WS-Policy Confidentiality Element Question

Question

I have a Web service that requires WS-Security encryption and signing for parts of the request and encrypts and signs parts of the response. I am attempting to create a proxy to invoke that back-end WS-Security Web service.
I've created two custom WS-Policy files, one that corresponds to the request and one that corresponds to the response for the back end Web service.
I've modified the WSDL for my business service to reference the two policy files.
Inside the ALSB proxy, I am able to apply the correct encryption/signature on the request to the back end Web service. I can invoke the proxy and see the back-end Web service being invoked with the correct components encrypted and signed.
The problem I am having is with the WS-Policy file that describes the response.
My understanding is that the policy for the response has to be abstract in order to be able to decrypt the response.. my policy file has a Confidentiatlity element that looks like:
<wssp:Confidentiality>
<wssp:KeyWrappingAlgorithm URI="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
<wssp:Target>
<wssp:EncryptionAlgorithm
URI="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
<wssp:MessageParts>
/xpath/to/element
</wssp:MessageParts>
</wssp:Target>
<wssp:KeyInfo/>
</wssp:Confidentiality>
However when I invoke the proxy with this in the response policy, the proxy doesn't invoke the back end Web service I get the following error on the console:
Failed to load WSDL binding information for service
If I remove the <Confidentiality> element it invokes the back-end Web service but is unable to decrypt the results.. I get an error that references the CertPathBuilder
How am I supposed to specify the Confidentiality on the response?
(The proxy service has a proxy service provider associated with it and the proxy service provider has both encryption and digital signature credentials as well)

Answer 1

Hi Martin,
uff, its a long time ago ;-)
Not directly, I created an Implicit Enhancement Spot at the end of method APPLY() (class CL_ST_USERNAME10).
Based on the interface name I'm reading a custom configuration table in order to define (overwrite) the username token settings in structure (instance attribute) "m_username_token".
I also opened a message at SAP, because the digest password was not calculated correctly.
The answer was the following OSS Note provided by SAP:
1587834 - wsse:UsernameToken: incorrect Password digest
I created the WS-Policy manually and attached it to the WSDL file.
This will generate the signature configuration.
It is very helpful to create a "dummy" provider service with the same WSS settings (SOAMANAGER) in order to generate a WS-Policy template.
If you need further information, don't hesitate to contact me.
Kind regards
Axel