I have better logs here to determine if this is a bug or per design, [2/28/12 11:28:22:872 EST] 0000006d PhaseIntercep 1 Chain org.apache.cxf.phase.PhaseInterceptorChain@156a156a was modified. Current flow: receive [PolicyInInterceptor, LoggingInInterceptor, AttachmentInInterceptor] pre-stream [CertConstraintsInterceptor, HttpsTokenInInterceptor] post-stream [StaxInInterceptor] read [WSDLGetInterceptor, SAAJPreInInterceptor, ReadHeadersInterceptor, SoapActionInInterceptor, StartBodyInterceptor] pre-protocol [MEXInInterceptor, MustUnderstandInterceptor, PolicyBasedWSS4JInInterceptor, UsernameTokenInterceptor] post-protocol [CheckFaultInterceptor, JAXBAttachmentSchemaValidationHack] unmarshal [URIMappingInterceptor, DocLiteralInInterceptor, SoapHeaderInterceptor] pre-logical [OneWayProcessorInterceptor] post-logical [WrapperClassInInterceptor] pre-invoke [SwAInInterceptor, HolderInInterceptor, AccountValidator, PolicyVerificationInInterceptor] invoke [ServiceInvokerInterceptor] post-invoke [OutgoingChainInterceptor]
********* [2/28/12 11:28:22:872 EST] 0000006d PhaseIntercep 1 Invoking handleMessage on interceptor org.apache.cxf.interceptor.LoggingInInterceptor@22842284 [2/28/12 11:28:22:872 EST] 0000006d ReportService I org.apache.cxf.services.ReportService.ReportServicePort.ReportService Inbound Message [2/28/12 11:28:22:887 EST] 0000006d PhaseIntercep 1 * Invoking handleMessage on interceptor org.apache.cxf.ws.security.wss4j.PolicyBasedWSS4JInInterceptor@2d402d4 [2/28/12 11:28:22:887 EST] 0000006d WSS4JInInterc 1 WSS4JInInterceptor: enter handleMessage() [2/28/12 11:28:22:887 EST] 0000006d PolicyBasedWS 1 Incoming request failed token policy validation [2/28/12 11:28:22:887 EST] 0000006d PolicyBasedWS 1 Incoming request failed binding policy validation [2/28/12 11:28:22:887 EST] 0000006d PolicyBasedWS 1 Incoming request failed supporting token policy validation* [2/28/12 11:28:22:887 EST] 0000006d WSS4JInInterc 1 Receive request: total= 0 request preparation= 0 request processing= 0 header, cert verify, timestamp= 0 [2/28/12 11:28:22:903 EST] 0000006d WSS4JInInterc 1 WSS4JInInterceptor: exit handleMessage() [2/28/12 11:28:22:903 EST] 0000006d PhaseIntercep 1 Invoking handleMessage on interceptor org.apache.cxf.ws.security.wss4j.UsernameTokenInterceptor@159c159c [2/28/12 11:28:22:903 EST] 0000006d PhaseIntercep 1 Invoking handleMessage on interceptor org.apache.cxf.binding.soap.interceptor.CheckFaultInterceptor@71567156 [2/28/12 11:28:22:903 EST] 0000006d PhaseIntercep 1 Invoking handleMessage on interceptor org.apache.cxf.jaxb.attachment.JAXBAttachmentSchemaValidationHack@d2a0d2a [2/28/12 11:28:22:903 EST] 0000006d PhaseIntercep 1 Invoking handleMessage on interceptor org.apache.cxf.interceptor.URIMappingInterceptor@20782078 [2/28/12 11:28:22:903 EST] 0000006d URIMappingInt 1 Invoking HTTP method POST [2/28/12 11:28:22:903 EST] 0000006d URIMappingInt 1 URIMappingInterceptor can only handle HTTP GET, not HTTP POST [2/28/12 11:28:22:903 EST] 0000006d PhaseIntercep 1 Invoking handleMessage on interceptor org.apache.cxf.interceptor.DocLiteralInInterceptor@540c540c [2/28/12 11:28:22:903 EST] 0000006d PhaseIntercep 1 Invoking handleMessage on interceptor org.apache.cxf.binding.soap.interceptor.SoapHeaderInterceptor@35c635c6 [2/28/12 11:28:22:903 EST] 0000006d PhaseIntercep 1 Invoking handleMessage on interceptor org.apache.cxf.interceptor.OneWayProcessorInterceptor@66826682 [2/28/12 11:28:22:903 EST] 0000006d PhaseIntercep 1 Invoking handleMessage on interceptor org.apache.cxf.jaxws.interceptors.WrapperClassInInterceptor@75207520 [2/28/12 11:28:22:903 EST] 0000006d PhaseIntercep 1 Invoking handleMessage on interceptor org.apache.cxf.jaxws.interceptors.SwAInInterceptor@2e942e94 [2/28/12 11:28:22:903 EST] 0000006d PhaseIntercep 1 Invoking handleMessage on interceptor org.apache.cxf.jaxws.interceptors.HolderInInterceptor@753e753e *[2/28/12 11:28:22:903 EST] 0000006d PhaseIntercep 1 Invoking handleMessage on interceptor com.bnymellon.reporting.services.reporting.interceptors.AccountValidator@365c365c* The policy check fails but framework still continues to hit handleMessage of other PhaseInterceptors and in my case when, AccountValidator extends AbstractPhaseInterceptor my application code is executed even though security failed. When policy check fails, should CXF not terminate right away? Why is the call propagated into other interceptors? -- View this message in context: http://cxf.547215.n5.nabble.com/Multiple-endpoints-and-security-policy-tp5519904p5522687.html Sent from the cxf-user mailing list archive at Nabble.com.
