Upgrade to wss4j 1.6 [SWS-711]

[gregturn]

Mark Diskin opened SWS-711 and commented

From support issue - Reference #11620

wss4j 1.6.1 has made much improves to the WS-Security implememtation and key to us (sure others) is the work to ensure cross-implementation compliance with BSP 1.1 http://coheigea.blogspot.com/2011/03/wss4j-16-basic-security-profile-11.html.

This upgrade opens up the possibility for Spring-WS to support SAML authentication (I'll open a separate issue for that).

---

Affects: 2.0.2

Reference URL: http://forum.springsource.org/showthread.php?107632-When-will-WSS4J-1.6.0-be-supported

Attachments:

• spring-ws.patch (45.43 kB)

Referenced from: commits 1f15b8c

4 votes, 5 watchers

[gregturn]

Arjen Poutsma commented

Unfortunately, WSS4J 1.6 introduced some breaking, non-backwards compatible changes, making it non-trivial to upgrade.

Postponed to 2.1.

[gregturn]

Patrick commented

Yes, please upgrade. We depend on 3rd party software which now ships with WSS4J 1.6. That's a huge issue, because we're using (and want to keep using) Spring WS...

[gregturn]

Edwin Stang commented

Spring-WS 2.0.3.RELEASE with WSS4J 1.6.4 leads to the following exception for me:

java.lang.IllegalStateException: Failed to load ApplicationContext
	at org.springframework.test.context.TestContext.getApplicationContext(TestContext.java:157)
	at org.springframework.test.context.support.DependencyInjectionTestExecutionListener.injectDependencies(DependencyInjectionTestExecutionListener.java:109)
	at org.springframework.test.context.support.DependencyInjectionTestExecutionListener.prepareTestInstance(DependencyInjectionTestExecutionListener.java:75)
	at org.springframework.test.context.TestContextManager.prepareTestInstance(TestContextManager.java:321)
	at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.createTest(SpringJUnit4ClassRunner.java:211)
	at org.springframework.test.context.junit4.SpringJUnit4ClassRunner$1.runReflectiveCall(SpringJUnit4ClassRunner.java:288)
	at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:15)
	at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.methodBlock(SpringJUnit4ClassRunner.java:290)
	at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.runChild(SpringJUnit4ClassRunner.java:231)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:47)
	at org.junit.runners.ParentRunner$3.run(ParentRunner.java:231)
	at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:60)
	at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:229)
	at org.junit.runners.ParentRunner.access$000(ParentRunner.java:50)
	at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:222)
	at org.springframework.test.context.junit4.statements.RunBeforeTestClassCallbacks.evaluate(RunBeforeTestClassCallbacks.java:61)
	at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:30)
	at org.springframework.test.context.junit4.statements.RunAfterTestClassCallbacks.evaluate(RunAfterTestClassCallbacks.java:71)
	at org.junit.runners.ParentRunner.run(ParentRunner.java:300)
	at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.run(SpringJUnit4ClassRunner.java:174)
	at org.eclipse.jdt.internal.junit4.runner.JUnit4TestReference.run(JUnit4TestReference.java:50)
	at org.eclipse.jdt.internal.junit.runner.TestExecution.run(TestExecution.java:38)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:467)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:683)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.run(RemoteTestRunner.java:390)
	at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.main(RemoteTestRunner.java:197)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'wssInterceptor' defined in class path resource [META-INF/ctx.integration.ws.xml]: Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Could not instantiate bean class [org.springframework.ws.soap.security.wss4j.Wss4jSecurityInterceptor]: Constructor threw exception; nested exception is java.lang.NoSuchMethodError: org.apache.ws.security.WSSecurityEngine.getInstance()Lorg/apache/ws/security/WSSecurityEngine;
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:997)
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:943)
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:485)
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:456)
	at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:294)
	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:225)
	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:291)
	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:193)
	at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:585)
	at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:913)
	at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:464)
	at org.springframework.test.context.support.AbstractGenericContextLoader.loadContext(AbstractGenericContextLoader.java:148)
	at de.invesdwin.gemeinsam.test.TestContextLoader.loadContext(TestContextLoader.java:78)
	at org.springframework.test.context.TestContext.loadApplicationContext(TestContext.java:130)
	at org.springframework.test.context.TestContext.getApplicationContext(TestContext.java:148)
	... 25 more
Caused by: org.springframework.beans.BeanInstantiationException: Could not instantiate bean class [org.springframework.ws.soap.security.wss4j.Wss4jSecurityInterceptor]: Constructor threw exception; nested exception is java.lang.NoSuchMethodError: org.apache.ws.security.WSSecurityEngine.getInstance()Lorg/apache/ws/security/WSSecurityEngine;
	at org.springframework.beans.BeanUtils.instantiateClass(BeanUtils.java:162)
	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:76)
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:990)
	... 39 more
Caused by: java.lang.NoSuchMethodError: org.apache.ws.security.WSSecurityEngine.getInstance()Lorg/apache/ws/security/WSSecurityEngine;
	at org.springframework.ws.soap.security.wss4j.Wss4jSecurityInterceptor.<init>(Wss4jSecurityInterceptor.java:121)
	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
	at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.lang.reflect.Constructor.newInstance(Constructor.java:532)
	at org.springframework.beans.BeanUtils.instantiateClass(BeanUtils.java:147)
	... 41 more

[gregturn]

Ivan Khoosty commented

FYI,

Jboss 7.1.0.Final ships with wss4j 1.5.8 and xmlsec 1.4.5

Jboss 7.1.1.Final ships with wss4j 1.6.5 and xmlsec 1.5.1 (https://issues.jboss.org/browse/JBWS-3439)

this means that any webapp using spring-ws cannot run on Jboss 7.1.1.Final, as xmlsec 1.5.1 gets loaded as part of java ee module dependency, so spring-ws bundled xmlsec 1.4.3 gets ignored... there is an api change from 1.4 to 1.5, which breaks the deployment.

[gregturn]

Mark Diskin commented

Hi Arjen,

I have created another approach for the wssj authenication integration using spring/spring security servlet filters. This allows for the requests to be stateless (I create the UserDetails after the SAML2 validation from the attributes provided) and able to then use the Roles (GrantedAuthority) in the spring security filter rules, etc... which was not something I could do with the springws interceptor approach. Did you want me to budndle this up under this or another case if you want to consider it?

[gregturn]

Arjen Poutsma commented

@Mark

Sure, feel free to attach it to another issue. Even if I won't make it part of the main distribution, it might be helpful to other people.

Thanks!

[gregturn]

jaminh commented

I have started working on getting Spring WS to build with WSS4J 1.6.5. I have gotten to a point where everything will at least build but I haven't tried testing beyond getting timestamp validation to work. It seems like in WSS4J 1.6 they are trying to split up the securement and validation so I tried to adjust some of the callback handlers accordingly. Also something to keep in mind is the Crypto interface was changed significantly in WSS4J 1.6 so any custom Crypto implementations are probably going to break when upgrading, but I believe it still comes with the basic Merlin implementation. I will attach a patch in case other people want to try to build on that. In the meantime I will keep working on it as much as I can.

[gregturn]

Arjen Poutsma commented

@jaminh: Thanks for the patch, it will certainly help.

Things are a bit tricky, however, because I don't want to force people to upgrade their wss4j version in a bug-fix release of Spring-WS (2.0.5). Forcing an upgrade would be fine for a 2.1 version of SWS, but 2.1 is still far off.

So we'll have to resort to some reflection trickery in order to make our wss4j support work for both 1.5.x and 1.6.x. We have this kind of tricks in other places as well, for instance the Quartz support in SPR. It's not easy, but hopefully it will work.

[gregturn]

Mark Diskin commented

Any thoughts on doing parallel releases (2.0.5,2.1) with the wss4j in the 2.1 (or 2.1rc) and moving some of the other work into a 2.2?

[gregturn]

Arjen Poutsma commented

@mark: yeah, that's an option as well, but I am only willing to take that route as a last resort, after trying the reflection-based approach. It's quite uncommon for a Spring project to release a minor version with only library upgrades, and without any new features in it.

[gregturn]

Arjen Poutsma commented

After some investigation, I've decided that the reflection-based approach is just too much hassle. Instead, I am going to follow Mark's suggestion, and release 2.0.5 without it (hopefully today). Shortly after that (next week, perhaps), I will push out 2.1 RC1, which will contain a fix for this issue and a couple of other library upgrades. Since 2.1 will contain library upgrades, I expect a short release cycle, and hopefully we'll see a 2.1 GA shortly after the RC. All other 2.1 M1 issues have been moved to 2.2 M1.

[gregturn]

Mark Diskin commented

In the meantime I've dropped the spring-ws-security dependancy, that way I'm able to bring in the latest wss4j 1.6 and handle the SAML2 SenderVoucher in my Security filter and still use the springws 2.0.x jars.

[gregturn]

Arjen Poutsma commented

I've upgraded SVN to use WSS4J 1.6, with the help of the patch provided jaminh (Thanks!). It compiles, and all tests run fine. That said, because the way WSS4J has changed internally, there are some breaking changes:

• SpringDigestPasswordValidationCallbackHandler and SpringPlainTestPasswordValidationCallbackHandler have been merged into SpringSecurityPasswordValidationCallbackHandler, which works the same way as the SpringDigestPasswordValidationCallbackHandler (i.e. supply it with a UserDetailsService).
• The Wss4jSecurityInterceptor no longer has the securementCallbackHandler property, as it's no longer used by WS4J.

Furthermore, the Wss4jSecurityInterceptor has some additional properties: enableRevocation and bspCompliant. Check the javadocs to see what these do.

I've just triggered a snapshot build, and it would be great if you guys could check it out if everything still works for you. This page shows you how to get snapshots.

If everything looks good, I will release 2.1.0-RC1 this Friday (11th May) followed by the GA release the following week.

[gregturn]

Arjen Poutsma commented

I've just pushed out version 2.1.0.RC1. Please give it a go and tell me if you find anything.

[gregturn]

Pavel Kotlov commented

Combination of spring-ws-2.1.0 and wss4j-1.6.6 still results in this error:

Could not instantiate bean class [org.springframework.ws.soap.security.wss4j.Wss4jSecurityInterceptor]: Constructor threw exception; 
nested exception is java.lang.NoSuchMethodError: org.apache.ws.security.WSSecurityEngine.getInstance()Lorg/apache/ws/security/WSSecurityEngine;```
 

Using wss4j-1.5.12 solves the problem for me. Well perhaps not for everyone... ;)