Error : Username Token Created policy not enforced

Question

I am working on CXF based services and clients. And implemented Username Password Security on the server side using Policy file defined in wsdl. Here is the configuration :

<wsp:Policy wsu:Id="policy.Security" xmlns:wsp="http://www.w3.org/ns/ws-policy">
  <wsp:ExactlyOne>
    <wsp:All>
        <sp:SupportingTokens>
            <wsp:Policy>
                <sp:UsernameToken
                        sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient"
                    wsp:Optional="false" wsp:Ignorable="false">
                    <wsp:Policy>
                        <sp:WssUsernameToken10 />
                        <sp13:Created />
                        <sp13:Nonce />
                    </wsp:Policy>
                </sp:UsernameToken>
            </wsp:Policy>
        </sp:SupportingTokens>
    </wsp:All>
  </wsp:ExactlyOne>
</wsp:Policy>

Client Configuration :

<jaxws:client
    xmlns:tns="http://ws.soa.com/service/offer/XYZ/"
    name="XYZPort" address="${xyz.endPoint}"
    serviceClass="com.soa.ws.service.offer.XYZ.XYZPortType"
    wsdlLocation="${xyz.wsdlLocation}" serviceName="tns:xyzService" >
    <jaxws:properties>
        <entry key="ws-security.username" value="${xyz.auth.username}" />
        <entry key="ws-security.callback-handler" value-ref="xyzPasswordCallback" />
    </jaxws:properties>
    <jaxws:inInterceptors>
    <ref bean="logInBound" />
    </jaxws:inInterceptors>
    <jaxws:outInterceptors>
    <ref bean="logOutBound" />      
    </jaxws:outInterceptors>
</jaxws:client>

Receiving below error on Trying to hit the service:

Caused by: javax.xml.ws.soap.SOAPFaultException: These policy alternatives can not be satisfied: {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}UsernameToken: Username Token Created policy not enforced at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:157)

Can anyone give direction on how to resolve this ?

Looks like it requires wsse:created and wsse:Nonce in the soap request. Not sure how to populate them . — RSH
Both are anti-replay attack measures. wsu:Created is a request timestamp and wsse:Nonce is a resquest unique id. Their format is described in documentation: docs.oasis-open.org/ws-sx/ws-securitypolicy — Yuri

Colm O hEigeartaigh Colm O hEigeartaigh · Accepted Answer · 2016-04-21T13:49:25

You might be using an oldish version of CXF. This was fixed here:

https://issues.apache.org/jira/browse/CXF-6051

Error : Username Token Created policy not enforced

1 Answers