consuming Webservice CF11

[Malvina]

I try to consume a webservice which lives on an iis-machine.

I get this error message:

-----------------------------------------------------------------------------------------------------------------------------------------------------error

Cannot perform web service invocation suche.

The fault returned when invoking the web service operation is:

org.apache.axis2.AxisFault: Fehler beim Überprüfen der Sicherheit für die Nachricht.

    at org.apache.axis2.util.Utils.getInboundFaultFromMessageContext(Utils.java:531)

    at org.apache.axis2.description.OutInAxisOperationClient.handleResponse(OutInAxisOperation.java:375)

    at org.apache.axis2.description.OutInAxisOperationClient.send(OutInAxisOperation.java:421)

    at org.apache.axis2.description.OutInAxisOperationClient.executeImpl(OutInAxisOperation.java:229)

    at org.apache.axis2.client.OperationClient.execute(OperationClient.java:165)

    at org.tempuri.BestandsabfrageServiceStub.suche(BestandsabfrageServiceStub.java:203)

    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

   at java.lang.reflect.Method.invoke(Method.java:483)

    at coldfusion.xml.rpc.Axis2ServiceProxy.getResult(Axis2ServiceProxy.java:111)

    at coldfusion.xml.r... ''

This is the code

--------------------------------------------------------------------------------------------------------------------------------------------------------------------code

<cfscript>

    wsdl="http://cmstest.gloggsche.de/Services/BestandsabfrageService.svc?wsdl";

    username="firstname.lastname@domain.de";

    password="passPhrase..";

    refresh=false;

</cfscript>

<cfobject name = "ws" wsversion="2"

webservice= "#wsdl#"

username = "#username#"

password = "#password#"

refreshWSDL = "#refresh#"

type = "webservice">

// this is das skeleton das den remote webservice representiert

// writedump(ws);

<cfscript>

// nun stellen wir das argument für den Aufruf bereit

// ich habe extra dies genau gleich gemacht wie ihr aufruf mit soapUI, sprich auch leere werte für optionale parameter

anfrage={};

anfrage.BeckId="";

anfrage.Entscheidungstyp="";

anfrage.NormalisiertesOriginalAktenzeichen="";

anfrage.DatumVon=createDate(2010,8,30);

anfrage.DatumBis=createDate(2010,8,30);

anfrage.GerichtSchluesselOderNummer="cr143837";

anfrage.Sprache="DE";

anfrage.VolltextVorhanden=true;

// nun suchen wir

writedump(ws.suche(anfrage));

//writeDump(ws.Suche(anfrage));

</cfscript>

------------------------------------------------------------------------------------------------------------------------------------------------------soapUI

with soapUI i can consume the webservice with success,

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "POST /Services/BestandsabfrageService.svc HTTP/1.1[\r][\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "Accept-Encoding: gzip,deflate[\r][\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "Content-Type: text/xml;charset=UTF-8[\r][\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "SOAPAction: "http://tempuri.org/IBestandsabfrageService/Suche"[\r][\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "Content-Length: 1788[\r][\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "Host: cmstest.gluggsche.de[\r][\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "Connection: Keep-Alive[\r][\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "User-Agent: Apache-HttpClient/4.1.1 (java 1.5)[\r][\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "[\r][\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "<soapenv:Envelope xmlns:glugg="http://schemas.datacontract.org/2004/07/Glugg.CMS.Definitions.Bestandsabfrage" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "   <soapenv:Header><wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><wsse:UsernameToken wsu:Id="UsernameToken-62F33C3C441C4F5CF814581640048155"><wsse:Username>firstname.lastname@glugg-domain.de</wsse:Username><wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">passphrase</wsse:Password><wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">s/oi9bCZrBYWb8QU7YtPvA==</wsse:Nonce><wsu:Created>2016-03-16T21:33:24.815Z</wsu:Created></wsse:UsernameToken></wsse:Security></soapenv:Header>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "   <soapenv:Body>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "      <tem:Suche>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "         <!--Optional:-->[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "         <tem:anfrage>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <!--Optional:-->[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <glugg:GluggId/>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <!--Optional:-->[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <glugg:DatumBis>2016-02-01</glugg:DatumBis>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <!--Optional:-->[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <glugg:DatumVon>2016-01-29</glugg:DatumVon>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <!--Optional:-->[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <glugg:Entscheidungstyp/>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <!--Optional:-->[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <glugg:GerichtSchluesselOderNummer>BGH</glugg:GerichtSchluesselOderNummer>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <!--Optional:-->[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <glugg:NormalisiertesOriginalAktenzeichen/>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <!--Optional:-->[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <glugg:Sprache>de</glugg:Sprache>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <!--Optional:-->[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "            <glugg:VolltextVorhanden>true</glugg:VolltextVorhanden>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "         </tem:anfrage>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "      </tem:Suche>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "   </soapenv:Body>[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "</soapenv:Envelope>"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "HTTP/1.1 200 OK[\r][\n]"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "Cache-Control: private[\r][\n]"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "Transfer-Encoding: chunked[\r][\n]"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "Content-Type: text/xml; charset=utf-8[\r][\n]"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "Server: Microsoft-IIS/7.0[\r][\n]"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "Set-Cookie: CMSID=2blyrs2xk2xlrykmzwdupb1u; path=/; HttpOnly[\r][\n]"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "X-AspNet-Version: 4.0.30319[\r][\n]"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "X-Powered-By: ASP.NET[\r][\n]"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "Date: Wed, 16 Mar 2016 21:33:27 GMT[\r][\n]"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "[\r][\n]"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "557[\r][\n]"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><s:Header><o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><u:Timestamp u:Id="_0"><u:Created>2016-03-16T21:33:27.202Z</u:Created><u:Expires>2016-03-16T21:38:27.202Z</u:Expires></u:Timestamp></o:Security></s:Header><s:Body><SucheResponse xmlns="http://tempuri.org/"><SucheResult xmlns:a="http://schemas.datacontract.org/2004/07/Glugg.CMS.Definitions.Bestandsabfrage" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:AnzahlErgebnisse>1</a:AnzahlErgebnisse><a:ErgebnisListe><a:Entscheidung><a:GluggId>EN2016004104</a:GluggId><a:Entscheidungsdatum>2016-01-29T00:00:00+01:00</a:Entscheidungsdatum><a:Entscheidungstyp>U</a:Entscheidungstyp><a:GerichtGluggId>cr143837</a:GerichtGluggId><a:GerichtSchluessel>BGH</a:GerichtSchluessel><a:IstMasterGesperrt>false</a:IstMasterGesperrt><a:NormalisiertesOriginalAktenzeichen>VZR28514</a:NormalisiertesOriginalAktenzeichen><a:Sprachen xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>de</b:string></a:Sprachen><a:VolltextVorhanden>true</a:VolltextVorhanden></a:Entscheidung></a:ErgebnisListe><a:Message i:nil="true"/></SucheResult></SucheResponse></s:Body></s:Envelope>"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "[\r][\n]"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "0[\r][\n]"

Wed Mar 16 22:33:25 CET 2016:DEBUG:<< "[\r][\n]"

So what do I the wrong way?

The cerificate was imported zu cacerts.

I tried it  with registering the webservice in the administrator as well.(same result as with cfobject)

What is wrong with my <cfobject>

Sorry for the long text,

best regards

Alec

[BKBK]

The error message says, Fehler beim Überprüfen der Sicherheit für die Nachricht [Failed to verify the security of the message]. This implies you should check and make sure you supply the correct username and password.

[Malvina]

checked the username/pw again.

It is the same as in the successful call with soapUI (see lines below). When i see it,  i ask me wether Coldfusion can produce these tokens..

----------------------------snippet of successful call ------------------------

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "<soapenv:Envelope xmlns:glugg="http://schemas.datacontract.org/2004/07/Glugg.CMS.Definitions.Bestandsabfrage" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">[\n]"

Wed Mar 16 22:33:24 CET 2016:DEBUG:>> "   <soapenv:Header><wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><wsse:UsernameToken wsu:Id="UsernameToken-62F33C3C441C4F5CF814581640048155"><wsse:Username>firstname.lastname@glugg-domain.de</wsse:Username><wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#Passwor dText">passphrase</wsse:Password><wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Bi nary">s/oi9bCZrBYWb8QU7YtPvA==</wsse:Nonce><wsu:Created>2016-03-16T21:33:24.815Z</wsu:Created> </wsse:UsernameToken></wsse:Security></soapenv:Header>[\n]"

----------------------------/snippet

[BKBK]

Just to get one further issue out of the way, your code implies that the domain is gloggsche.de, whereas the SOAPUI example uses gluggsche.de.

[Malvina]

Sorry, a mistake during anonymization of the cf-code and  soapUI log.

glogg and glugg are synonym. In case they follow the original (Glugg/glugg).
Thank you for careful reading.:).

[Malvina]

This i the webservice-call i can send with soapUI.

it delivers the wanted reply.

How ca i do this with coldfusion11.
How do i provide the Tokens.

In the Moment i cant read the webservice calls from coldfusion.

With fiddler i dd not succeed. In cf9 there was tcpmon. Do i have to  install wireshark?

---------------------soapUI-call--------------------

POST https://cmstest.gluggsche.de/Services/BestandsabfrageService.svc HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: "http://tempuri.org/IBestandsabfrageService/Suche"
Content-Length: 1788
Host: cmstest.gluggsche.de
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)

<soapenv:Envelope xmlns:glugg="http://schemas.datacontract.org/2004/07/Glugg.CMS.Definitions.Bestandsabfrage" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
   <soapenv:Header><wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><wsse:UsernameToken wsu:Id="UsernameToken-98DAFC15334EBD6F1814585039979784"><wsse:Username>firstname.lastname@domain.de</wsse:Username><wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">..passphrase_</wsse:Password><wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">bb2bdI6Sl2QqaWALGz0kCA==</wsse:Nonce><wsu:Created>2016-03-20T19:59:57.978Z</wsu:Created></wsse:UsernameToken></wsse:Security></soapenv:Header>
   <soapenv:Body>
      <tem:Suche>
         <!--Optional:-->
         <tem:anfrage>
            <!--Optional:-->
            <glugg:GluggId/>
            <!--Optional:-->
            <glugg:DatumBis>2016-03-01</glugg:DatumBis>
            <!--Optional:-->
            <glugg:DatumVon>2016-02-24</glugg:DatumVon>
            <!--Optional:-->
            <glugg:Entscheidungstyp/>
            <!--Optional:-->
            <glugg:GerichtSchluesselOderNummer>BGH</glugg:GerichtSchluesselOderNummer>
            <!--Optional:-->
            <glugg:NormalisiertesOriginalAktenzeichen/>
            <!--Optional:-->
            <glugg:Sprache>de</glugg:Sprache>
            <!--Optional:-->
            <glugg:VolltextVorhanden>true</glugg:VolltextVorhanden>
         </tem:anfrage>
      </tem:Suche>
   </soapenv:Body>
</soapenv:Envelope>

[Charlie Arehart]

Malvina, it seems the issue is that you are consuming a web service that uses WSS (a particular form of security), which had not supported over the years. (See the references in your xml below to “wss’”.) And as you conclude, you’re needing to pass in that usernametoken..

Knowing that, if you do some searching for ColdFusion and wss you’ll find various resources discussing how to get things to work. Just be aware that each ay be referring to a different CF version.

I present here 3 possibilities you may want to consider. I’ve not tried them myself. Just wondering if any may help you.

1) For instance, one resource from the CF9 era shows some CFML code for making such a call by passing that token manually:

http://www.mikeobrien.net/blog/consuming-web-service-that-requires-wss/

It may not be EXACLY what you need, but since you’re comfortable with SoapUI (and even were considering dropping to wireshark), you may be able to connect the dots to get things working.

2) There’s another blog post, which seems from the CF10 or 11 era (2011), which proposes using some alternative java libraries. Just beware that that may not be needed in the CF11 you’re using (which has updated libraries over CF10 or 9):

http://onlineanthony.blogspot.com/2010/05/using-ws-security-for-soap-in.html

But note at least that it’s got a lot of comments, any of which may also prove helpful for you.

3) Finally, I’ll note that I see some resources that suggest the new axis-2 support (added in CF10) may inherently add support for this ws authentication, but I see that you have added the wsversion=”2” to your code, and it hasn’t helped.

Let us know if any of the rest above may help.

(FWIW, if you or anyone may come across mentions in the past that a future release of CF would add support for WSS, it DID happen, in CF11, but it was only for the websockets feature, not web services. More at https://helpx.adobe.com/coldfusion/developing-applications/coldfusion-and-html-5/using-coldfusion-websocket/websocket-enhancements.html).

/charlie

[Malvina]

Hi Charlie,

Tested the approaches, but none was successfull.

To add a static header is possible, but addition of the calculated tokens fails.

I can produce the xml as below, but could not manage to add the tokens (see the *)  properly.

As cf2016 has a similar set of axis2.jars as cf11, it failed as well.

From the idea "give the wsdl-file to coldfusion/axis it will do the job" i feel far away.

do you see a way to add the tokens ?

How to calculate the tokens? Are there other java-libs i have to integrate? rampart?

ws-security seems to be popular with microsoft products

<soapenv:Envelope xmlns:glugg="http://schemas.datacontract.org/2004/07/Glugg.CMS.Definitions.Bestandsabfrage" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">

    <soapenv:Header>

        <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">

*            <wsse:UsernameToken wsu:Id="UsernameToken-88EDF154942BEC248614600377485574">

                <wsse:Username>lastname.firstname@glugg-domain.de</wsse:Username>

                <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">..passwphrase..</wsse:Password>

*                <wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">3zCrgLib0kMUgaozGHPbGA==</wsse:Nonce>

                <wsu:Created>2016-04-07T14:02:28.557Z</wsu:Created>

            </wsse:UsernameToken>

        </wsse:Security>

    </soapenv:Header>

    <soapenv:Body>

....  calls the method and provides arguments

    </soapenv:Body>

</soapenv:Envelope>

[BKBK]

This might help: a tip from Mike O'Brien for consuming WSS web services

In your case, start with something like this:

<cfscript>

    wsdl="http://cmstest.gloggsche.de/Services/BestandsabfrageService.svc?wsdl";

    username="firstname.lastname@domain.de";

    password="passPhrase..";

    refresh=false;

</cfscript>

<cfobject name = "ws" wsversion="2"

webservice= "#wsdl#"

username = "#username#"

password = "#password#"

refreshWSDL = "#refresh#"

type = "webservice">

// this is das skeleton das den remote webservice representiert

// writedump(ws);

<cfscript>

// nun stellen wir das argument für den Aufruf bereit

// ich habe extra dies genau gleich gemacht wie ihr aufruf mit soapUI, sprich auch leere werte für optionale parameter

anfrage={};

anfrage.BeckId="";

anfrage.Entscheidungstyp="";

anfrage.NormalisiertesOriginalAktenzeichen="";

anfrage.DatumVon=createDate(2010,8,30);

anfrage.DatumBis=createDate(2010,8,30);

anfrage.GerichtSchluesselOderNummer="cr143837";

anfrage.Sprache="DE";

anfrage.VolltextVorhanden=true;

// implement WSS security

addCredentials(ws, username, password);

// nun suchen wir

writedump(ws.suche(anfrage));

//writeDump(ws.Suche(anfrage));

</cfscript>

<cfscript>

function addCredentials(service, username, password)

{

      wssNamespace = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";

      header = createObject("java", "org.apache.axis.message.SOAPHeaderElement");

      header.init(wssNamespace, "wsse:Security");

      header.addChildElement("wsse:UsernameToken");

      header.getFirstChild().addChildElement("wsse:Username").setValue(username);

      header.getFirstChild().addChildElement("wsse:Password").setValue(password);

      header.setMustUnderstand(1);

      service.setHeader(header);

}

<cfscript>

[Charlie Arehart]

"Great minds." 🙂

I'm guessing you didn't see that I shared that link last night, along with other info. But good on ya' for going ahead and coding it up.

Looking forward to hearing if that approach or the other I offered may get Malvina going.

[BKBK]

Apologies, Charlie. I didn't see the link.

Your remark on WSS immediately rang a bell. So I googled wss web service coldfusion ​and, hey presto!

[Malvina]

Thank you to both of you for this pretty bunch of hints and tips, i give feedback the other day.

Alec