Search code examples
cxfws-securitysaml-2.0

SAMLToken (Signed) request failing because of WS Policy

I am implementing alternate authentication using UsernameToken or SAMLToken (Signed). I have configured below policy in my wsdl: 

        <wsp:Policy wsu:Id="DoubleItPlaintextPolicy">
            <wsp:ExactlyOne>     
                    <wsp:All>
                            <sp:SupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
                                    <wsp:Policy>
                                            <sp:SamlToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
                                                    <wsp:Policy>
                                                            <sp:WssSamlV20Token11/>
                                                    </wsp:Policy>
                                            </sp:SamlToken>
                                    </wsp:Policy>
                            </sp:SupportingTokens>       
                    </wsp:All>
                    <wsp:All>       
                            <sp:SupportingTokens>
                                    <wsp:Policy>
                                            <sp:UsernameToken>
                                                    <wsp:Policy>
                                                            <sp:HashPassword/>
                                                    </wsp:Policy>
                                            </sp:UsernameToken>       
                                    </wsp:Policy>
                            </sp:SupportingTokens>
                    </wsp:All>     
            </wsp:ExactlyOne>
    </wsp:Policy>

Also, I have configured the backend validators in spring beans file. I am able to receive requests with UsernameToken. However, SAMLToken requests are failing with below error:

<faultstring>These policy alternatives can not be satisfied:{http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}SupportingTokens {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}SamlToken {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}UsernameToken</faultstring>

Below is a sample request which I am trying to handle:

http://shortText.com/SNzXMB

Can someone please let me know the correct policy for handling this kind of request.

Solution

  • It seems CXF-2.4 which I was using had some issues with Policy Alternates. Above policysnippet worked when I upgraded to CXF-2.7