OWSM :: Unable to satisfy WSSE Basic Authentication

Question

Hi,
I have dowloaded & installed the Oracle SOA Suite 10.1.3.1.0. I conveniently wrote a simple Java Web Service using Oracle JDeveloper 10.1.3 & protected the Web Service with Oracle Web Services Manager.
I have created a policy in Oracle Web Services Manager to extract the WSSE-Basic UserName and Password from the incoming SOAP Request & validate it with the credentials stored in a file.
The contents of the file are :-
<FONT COLOR="GREEN">
oc4jadmin:{MD5}dUrDMlp/g1vXtP2Z+Fwl/w==
</FONT>The request that I am sending to OWNSM ( handcrafted in SOAPSonar ) is :-
<FONT COLOR="BLUE">
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<soap:Header>
     <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" soap:mustUnderstand="1">
          <wsse:UsernameToken xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
               <wsse:Username>oc4jadmin</wsse:Username>
               <wsse:Password>{MD5}dUrDMlp/g1vXtP2Z+Fwl/w==</wsse:Password>
          </wsse:UsernameToken>
     </wsse:Security>
</soap:Header>
    <soap:Body xmlns:ns1="http://com/oracle/ws/usf/WsUSF.wsdl/types/">
        <ns1:procGetSsnElement>
            <ns1:pMasterid>1</ns1:pMasterid>
            <ns1:pLastname>1</ns1:pLastname>
            <ns1:pFirstname>1</ns1:pFirstname>
            <ns1:pDob>2003-12-12T00:00:00Z</ns1:pDob>
            <ns1:pSystemcode>1</ns1:pSystemcode>
        </ns1:procGetSsnElement>
    </soap:Body>
</soap:Envelope>
</FONT>However, the response that I keep getting from OWSM is :-
<FONT COLOR="RED">
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
  <SOAP-ENV:Body>
    <SOAP-ENV:Fault>
      <faultcode xmlns:p="http://schemas.oblix.com/ws/2003/08/Faults">p:Client.AuthenticationFault</faultcode>
      <faultstring>Invalid username or password</faultstring>
      <detail>
      </detail>
    </SOAP-ENV:Fault>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>
</FONT>I am not sure how to pass on the credentials using WSSE to OWSM. If I can get that right, I can craft the same request using the PL/SQL & move ahead with the actual business logic.
Can you guys please help me with this ?
Regards,
Sandeep

Answer 1

Hi Sandeep,
I do not have extensive experience with WSS, but the error message let me believe that there is something wrong with the value for the password, as the server replies with 'Inlavid' in the fault string.
When using WSS with oc4j 10.1.3.1, once you ask to use digest value for the password, you are also required to send two extra pieces of informations in the security header: a nonce and a timestamp.
Last, make sure that you don't send the {MD5} in the password element - this is most likely a hint from SOAPSonar.
Here is a sample of a soap payload generated from JDev 10.1.3.1 for a service secured on the oc4j (not exactly OWSM).
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ns0="http://TrailerInfo/" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
   <env:Header>
      <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" env:mustUnderstand="1">
         <wsse:UsernameToken xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <wsse:Username>oc4jadmin</wsse:Username>
            <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">ljF6f2hQ+4xRsD+m2TggreumeUs=</wsse:Password>
            <wsse:Nonce>GeIj1ZlHh9Pxq4KZ+0E9Rw==</wsse:Nonce>
            <wsu:Created ValueType="http://www.w3.org/2001/XMLSchema/dateTime">2007-03-27T15:29:17Z</wsu:Created>
         </wsse:UsernameToken>
      </wsse:Security>
   </env:Header>
   <env:Body>Hope it helps,
-Eric