Hi, I try to connect a CXF client to a WCF service with mutual certificates. The request looks mostly fine, however the leading "#" seems to be missing in the URI attribute of the first wsc:DerivedKeyToken/wsse:SecurityTokenReference/wsse:Reference/@URI:
<wsse:Reference URI="EK-EB7D959EB7AAE265FA13238483886841" ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey"/> On the server side I then get the error "XmlException: Cannot read KeyIdentifierClause from element 'Reference' with namespace 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'. Custom KeyIdentifierClauses require custom SecurityTokenSerializers, please refer to the SDK for examples." Has anyone experienced the same problem? I'm using CXF version 2.5.0. Is there any way I can fix the error? Below is the full SOAP request sent by CXF: <?xml version="1.0" encoding="UTF-8"?> <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope";> <soap:Header> <Action xmlns="http://www.w3.org/2005/08/addressing"; xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"; wsu:Id="Id-716570799">http://tempuri.org/IService1/GreetMe</Action> <MessageID xmlns="http://www.w3.org/2005/08/addressing"; xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"; wsu:Id="Id-107372097">urn:uuid:37735dfc-6929-4993-ab85-39b6da3e7700</MessageID> <To xmlns="http://www.w3.org/2005/08/addressing"; xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"; wsu:Id="Id-1043274522">http://localhost:7777/MuniceRETest/MunicReTestService.Service1.svc</To> <ReplyTo xmlns="http://www.w3.org/2005/08/addressing"; xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"; wsu:Id="Id-110913499"> <Address>http://www.w3.org/2005/08/addressing/anonymous</Address> </ReplyTo> <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"; xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"; soap:mustUnderstand="true"> <wsu:Timestamp wsu:Id="TS-1"> <wsu:Created>2011-12-14T07:39:48.347Z</wsu:Created> <wsu:Expires>2011-12-14T07:44:48.347Z</wsu:Expires> </wsu:Timestamp> <xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"; Id="EK-EB7D959EB7AAE265FA13238483886841"> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#";> <wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";> <wsse:KeyIdentifier EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"; ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1";>UsObF/wOuFYqPswdD1bivW614Hw=</wsse:KeyIdentifier> </wsse:SecurityTokenReference> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>wmvpdYBMl2amoFwDpDheDpEOo/ANIQxEdsnhh9MezA1YJ9YTErEPYNkw57fRhpiRMr5N8Feg9qhOzxxLTUY5I1pF260afJ1X+BUvmd6RTArPnWRQiqD7rMM/0uIFlRRw7RFJ1odyqr3hmNiXLfsbMYBItQYP7t+uZZNgPPQTxJk=</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedKey> <wsc:DerivedKeyToken xmlns:wsc="http://schemas.xmlsoap.org/ws/2005/02/sc"; wsu:Id="DK-2"> <wsse:SecurityTokenReference xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"; wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey"; wsu:Id="STR-EB7D959EB7AAE265FA13238483887102"> <wsse:Reference URI="EK-EB7D959EB7AAE265FA13238483886841" ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey"/> </wsse:SecurityTokenReference> <wsc:Offset>0</wsc:Offset> <wsc:Length>16</wsc:Length> <wsc:Nonce>W4BhPXvFIC9idCeSTsHvjw==</wsc:Nonce> </wsc:DerivedKeyToken> <wsc:DerivedKeyToken xmlns:wsc="http://schemas.xmlsoap.org/ws/2005/02/sc"; wsu:Id="DK-4"> <wsse:SecurityTokenReference xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"; wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey"; wsu:Id="STR-EB7D959EB7AAE265FA13238483887685"> <wsse:Reference URI="#EK-EB7D959EB7AAE265FA13238483886841" ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey"/> </wsse:SecurityTokenReference> <wsc:Offset>0</wsc:Offset> <wsc:Length>16</wsc:Length> <wsc:Nonce>XI57dsm9x9nMo8Uv5bpd9A==</wsc:Nonce> </wsc:DerivedKeyToken> <xenc:ReferenceList xmlns:xenc="http://www.w3.org/2001/04/xmlenc#";> <xenc:DataReference URI="#ED-5"/> <xenc:DataReference URI="#ED-6"/> </xenc:ReferenceList> <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"; Id="ED-6" Type="http://www.w3.org/2001/04/xmlenc#Element";> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#";> <wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";> <wsse:Reference URI="#DK-4"/> </wsse:SecurityTokenReference> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>3jf7lxFjAW9lRpuGnWGMuDHphZDCshK0sD4Id3Cw/nrV/HCazF46nKa0lcsn+fNHx9qWiCUB7dUfE22l1hnYfWsO4tYnX6EiRfsgpcBw3J+KkFlLzc2ynkWUzJSGd6uLnd4qBgBnwLNG2SjEsf2AoejIltHVTXt4ivJsbM7eY4+PokcLGB5jpWXPm1iE3Zc1MCDvluy1oVexTeeP2OME0YZ1jdguT9qCcITYVl161MvwKaieCmLCt2BYfTCX0GLatnQbbIMnu8UIHpXFpAkXbrfkANHLkpau2GX+3KLaY/JJ06L5fNS6pdRGrAR29oT5F4Ub4f/oMEIL4sIVc76V9agruCgWMiI2N/ROhs7BSnPOhEpkg6y8lcOGjeIP8fLuWrkenWn2CgZgBT3O9floGnbhPOrDd5F7E1M6z3oTdwF7DU0DwPrmxF4a8scfVgYrHeEwDPWNSzMyle0MwhOf1tz9xr4kKcBoYhOafRr1G7XrsXoz814K5jBVjH1nPKfugT3JIcDzESN433MiUNcSn0hTjgAL8KGBoORAs9UN2xDaubtn/MNr5KrJNq9EjBOiBLWX9fO+s6Mr+AooFrFlFAZkDMBD7G57Z824vrvwGr9/KO8tflZaHIFv8kbwfkuTtOuQnHS4RXZROxxBteTEwaTLbgLbRJHu2JFKUjgNmK3uuw5POWaVw6oBiIPXvKBUfVcjGTRfG58OamjSzfH2lf9JjJntLJZkne9Ydoo4q9aXKaGbUpzEhC/Vd1ihjdTslepyGzKxM+G7lW3+CFHZ0d5SRYDE3tKyikjogi7IM4m2poEHrnUC8+rvZvfzId50m3qfgkhRY3/1OX1yWOvPxU5ND4KlCNbdzt5BOHJb0W1slBVRmnXoeR1uQ0otqzzw0sAm7DXxwiwqL3ycEIi8wKKq7RiY0Zi/dyBzi76yVIFsYQfrgeqy06dozIAwY9aY0GZcsSk5zZ96VjBLyuty0nplSsxtXWS9QoQbneDMOewRXmL/1xjsJ1r3jKMb2DHQwwhs2k4gkNZDLdqc6UIS4BVr0BVj9SlEUVCvRFOahTgbpgwjZhnlqzOCoAPYXqhrsigj2G2IAcueZ/r6YPdmxL0rkm11XXjuivKafh+eihy5U/3FJbB66m/nfGgjz6oxHv/n6XKqDI6JfuWar0qI058nCygWjAvVRxMQoJJAgfso8Paoh9KoOXDXI9AJNV5zq5c3fdfdA/SbwTLjM2oCdHhayJEZmT3UYB2a0AQVHr4wMp0rllHsEYKo0VvENBYAxETmD2HEzuonsmlNCWIcIjypbwr8e24A9uFUBGZ4ss4GcBAczE6alXV9A3o61NGqrWQ57twiFEzuK3F/L8fqxYmkmEwwh52XpAcwch9gAGJaIxoLO4j/nAltiWSrw/2wVK3NH3TsReGl7eskMDnRfj+vIwt2PlyB0GL4/qzVPxCwnIN2KlcCzNGd+whyzkmw2vZlF7xgIqps4Y25q4zjin8X13HcG0JGGE9XyEIOa94RpKcCZigAXbG5bd4xPduE1g260p58n9SNEbz9ZYtBuT5JjnaMSvO8FBkaidxyZ4oKBF459YxyL6i7HpG+J3WZ0E1CHI5KvikBiHELL1M7ZokpIiXkfDRWUEQUeLpaLH7fmb4e/XMrkLRPyVdRYXxJhWW83V6EptKmk2GeDQlxGIgvkkwuDJv5iQL3aTVtmgx27vS8MK1nVYcfIVSHQy7DtpcL/xFfNJDoorwSNKx+5f0aYHns17fSmfCkyM7M1sVR0pIBmQ1mUFB7ICYEcDoUvupgx2nSCBOXDr7kZ8UaXD52bi4pIOvjuoN6t39BR8ms1MeWpmZ0emqVFuTAFoblugDH26+qzLBaDeoHZeiZfku38PyUY1gBmKPlKv53NHy/ylHuYErLCt620RAAKiG2h2UpOo/GHE1Cdh1BiV843dKIgMc+YgMRn2+TgRZoSWMAf87Psz1Rb3WGdAyYW78ufk5q96onXTje2G65otdksf7awEygPSwCMhJJijEoRlvOJut+oOasHxAFM8wx5vE2WQBO6Rt0PmVMxIeRQTdtpPjfxZkqWjQORUap1e5cYSZxuaVrFSo0bqcCfEgHGQ71ouSigIgdlUzMvCjgTkyPXyy5GFGuFioPl3iTazmjVjMPZOqOMZgPASQM9rYKNK9a/zbyLrbNGrqXUMaGnK3a/X3jXfAW42N/zxphr5KCJr4fQsBes7/jebopyHd2CbcFlL8AOYWAOyxChENTVjowP+KVCK2GP0uZENP29E6tEdZHb3JezSl5ZBQk6yE+v95/qvVQWTlkmYczTWBKx5ZsMvNDe0dFtnSHCp87RQe8ur9GaEufbTxZKsmlbWRw6AhvHuFTj801Fepf9+/k5vmjniKC0cBoAR/u18BRItEaCPXJTxccv7ZYtTZYaQJlVaYUOcQ9EFt+0fT97vZNbZ9NYwdLTq2HDTZgW18Pfhn+A4yl3HihEQRVibTFoDeShOxaFk2KrmBQActthTN5wxHI0PEQ26w5kuzPsUbVtto7IhJYEG/kZIizYbl8F6CUANOVymELxbtL2hqdLYGo7e2OEeOsD3WQmhiTMEMHL+3wqNeS3N/+YjivBhS5PNf8oTROFMxlgxeKcqPfK4Ly5BNGa2uNpX6DUzeV6g8Dwdlbo4McgjTPUhYmBEuI6PXrzioAs5Y0CMzj3IUtGgthrWb0cuR/cawgO8rkTrM1eyxq3UP8LR8yTSmeMVQ9qB3I0WtSUbeELlyS1HjOrNYRsiXW+HfdZJGmXpmqFic/dSgmXT0sxSDH2DTZAtZ/Zl87jZfQfmj1ExKza9msiRDSpc/U6f8asTdxF9EWb4j7FuEOJ4OobyEWlPBWEhqOZVmCA7EvN66GWQal+VUquiwTgb5ttfYjzmEmNDXXz4HD9JwPnV9VcQ6pxd79yPrYLn+4wmAL9T0JAqLKZpTAdHV5pSqNDYajQQyfP0aWzT7wb+XNIFB7DZxE1IVm9LGr8GhRKqoe1ErZYzW+UuIua11RjLpTI/wEAeCNiQrn5UVU0gNj4hafrrKF6sSIriXK9PGmYe2WrENrG/veWztARtyr6S+3IQ0gUIPc26ZYwCEoMqW8d2OCNN6Mv3fJ33U92ZUesTMghdWqhgDN1p3AAz4wfzsYg0Z1aTWUlZK70MhKy4u38ajx10Pow7kHhVQtXYEk/Ie1vvEIEGRCk8BQ0CnNfoEXmQCgdJln/sGhzMMgFsZzYb3Au2Wj7/O0WVi6KtSmiOeg5VVgxeiyY4wJpVFevi9LbnmC6Dt98UHoLjDdvoo3i7GKtJbsttY9QSdCrZpSz3OWl+9/npdBP/DF7qT56degW8Ucbz89nAN/F2ApW2Fb7+Cl5ELTn528YVGSp2QHkf8o/jTd9IPvnA1qdYnS3HSiK+U6DmWJfmvKWDrBHJUG+3Lza9WtBKADfSWHH1kvRPQGCSxPdljqmgfzDhHBA27lxuuu97jgXmq31rJAOgt1J1iMv7ypW3jMAZRVvB2GGVPOHd/ooUXz+Ik0h1rBXXXYpLLXocW9W4SUkUznSysQIRLlZAz8m2aJVMbD4St54W5Q61qnzFNGtU9b5ZkNifIKRsACK9S7jy6qGo+cDJo2jvM3jeNiDCus+piGQhCMvtEGzp+JvtPbA00ch8ZvLomG80aWTe5hs3WwLpSMcGIS1OpUO3ocHVuVCVrt/PnBb+HmfDBOjLVjWp4gwfmGJrkwS9pAGQrfHn02Oh51J+EhujShzs1oI2HCydYXAlxPZKOZIMoN8u9V0d5h75anoEhU1TPTzjxffYTYe2Vl/61c5DJdKisl9J494BVBmynbAd/C2hWuhd50TF4PDve1UJiwtJV6ar4EFoiAWZwJyFstM1Tvig1J/0Xdy069lTaVxSPNw9f/oMF/hNk3fDS0SaazsZ0/dTvRqyxmrA5v8hqdzsbbInglgFSA05SrILgDucTkECg/KI/AXwEJRw0XC+s16Qnfv8JTJKlYPuqMrS3P8sAHOw3XGHeAlQFJlrwqUCed7XevvQtQIw1RStJqen7Mkf9eVoA3QnWDifV9ooNq7l3B74pf+DE6cIRezxCuaWNRHl+VbQ7BsfWQaZhsIHXEKrJGkRQt7vnkARt206YNz12X6OFn8bbkMLjgtysmfa+uyLhBDZ/ff0SBHOBAgvJ19Qm/B8tYnHnWVFBI3iFHdJVCUIQMo0AjqfNLG/qpvH8k6aYHFGUZ0Jpd/qhHt9hCApbpzjTBhWcnCgfrIBHZR7y+4IgjtOOGcyTARqBzjm+2AzxA93Ls6E2Wlv5I2UbWN7rGrWFRHLVyLonE9k/QjAAg32Uha8ze4FtdHtFoGxtUhNFOQQreDdrZ/49yGETqeXoNjAPtg7W6gpTfjUjN9Jc=</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedData> </wsse:Security> </soap:Header> <soap:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"; wsu:Id="Id-42610539"> <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"; Id="ED-5" Type="http://www.w3.org/2001/04/xmlenc#Content";> <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#";> <wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";> <wsse:Reference URI="#DK-4"/> </wsse:SecurityTokenReference> </ds:KeyInfo> <xenc:CipherData> <xenc:CipherValue>ocmeEmZvxM1o2yM3PcqIs4wpOrMkyG1No6XOO6TYKYwdvEAHRQgem6c70nCOPBcKeTjPLRNQ+Uts1FJhc+79mZkHHWqHS/Rvhwmb992rWjxFwvwbSkbCTu3eYKwVBdMT12ap8cRtniBgUcjfWUPXJFLGcK6ZDpqYaN9HN/8MXbBL0Yme9yznj2PZqK8C3Rye0DRunyCutJutYZ1/RbCbs/SARKS6ycCG921xtYqwHN5VgM5W+7wVyErbg+COi7beE+b2dCR/kSlPpxID8R8x28T17MtCGdYRlauXHUsH+fojNxrn/I7EkKipVMzHH4/Ig0SOdWms6UDeH/fDgtgDMDyEXK7gPFGm3/KsUbNavxwxiMeDXItEskL3QG0fdeUgPr1A+GxTfI2poEVdbJ+Efw==</xenc:CipherValue> </xenc:CipherData> </xenc:EncryptedData> </soap:Body> </soap:Envelope> Best regards, Udo
