The passwordType was passwordDigest at server side and passwordText at client side. This works fine in 2.2.5. After setting both sides to be passwordText, we can upgrade to 2.2.6 without a problem.
Thanks, Yonghe dkulp wrote: > > > You may be running into the fixes needed for: > https://issues.apache.org/jira/browse/CXF-2150 > > According to the code at that line number, your passwordType on the server > is > set to "PasswordDigest", but you are sending a Text. We now make sure > that > isn't allowed as the passwords actually verified with that combination in > WSS4J. Definitely check to make sure your passwordType is PasswordText > if > you want a text password. > > Dan > > > On Tue January 26 2010 4:37:53 pm Yognhe wrote: >> Hi, >> >> After upgrading cxf from 2.2.5 to 2.2.6, wss4j authentication failed. >> Switching back to 2.2.5, everything is okey. Seems that there is bug in >> 2.2.6. My version of wss4j is 1.5.8, passwordType is PasswordText and it >> is >> sent over http (actually hashed password is sent by cleartext). >> >> Cxf prints the following exception: >> >> Jan 26, 2010 3:18:25 PM >> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor >> handleMessage >> WARNING: >> org.apache.ws.security.WSSecurityException: An error was discovered >> processing the <wsse:Security> header >> at >> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.doResults(WSS4JInInterc >> eptor.java:367) at >> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInIn >> terceptor.java:293) at >> org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInIn >> terceptor.java:78) at >> org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChai >> n.java:243) at >> org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationO >> bserver.java:109) at >> org.apache.cxf.transport.servlet.ServletDestination.invoke(ServletDestinati >> on.java:98) at >> org.apache.cxf.transport.servlet.ServletController.invokeDestination(Servle >> tController.java:406) at >> org.apache.cxf.transport.servlet.ServletController.invoke(ServletController >> .java:178) at >> org.apache.cxf.transport.servlet.AbstractCXFServlet.invoke(AbstractCXFServl >> et.java:142) at >> org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(Abstract >> HTTPServlet.java:179) at >> org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPSer >> vlet.java:103) at >> javax.servlet.http.HttpServlet.service(HttpServlet.java:710) >> at >> org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPSe >> rvlet.java:159) at >> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applicatio >> nFilterChain.java:290) at >> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterC >> hain.java:206) at >> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.j >> ava:230) at >> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.j >> ava:175) at >> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:12 >> 8) at >> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:10 >> 4) at >> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.jav >> a:109) at >> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:261) >> at >> org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844) >> at >> org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Htt >> p11Protocol.java:581) at >> org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447) >> at >> java.lang.Thread.run(Thread.java:619) >> > > -- > Daniel Kulp > [email protected] > http://www.dankulp.com/blog > > -- View this message in context: http://old.nabble.com/upgrading-from-2.2.5-to-2.2.6-failed-tp27330177p27378561.html Sent from the cxf-user mailing list archive at Nabble.com.
