [ERROR] [WSM-07618] [oracle.wsm.resources.enforcement] [tid: [ACTIVE].ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 004p^wQwJi29xWGpIwP5if0006SK000GFk,1:23758:3:1] [WSM_POLICY_NAME: oracle/wss_saml_or_username_token_service_policy] [WEBSERVICE_PORT.name: TaskQueryServicePort] [APP: soa-infra] [J2EE_MODULE.name: integration/services/TaskQueryService] [WEBSERVICE.name: TaskQueryService] [J2EE_APP.name: soa-infra] [URI: /homePage/faces/AtkHomePageWelcome] Failed to execute the assertion "WSSecurity UserName Token" in the conditional policy. InvalidSecurity : error in processing the WS-Security security header[[
    oracle.wsm.common.sdk.WSMException: InvalidSecurity : error in processing the WS-Security security header
         at oracle.wsm.security.policy.scenario.executor.WssUsernameTokenScenarioExecutor.receiveRequest(WssUsernameTokenScenarioExecutor.java:197)
         at oracle.wsm.security.policy.scenario.executor.SecurityScenarioExecutor.execute(SecurityScenarioExecutor.java:562)
         at oracle.wsm.policyengine.impl.runtime.AssertionExecutor.execute(AssertionExecutor.java:41)
         at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeSimpleAssertion(WSPolicyRuntimeExecutor.java:669)
         at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeXorAssertion(WSPolicyRuntimeExecutor.java:480)
         at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeAndAssertion(WSPolicyRuntimeExecutor.java:340)
         at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.execute(WSPolicyRuntimeExecutor.java:294)
         at oracle.wsm.policyengine.impl.PolicyExecutionEngine.execute(PolicyExecutionEngine.java:102)
         at oracle.wsm.agent.WSMAgent.processCommon(WSMAgent.java:1001)
         at oracle.wsm.agent.WSMAgent.processRequest(WSMAgent.java:470)
         at oracle.fabric.common.BindingSecurityInterceptor.processRequest(BindingSecurityInterceptor.java:94)
         at oracle.integration.platform.common.InterceptorChainImpl.processRequest(InterceptorChainImpl.java:128)
         at oracle.integration.platform.common.mgmt.InterceptorChainManager.processRequest(InterceptorChainManager.java:276)
         at oracle.j2ee.ws.server.mgmt.runtime.SuperServerInterceptorPipeline.handleRequest(SuperServerInterceptorPipeline.java:165)
         at oracle.j2ee.ws.server.provider.management.AbstractProviderInterceptorPipeline.executeRequestInterceptorChain(AbstractProviderInterceptorPipeline.java:576)
         at oracle.j2ee.ws.server.provider.ProviderProcessor.executeInterceptorRequestChain(ProviderProcessor.java:921)
         at oracle.j2ee.ws.server.WebServiceProcessor.processRequest(WebServiceProcessor.java:231)
         at oracle.j2ee.ws.server.WebServiceProcessor.doService(WebServiceProcessor.java:193)
         at oracle.j2ee.ws.server.WebServiceServlet.doPost(WebServiceServlet.java:485)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
         at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
         at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
         at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:301)
         at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
         at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
         at oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119)
         at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:315)
         at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:442)
         at oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:103)
         at oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:171)
         at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
         at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
         at oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:139)
         at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
         at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3730)
         at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3696)
         at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
         at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
         at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2273)
         at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2179)
         at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1490)
         at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
         at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
    Caused by: oracle.wsm.security.SecurityException: WSM-00265 : The Username token is missing in the security header. Ensure that there is a Username token policy attached on the client side. Tokens found in the security header are :- [(saml:Assertion), ].
         at oracle.wsm.security.policy.scenario.processor.UsernameTokenProcessor.verify(UsernameTokenProcessor.java:241)
         at oracle.wsm.security.policy.scenario.executor.WssUsernameTokenScenarioExecutor.receiveRequest(WssUsernameTokenScenarioExecutor.java:129)
         ... 43 more
    [2013-02-22T06:59:18.613-05:00] [soa_server1] [ERROR] [WSM-07602] [oracle.wsm.resources.enforcement] [tid: [ACTIVE].ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 004p^wQwJi29xWGpIwP5if0006SK000GFk,1:23758:3:1] [WSM_POLICY_NAME: oracle/wss_saml_or_username_token_service_policy] [WEBSERVICE_PORT.name: TaskQueryServicePort] [APP: soa-infra] [J2EE_MODULE.name: integration/services/TaskQueryService] [WEBSERVICE.name: TaskQueryService] [J2EE_APP.name: soa-infra] [URI: /homePage/faces/AtkHomePageWelcome] Failure in WS-Policy Execution due to exception.
    [2013-02-22T06:59:18.613-05:00] [soa_server1] [ERROR] [WSM-07501] [oracle.wsm.resources.enforcement] [tid: [ACTIVE].ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 004p^wQwJi29xWGpIwP5if0006SK000GFk,1:23758:3:1] [WSM_POLICY_NAME: oracle/wss_saml_or_username_token_service_policy] [WEBSERVICE_PORT.name: TaskQueryServicePort] [APP: soa-infra] [J2EE_MODULE.name: integration/services/TaskQueryService] [WEBSERVICE.name: TaskQueryService] [J2EE_APP.name: soa-infra] [URI: /homePage/faces/AtkHomePageWelcome] Failure in Oracle WSM Agent processRequest, category=security, function=agent.function.service, application=soa-infra, composite=null, modelObj=TaskQueryService, policy=oracle/wss_saml_or_username_token_service_policy, policyVersion=null, assertionName={http://schemas.oracle.com/ws/2006/01/securitypolicy}wss-username-token.

    we got the update and this has been resolved as we have installed weblogic 10.

  • Problem with signed SAML assertion and Web Services Manager

    Folks,
    I’m having some issues trying to generate a proper signed SAML assertion using JDeveloper 10.1.3. I am securing a java proxy class using the wizard as described in http://www.oracle.com/technology/products/jdev/howtos/1013/wssecure/10gwssecurity_howto.html .
    On the OWSM side, I have a service that I am securing with SAML - Verify WSS 1.0 Token. If I set the "Allow signed assertions only" property to false I can complete the service call. However, when it is set to true I am receiving the following fault: javax.xml.rpc.soap.SOAPFaultException: SAML token verification failed.
    When I examine the message going to OWSM in a packet analyzer, it is missing the signature in the SAML assertion. The <saml:Assertion> tags looks like:
          <saml:Assertion MajorVersion="1" MinorVersion="1"
                          xmlns="urn:oasis:names:tc:SAML:1.0:assertion"
                          xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
                          AssertionID="yM0oqZgF0N1a1td6yzKgOQ22"
                          IssueInstant="2007-01-23T17:15:27Z"
                          Issuer="HealthMarkets_s3">
            <saml:Conditions NotBefore="2007-01-23T17:15:27Z"
                             NotOnOrAfter="2007-01-24T17:15:27Z"/>
            <saml:AuthenticationStatement AuthenticationInstant="2007-01-23T17:15:27Z"
                                          AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password">
              <saml:Subject>
                <saml:NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">client_s3</saml:NameIdentifier>
                <saml:SubjectConfirmation>
                  <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:sender-vouches</saml:ConfirmationMethod>
                </saml:SubjectConfirmation>
              </saml:Subject>
            </saml:AuthenticationStatement>
          </saml:AssertionI have selected the Sign Outbound Messages in step 3 of the Secure Web Proxy Wizard. This step uses the DSA-SHA1 algorithm.
    Any help is greatly appreciated.
    Thanks in advance,
    Joseph

    Thanks for the response. I am not using any pages for this application yet... just calling the web service from SOAP UI or any Web Service testing tool causes the problem.
    All that has to be done to replicate it is to build a simple EJB 3.0 JPA bean using the entities from tables wizard and then add named query as follows:
    @NamedQuery(name = "BomHeader.findByDesc", query = "select o from BomHeader o where o.bomDesc like :p_bomDesc")
    then build a session bean with the wizard that includes the JPA persistence unit and the entity and subsequently use the wizard to wrap the session bean in a web service.
    The whole replication process should take 5 minutes if you have some database tables to work with. It breaks when the web service is called.
    Thanks in advance

  • SAML Assertion Producer APIs

    I'm implementing SSO in my servlet, and have fonud some example code using the SAML framework. But I can't find the class files I need, as they are not part of the standard Java libraries, as far as I can tell.
    What I need are the ones in com.sun.identity.saml; com.sun.identity.saml.SAMLClient, com.sun.identity.saml.common.SAMLException, com.sun.identity.saml.assertion.Assertion.
    Does anybody know where I can download these ?
    Thanks.

    Hi,
    Could you please send me the same code for SAML framework .
    my mail id is [email protected]
    Rgds,
    Raj

  • SAML assertion was used to sign a message, the verification of signature us

    CR325776, CR301621, CR331147
    When SAML assertion was used to sign a message, the verification of signature used to fail with NullPointerException.
    This problem has been resolved.
    We have 9.2 MP2 as our ALDSP weblogic server. Is there any way to do a smart Update from MP2 to MP3?
    Can it be done behind the proxy, ie., download the patch and install ?
    Our Unix server is Solaris. Please let us know.
    Thanks.

    we got the update and this has been resolved as we have installed weblogic 10.

  • OSB: Change SAML Assertions

    Hi,
    I've been looking for the configuration that changes the default time to live of SAML headers generated in OSB.
    I found that to change SAML issuer name, it is done in the oracle/wss10_saml20_token_client_policy in Enterprise Manager by changing the following:
    Property set: standard-security-properties
    Name: saml.issuer.name
    Value: www.oracle.com (change this)
    I thought there would also be a property set that changes SAML TTL. Found this document but no mention on TTL configuration
    http://docs.oracle.com/cd/E28271_01/web.1111/b32511/assertion_schema.htm#CHDEBGGF
    Moving on, found that it could be configured in SAML Credential Mapping Provider. Ironically, I've checked the WLS console and there was no SAML Credential Mapping Provider created in the weblogic server as documented below.
    http://docs.oracle.com/cd/E12840_01/wls/docs103/secmanage/providers.html#SAML_cred
    I'm suspecting it is configured elsewhere, but I could not find it. Could anyone please shed some lights?
    Below is the sample SAML header I've generated. The part I would like to change is TTL portion (NotOnOrAfter). Currently defaulted to 5 mins.
    <soapenv:Header>
    <wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
    <saml:Assertion Version="2.0" ID="SAML-Kr4iE8Cl6zzQKsiEjF64Hg22" IssueInstant="2012-06-07T12:01:02Z" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
    <saml:Issuer>www.oracle.com</saml:Issuer>
    <saml:Subject>
    <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">abc</saml:NameID>
    <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:sender-vouches"/>
    </saml:Subject>
    <saml:Conditions NotBefore="2012-06-07T12:01:02Z" NotOnOrAfter="2012-06-07T12:06:02Z"/>
    <saml:AuthnStatement AuthnInstant="2012-06-07T12:01:02Z">
    <saml:AuthnContext>
    <saml:AuthnContextClassRef>
    urn:oasis:names:tc:SAML:2.0:ac:classes:Password
    </saml:AuthnContextClassRef>
    </saml:AuthnContext>
    </saml:AuthnStatement>
    </saml:Assertion>
    </wsse:Security>
    </soapenv:Header>
    Thanks.

    I think this is parameter "agent.expire.time"
    look here:
    http://docs.oracle.com/cd/E14571_01/web.1111/b32511/managing.htm#BABHIFDD
    Edited by: AigarsP on Jun 8, 2012 2:01 AM

  • Problem with validating SAML assertion signature ("bad" certificate?)

    Hi,
    We've been developing and testing webservices and webservice clients under WebLogic for awhile. In our typical configuration, we have the SAML Credential mapper configured on the webservice client side, and the SAML Identity Asserter on the webservice side, and we are using "sender-vouches", whereby the SAML assertions are being signed by the SAML Credential mapper.
    Up through development, for the signing, we've been using certs issued by a test CA that we have, but now, we are moving to a pre-production environment, and we're required to use certs issued by a specific 3rd party CA. Since we've started using those new certs, we have been getting "token failed to validate" errors. We've been trying to diagnose this problem for awhile, and we're at the point that we believe that, for some reason, the certs that we got that were issued by the 3rd party CA are "bad".
    Specifically, those certs are SSL Server certs, with the following characteristics:
    Usages:
    Digital Signature
    Key Encipherment
    Key Agreement
    Netscape Type: SSL Server Authentication
    but, they also have two "extended usage extension" OIDs, both are "2.16.840.1.101.2.x.yy.zz".
    When we looked at the certs using various tools, e.g., "openssl x509...", etc., those extended usage extensions are being displayed as "unknown", which made us a littel suspicious about them, so I setup a simple test configuration with two WebLogic 10.0 MP1 instances.
    For testing, we first used a cert from the 3rd party CA, which gave us the "failed to validate token" errors.
    During this testing, we put a sniffer on the line, and captured the SOAP message with the signed SAML assertion, and we used a small Java app that I wrote awhile ago that will validate a digital signature. When we ran that Java app, the digital signature validated successfully (i.e., the digital signature was GOOD).
    This seems to imply that the "failed to validate token signature" errors are happening because of something other than the digital signature being incorrect.
    So, then, we created a certificate that matches the 3rd party CA certs almost exactly, except that we did not include the two extended usage extensions, and we configured the two WebLogic instances to use this new certificate.
    When we tested with the new certificate, we no longer got the errors.
    So, it appears that when the cert has those two enhanced usage extensions, WebLogic is either not willing to, or not able to, utilize the certs for validating digital signatures.
    Does anyone have any insight into this problem, or has anyone encountered a problem like this before?
    I also was wondering if there are any parameters for WebLogic that we might try to set that would tell WebLogic to perhaps ignore the certificate extensions and to just do the digital signature validation?
    Thanks,
    Jim

    Hi,
    FYI, we were able to resolve this problem today. It turned out to be that the certificate and key were not "matched".
    The way that we figured this out was to use openssl and the procedure here:
    http://kb.wisc.edu/middleware/page.php?id=4064
    which showed the mismatch.
    We've since generated a new cert request and got a new certificate, and it's working now.
    Jim

  • Problem signing SAML assertion

    Folks,
    I’m having some issues trying to generate a proper signed SAML assertion using JDeveloper 10.1.3. I am securing a java proxy class using the wizard as described in http://www.oracle.com/technology/products/jdev/howtos/1013/wssecure/10gwssecurity_howto.html .
    On the OWSM side, I have a service that I am securing with SAML - Verify WSS 1.0 Token. If I set the "Allow signed assertions only" property to false I can complete the service call. However, when it is set to true I am receiving the following fault:
    javax.xml.rpc.soap.SOAPFaultException: SAML token verification failed.
    When I examine the message going to OWSM in a packet analyzer, it is missing the signature in the SAML assertion. The <saml:Assertion> tags looks like:
          <saml:Assertion MajorVersion="1" MinorVersion="1"
                          xmlns="urn:oasis:names:tc:SAML:1.0:assertion"
                          xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
                          AssertionID="yM0oqZgF0N1a1td6yzKgOQ22"
                          IssueInstant="2007-01-23T17:15:27Z"
                          Issuer="HealthMarkets_s3">
            <saml:Conditions NotBefore="2007-01-23T17:15:27Z"
                             NotOnOrAfter="2007-01-24T17:15:27Z"/>
            <saml:AuthenticationStatement AuthenticationInstant="2007-01-23T17:15:27Z"
                                          AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password">
              <saml:Subject>
                <saml:NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">client_s3</saml:NameIdentifier>
                <saml:SubjectConfirmation>
                  <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:sender-vouches</saml:ConfirmationMethod>
                </saml:SubjectConfirmation>
              </saml:Subject>
            </saml:AuthenticationStatement>
          </saml:Assertion>I have selected the Sign Outbound Messages in step 3 of the Secure Web Proxy Wizard. This step uses the DSA-SHA1 algorithm.
    Any help is greatly appreciated.
    Thanks in advance,
    Joseph

    I do believe that JDev will produce a deployment descriptor that contains the WS-Security policy information. Can you post this? It should look something like this:
    <oracle-webservice-clients>
    <webservice-client>
    <saml-token>
    <signature-methods>RSA-SHA1</signature-methods>
    </saml-token>
    </webservice-client>
    </oracle-webservice-clients>

Maybe you are looking for

  • ReturnToPortal Page not returning correctly

    Have a narrow portlet which searches a database returning records using form post: <form name="filter" method="post" action="display.jsp">....</form> This works fine, opening a new page, single column, wide in the portal displaying the results. This

  • Erasing Mac Mail Sent messages

    As a customer of Earthlink, I use Mac Mail for e-mail. I have over 300 messages in my Sent box and would like to get rid of most of them, but that action seems to be blocked by one large file I sent recently that does not allow me to trash it and kee

  • Interfaces declare methods that one or more classes may or may not implemen

    Interfaces declare methods that one or more classes may or may not implement. true or false?

  • Moving Subtitle clips in the timeline

    I want to select all of the clips in one subtitle stream and slide them up in time by 1 sec. I'm sure it's simple but the obvious Shift-click or Command-click doesn't get it. Thanks.

  • FXO/FXS IOS COMMAND ISSUES

    Hello, I've got 2 1760 routers with each a VIC2-4FX0 and VIC-FXS/DID cards. I've got 128mb of system RAM in them, running IOS c1700-advsecurityk9-mz.124-3.bin, which is supposed to be a voice ios with advanced feat. pack according to Cisco's website.