X509 message level authentication - Unable to validate identity assertions

Question

Hi All,
I am creating a proxy service that will authenticate a soap request with incoming x509 certificate.
I configured weblogic server following the below blog post
http://tim.blackamber.org.uk/?p=831
I also setup SSL and keystore tab in the weblogic server by following steps in the the below URL
http://biemond.blogspot.com/2009/06/ws-security-in-osb.html
In my proxy service I am using pre-defined policy "Auth.xml"
The proxy service is attached below
I am running the proxy service from test console. I have a security provider created pointing the keystore and selected while running the proxy service from test console ( no user name/password provided)
I was expecting that proxy service will read the security token and map the CN name correspons to the security token key (my default User name mapper attribute is CN) to an user created in weblogic server and able to authenticate it.
But I am getting following error. Please suggest.
<An error ocurred during web service security inbound request processing [error-code: Fault, message-id: 1345281693794990467-5e61805e.1324a2f888f.-7f8a, proxy: myPrototypes/ProxyService/ProxyServiceExtBizV2, operation: null]
--- Error message:
<env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope"><env:Header/><env:Body><env:Fault xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><Code xmlns="http://www.w3.org/2003/05/soap-envelope"><Value>env:Sender</Value><Subcode><Value>wsse:InvalidSecurity</Value></Subcode></Code><Reason xmlns="http://www.w3.org/2003/05/soap-envelope"><Text xml:lang="en-US">Unable to validate identity assertions.</Text></Reason></env:Fault></env:Body></env:Envelope>
weblogic.xml.crypto.wss.WSSecurityException: Unable to validate identity assertions.
*     at weblogic.wsee.security.wss.SecurityPolicyValidator.doIdentity(SecurityPolicyValidator.java:144)*
*     at weblogic.wsee.security.wss.SecurityPolicyValidator.processIdentity(SecurityPolicyValidator.java:107)*
     at weblogic.wsee.security.wss.SecurityPolicyValidator.processInbound(SecurityPolicyValidator.java:78)
     at weblogic.wsee.security.WssServerPolicyHandler.processInbound(WssServerPolicyHandler.java:54)
     at weblogic.wsee.security.WssServerPolicyHandler.processRequest(WssServerPolicyHandler.java:30)
     at weblogic.wsee.security.WssHandler.handleRequest(WssHandler.java:74)
     at com.bea.wli.sb.security.wss.wls.Wls92InboundHandler.processRequest(Wls92InboundHandler.java:164)
     at com.bea.wli.sb.security.wss.WssHandlerImpl.doInboundRequest(WssHandlerImpl.java:223)
     at com.bea.wli.sb.context.BindingLayerImpl.addRequest(BindingLayerImpl.java:289)
     at com.bea.wli.sb.pipeline.MessageProcessor.processRequest(MessageProcessor.java:87)
     at com.bea.wli.sb.pipeline.RouterManager$1.run(RouterManager.java:593)
     at com.bea.wli.sb.pipeline.RouterManager$1.run(RouterManager.java:591)
     at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)
     at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:146)
     at com.bea.wli.sb.security.WLSSecurityContextService.runAs(WLSSecurityContextService.java:55)
     at com.bea.wli.sb.pipeline.RouterManager.processMessage(RouterManager.java:590)
     at com.bea.wli.sb.test.service.ServiceMessageSender.send0(ServiceMessageSender.java:332)
     at com.bea.wli.sb.test.service.ServiceMessageSender.access$000(ServiceMessageSender.java:79)
     at com.bea.wli.sb.test.service.ServiceMessageSender$1.run(ServiceMessageSender.java:137)
     at com.bea.wli.sb.test.service.ServiceMessageSender$1.run(ServiceMessageSender.java:135)
     at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)
     at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:146)
proxy service definition:
<?xml version="1.0" encoding="UTF-8"?>
<xml-fragment xmlns:ser="http://www.bea.com/wli/sb/services" xmlns:tran="http://www.bea.com/wli/sb/transports" xmlns:env="http://www.bea.com/wli/config/env" xmlns:http="http://www.bea.com/wli/sb/transports/http" xmlns:con="http://www.bea.com/wli/sb/services/security/config" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:con1="http://www.bea.com/wli/sb/pipeline/config" xmlns:con2="http://www.bea.com/wli/sb/stages/logging/config" xmlns:con3="http://www.bea.com/wli/sb/stages/config" xmlns:con4="http://www.bea.com/wli/sb/stages/publish/config">
<ser:coreEntry isProxy="true" isEnabled="true">
<ser:serviceProvider ref="myPrototypes/x509keyprovider"/>
<ser:security>
<con:inboundWss processWssHeader="true"/>
</ser:security>
<ser:binding type="abstract SOAP" isSoap12="true" xsi:type="con:AnySoapBindingType" xmlns:con="http://www.bea.com/wli/sb/services/bindings/config"/>
<ser:monitoring isEnabled="false">
<ser:aggregationInterval>10</ser:aggregationInterval>
<ser:pipelineMonitoringLevel>Pipeline</ser:pipelineMonitoringLevel>
</ser:monitoring>
<ser:reporting>true</ser:reporting>
<ser:logging isEnabled="true">
<ser:logLevel>debug</ser:logLevel>
</ser:logging>
<ser:sla-alerting isEnabled="true">
<ser:alertLevel>normal</ser:alertLevel>
</ser:sla-alerting>
<ser:pipeline-alerting isEnabled="true">
<ser:alertLevel>normal</ser:alertLevel>
</ser:pipeline-alerting>
<ser:ws-policy>
<ser:binding-mode>service-policy-bindings</ser:binding-mode>
<ser:policies>
<ser:service-policy>
<ser:predefined-policy>Auth.xml</ser:predefined-policy>
</ser:service-policy>
</ser:policies>
</ser:ws-policy>
</ser:coreEntry>
<ser:endpointConfig>
<tran:provider-id>http</tran:provider-id>
<tran:inbound>true</tran:inbound>
<tran:URI>
<env:value>/myPrototypes/ProxyService/ProxyServiceExtBizV2</env:value>
</tran:URI>
<tran:inbound-properties/>
<tran:all-headers>true</tran:all-headers>
<tran:provider-specific>
<http:inbound-properties/>
</tran:provider-specific>
</ser:endpointConfig>
<ser:router>
<con1:pipeline type="request" name="PipelinePairNode1_request">
<con1:stage name="stage1">
<con1:context/>
<con1:actions>
<con2:log>
<con3:id>_ActionId-3973507234039169612-4f70a750.1323cbeae66.-7e09</con3:id>
<con2:logLevel>info</con2:logLevel>
<con2:expr>
<con3:xqueryText>$header</con3:xqueryText>
</con2:expr>
<con2:message>osb_extbiz_log:request side:hdr is</con2:message>
</con2:log>
<con4:route>
<con3:id>_ActionId-3973507234039169612-4f70a750.1323cbeae66.-7866</con3:id>
<con4:service ref="myPrototypes/BizService/BizServiceExtBiz" xsi:type="ref:BusinessServiceRef" xmlns:ref="http://www.bea.com/wli/sb/reference"/>
<con4:outboundTransform/>
</con4:route>
</con1:actions>
</con1:stage>
</con1:pipeline>
<con1:pipeline type="response" name="PipelinePairNode1_response">
<con1:stage name="stage1">
<con1:context/>
<con1:actions>
<con2:log>
<con3:id>_ActionId-3973507234039169612-4f70a750.1323cbeae66.-7cd6</con3:id>
<con2:logLevel>info</con2:logLevel>
<con2:expr>
<con3:xqueryText>$header</con3:xqueryText>
</con2:expr>
<con2:message>osb_extbiz_log:response side:hdr is</con2:message>
</con2:log>
<con2:log>
<con3:id>_ActionId-3973507234039169612-4f70a750.1323cbeae66.-79d3</con3:id>
<con2:logLevel>info</con2:logLevel>
<con2:expr>
<con3:xqueryText>$outbound</con3:xqueryText>
</con2:expr>
<con2:message>osb_extbiz_log:response side:outbound is</con2:message>
</con2:log>
<con2:log>
<con3:id>_ActionId-3973507234039169612-4f70a750.1323cbeae66.-79b6</con3:id>
<con2:logLevel>info</con2:logLevel>
<con2:expr>
<con3:xqueryText>$inbound</con3:xqueryText>
</con2:expr>
<con2:message>osb_extbiz_log:response side:inbound is</con2:message>
</con2:log>
</con1:actions>
</con1:stage>
</con1:pipeline>
<con1:flow>
<con1:pipeline-node name="PipelinePairNode1">
<con1:request>PipelinePairNode1_request</con1:request>
<con1:response>PipelinePairNode1_response</con1:response>
</con1:pipeline-node>
</con1:flow>
</ser:router>
</xml-fragment>
Edited by: 818591 on Sep 8, 2011 4:47 PM

Answer 1

For anyone watching this thread for any relevant information,
after adding sign.xml policy, it started working