SpacesWebService proxy security failure when deployed in weblogic server

Question

Hi all,
I plan to use the SPacesWebservice by creating a webservices proxy. A proxy client was created and I passed on appropriate security information.
public static void main(String[] args) {
try {
spacesWebService_Service = new SpacesWebService_Service();
SpacesWebService spacesWebService = spacesWebService_Service.getSpacesWebServiceSoapHttpPort();
Map<String, Object> requestContext = ((BindingProvider) spacesWebService).getRequestContext();
setPortCredentialProviderList(requestContext);
System.out.println(spacesWebService.getGroupSpaces(null));
// Add your code to call the desired methods.
} catch (Exception ex) {
ex.printStackTrace();
@Generated("Oracle JDeveloper")
public static void setPortCredentialProviderList(Map<String, Object> requestContext) throws Exception {
// TODO - Provide the required values
String username = "weblogic";
String password = "weblogic1";
String clientKeyStore = "C:\\default-keystore.jks";
String clientKeyStorePassword = "weblogic1";
String clientKeyAlias = "orakey";
String clientKeyPassword = "weblogic1";
String serverKeyStore = "C:\\default-keystore.jks";
String serverKeyStorePassword = "weblogic1";
String serverKeyAlias = "orakey";
List<CredentialProvider> credList = new ArrayList<CredentialProvider>();
// Add the necessary credential providers to the list
credList.add(getUNTCredentialProvider(username, password));
credList.add(getBSTCredentialProvider(clientKeyStore, clientKeyStorePassword, clientKeyAlias, clientKeyPassword, serverKeyStore, serverKeyStorePassword, serverKeyAlias, requestContext));
//credList.add(getSAMLTrustCredentialProvider());
requestContext.put(WSSecurityContext.CREDENTIAL_PROVIDER_LIST, credList);
When i run this client, just plain java, the client runs fine.
But additionally, I created the webservice proxy in a web application, and I try to use the proxy client to invoke the webservice. However, when I deploy the web application in weblogic server, and I try to touch the SpacesWebService methods using the client then I get the following errors :
Caused by: oracle.wsm.common.sdk.WSMException: FailedCheck : failure in security check
at oracle.wsm.security.policy.scenario.executor.Wss11UsernameWithCertsScenarioExecutor.receiveRequest(Wss11UsernameWithCertsScenarioExecutor.java:201)
at oracle.wsm.security.policy.scenario.executor.SecurityScenarioExecutor.execute(SecurityScenarioExecutor.java:596)
at oracle.wsm.policyengine.impl.runtime.AssertionExecutor.execute(AssertionExecutor.java:41)
at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeSimpleAssertion(WSPolicyRuntimeExecutor.java:666)
at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeXorAssertion(WSPolicyRuntimeExecutor.java:477)
at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeAndAssertion(WSPolicyRuntimeExecutor.java:336)
at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.execute(WSPolicyRuntimeExecutor.java:289)
at oracle.wsm.policyengine.impl.PolicyExecutionEngine.execute(PolicyExecutionEngine.java:102)
at oracle.wsm.agent.WSMAgent.processCommon(WSMAgent.java:975)
at oracle.wsm.agent.WSMAgent.processRequest(WSMAgent.java:460)
at oracle.fabric.common.BindingSecurityInterceptor.processRequest(BindingSecurityInterceptor.java:94)
... 46 more
Caused by: oracle.wsm.security.policy.scenario.policycompliance.PolicyComplianceException: WSM-00034 : Error in Encryption reference mechanism compliance : Expected : thumbprint , Actual : issuerserial. Ensure that a compatible policy is attached at the client side.
at oracle.wsm.security.policy.scenario.policycompliance.impl.ComplianceEngine.preDecryptionCompliance(ComplianceEngine.java:223)
at oracle.wsm.security.policy.scenario.policycompliance.impl.ComplianceEngine.checkCompliance(ComplianceEngine.java:385)
at oracle.wsm.security.policy.scenario.processor.Wss11X509TokenProcessor.verifyRequest(Wss11X509TokenProcessor.java:882)
at oracle.wsm.security.policy.scenario.processor.Wss11X509TokenProcessor.verify(Wss11X509TokenProcessor.java:844)
at oracle.wsm.security.policy.scenario.processor.Wss11X509TokenProcessor.verify(Wss11X509TokenProcessor.java:808)
at oracle.wsm.security.policy.scenario.executor.Wss11UsernameWithCertsScenarioExecutor.receiveRequest(Wss11UsernameWithCertsScenarioExecutor.java:134)
... 56 more
Does anyone know why authentication is not happening only in the webapp ? (Note: the weblogic server is in the same machine. So the path to the keystore is valid)
Edited by: user9138987 on Aug 21, 2011 3:04 PM

Answer 1

The keystore is created using the following commands and the default-keystore is assigned to the weblogic domain
keytool -genkeypair -keyalg RSA -dname "cn=spaces,dc=example,dc=com" -alias orakey -keypass weblogic1 -keystore default-keystore.jks -storepass welcome1 -validity 1064
keytool -exportcert -v -alias orakey -keystore default-keystore.jks -storepass weblogic1 -rfc -file orakey.cer
keytool -importcert -alias webcenter_spaces_ws -file orakey.cer -keystore default-keystore.jks -storepass weblogic1