OSB 10gR3 - Process WS-Security flag not working with PasswordDigest

Question

Hi,
By Oracle documentation when you set the "process ws-security header" in security section of a proxy service, the proxy service act as an active intermediary and consume the ws-security header received in inbound messages. This feature works fine when you call the proxy service using WS-Security Username Token Profile PasswordText, but when you send Username Token with PasswordDigest I got the following error: +"weblogic.xml.crypto.wss.WSSecurityException: Unable to validate identity assertions"+
I am using SoapUi to call the proxy with passwordDigest, WSS-Password Type option set to PasswordDigest.
Proxy configured with:
General tab -> WSDL based proxy service, this wsdl doesn't have ws-policy definitions inside.
Transport tab -> Get all headers = Yes
HTTP Transport tab -> HTTPS Required = No / Authentication = Basic
Operation tab -> Enforce WS-I Compliance = not checked / Selection Algorithm = SOAP Body Type
Message Content tab -> default settings
Policy -> Added Auth.xml(predefined) policy to request policies.
Security tab -> Process WS-Security header = Yes / Custom Authentication settings = none
Error --->
+<01/12/2009 09h34min55s BRST> <Error> <OSB Security> <BEA-387022> <An error ocurred during web service security inbound request processing [error-code: Fault, message-id: 6198860737666014185--de42214.12549f82d66.-7fdb, proxy: AlphaTests/MyProxy/Proxy/MyLogProxy, operation: null]+
--- Error message:
+<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"><env:Header/><env:Body><env:Fault xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><faultcode>wsse:InvalidSecurity</faultcode>*<faultstring>Unable to validate identity assertions.</faultstring>*</env:Fault></env:Body></env:Envelope>+
weblogic.xml.crypto.wss.WSSecurityException: Unable to validate identity assertions.
+     at weblogic.wsee.security.wss.SecurityPolicyValidator.processIdentity(SecurityPolicyValidator.java:133)+
+     at weblogic.wsee.security.wss.SecurityPolicyValidator.processInbound(SecurityPolicyValidator.java:77)+
+     at weblogic.wsee.security.WssServerPolicyHandler.processInbound(WssServerPolicyHandler.java:54)+
+     at weblogic.wsee.security.WssServerPolicyHandler.processRequest(WssServerPolicyHandler.java:30)+
+     at weblogic.wsee.security.WssHandler.handleRequest(WssHandler.java:74)+
+     at com.bea.wli.sb.security.wss.WssInboundHandler.processRequest(WssInboundHandler.java:155)+
+     at com.bea.wli.sb.security.wss.WssHandlerImpl.doInboundRequest(WssHandlerImpl.java:201)+
+     at com.bea.wli.sb.context.BindingLayerImpl.addRequest(BindingLayerImpl.java:257)+
+     at com.bea.wli.sb.pipeline.MessageProcessor.processRequest(MessageProcessor.java:66)+
+     at com.bea.wli.sb.pipeline.RouterManager$1.run(RouterManager.java:508)+
+     at com.bea.wli.sb.pipeline.RouterManager$1.run(RouterManager.java:506)+
+     at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)+
+     at weblogic.security.service.SecurityManager.runAs(Unknown Source)+
+     at com.bea.wli.sb.security.WLSSecurityContextService.runAs(WLSSecurityContextService.java:55)+
+     at com.bea.wli.sb.pipeline.RouterManager.processMessage(RouterManager.java:505)+
+     at com.bea.wli.sb.transports.TransportManagerImpl.receiveMessage(TransportManagerImpl.java:371)+
+     at com.bea.wli.sb.transports.http.HttpTransportServlet$RequestHelper$1.run(HttpTransportServlet.java:279)+
+     at com.bea.wli.sb.transports.http.HttpTransportServlet$RequestHelper$1.run(HttpTransportServlet.java:277)+
+     at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)+
+     at weblogic.security.service.SecurityManager.runAs(Unknown Source)+
+     at com.bea.wli.sb.transports.http.HttpTransportServlet$RequestHelper.securedInvoke(HttpTransportServlet.java:276)+
+     at com.bea.wli.sb.transports.http.HttpTransportServlet$RequestHelper.service(HttpTransportServlet.java:237)+
+     at com.bea.wli.sb.transports.http.HttpTransportServlet.service(HttpTransportServlet.java:133)+
+     at weblogic.servlet.FutureResponseServlet.service(FutureResponseServlet.java:24)+
+     at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)+
+     at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)+
+     at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)+
+     at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:292)+
+     at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:175)+
+     at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3498)+
+     at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)+
+     at weblogic.security.service.SecurityManager.runAs(Unknown Source)+
+     at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2180)+
+     at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2086)+
+     at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1406)+
+     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)+
+     at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)+

Answer 1

Eduardo,
Yes, but the flag "Process WS-Security header" needs to be set to 'No' and I included a delete node to remove the wsse:Security element from header. Attaching Auth.xml predefined policy to my request operation, causes OSB to include the policy directive in my WSDL, but the PasswordText(see below).
In Oracle security guide we have steps to configure PasswordDigest in the Oracle Service Bus Security Configuration using the WLS Console http://download.oracle.com/docs/cd/E13159_01/osb/docs10gr3/security/model.html#wp1062542
My doubt is: Is this a bug? "Process WS-Security header" flag is supposed to work with PasswordDigest?
My WSDL with WS-Policy statements after Auth.xml policy was configured.
<?xml version="1.0" encoding="UTF-8"?>
<s2:definitions targetNamespace="http://alpha.tests.org" xmlns:s0="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:s1="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:s2="http://schemas.xmlsoap.org/wsdl/" xmlns:s3="http://alpha.tests.org" xmlns:s4="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
<s0:Policy s1:Id="encrypt-custom-body-element-and-username-token">
<wssp:Identity xmlns:wssp="http://www.bea.com/wls90/security/policy">
<wssp:SupportedTokens>
<wssp:SecurityToken TokenType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#UsernameToken">
<wssp:UsePassword Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"/>
</wssp:SecurityToken>
</wssp:SupportedTokens>
</wssp:Identity>
</s0:Policy>
<wsp:UsingPolicy s2:Required="true"/>
<s2:types>
<xsd:schema elementFormDefault="qualified" targetNamespace="http://alpha.tests.org" xmlns="http://www.w3.org/2001/XMLSchema" xmlns:impl="http://alpha.tests.org" xmlns:s0="http://schemas.xmlsoap.org/wsdl/" xmlns:s1="http://alpha.tests.org" xmlns:s2="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:wsdlsoap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<xsd:element name="EchoRequest">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="send" type="xsd:string"/>
</xsd:sequence>
</xsd:complexType>
</xsd:element>
<xsd:element name="EchoResponse">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="response" type="xsd:string"/>
</xsd:sequence>
</xsd:complexType>
</xsd:element>
</xsd:schema>
</s2:types>
<s2:message name="echoRequest">
<s2:part element="s3:EchoRequest" name="echoPartReq"/>
</s2:message>
<s2:message name="echoResponse">
<s2:part element="s3:EchoResponse" name="echoPartResp"/>
</s2:message>
<s2:portType name="MyAlphaPort">
<s2:operation name="echo">
<s2:input message="s3:echoRequest" name="echoRequest"/>
<s2:output message="s3:echoResponse" name="echoResponse"/>
</s2:operation>
</s2:portType>
<s2:binding name="MyAlphaBinding" type="s3:MyAlphaPort">
<s4:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
<s2:operation name="echo">
<s2:input name="echoRequest">
<s4:body use="literal"/>
<wsp:Policy>
<wsp:PolicyReference URI="#encrypt-custom-body-element-and-username-token"/>
</wsp:Policy>
</s2:input>
<s2:output name="echoResponse">
<s4:body use="literal"/>
</s2:output>
</s2:operation>
</s2:binding>
<s2:service name="MyAlphaBindingQSService">
<s2:port binding="s3:MyAlphaBinding" name="MyAlphaBindingQSPort">
<s4:address location="http://CLXSP0272:7001/MyAlphaService"/>
</s2:port>
</s2:service>
</s2:definitions>