Forum Discussion

Fredrik_Granstr's avatar
Fredrik_Granstr
Occasional Contributor
17 years ago

WSDL security

Hi,
  I am a new user for this tool and I have some problem to understand how to setup a security configuration for SoapUI 2.5

- I create a project with my WSDL file
- Dubble click on the project file and start to modify the "Sequrity configuration" tab
* Add my KeyStore
* Add a new WS-Sequrity Configurations called "testout" (Signature: Keystore, password, X509-Certificate, #rsa-sha1, #wothComments, Use Single Certificate, added all parts)

I then open my soap request (getAspects) and select "Aut" in the button of the window. In Aut window I select testout for Outgoing WSS, all other field are blank.

When I press the run button (green) i always get the same replay and that is: "Security Requirements not met - No Security header in message"

So, can someone please give me some tips of what I am missing?

I have attached the WSDL file I use.

15 Replies

Show More
  • omatzura's avatar
    omatzura
    Super Contributor
    17 years ago
    Hi,

    ok.. then I'm sorry to say that this is a limitation in the WS-Security support, ie it doesn't support SAML 2.0. I'll put this on our list for an upcoming version.

    How could we work around this? Could you add the assertion "manually" with a property-transfer or something?

    Sorry for the inconvenience..

    regards!

    /Ole
    evwiare.com
  • Fredrik_Granstr's avatar
    Fredrik_Granstr
    Occasional Contributor
    17 years ago
    Hi,
      I think manually is ok for now. Can you tell me more about how I can add a SAML assertion to the SOAP security header information.

    Regards,

      Fredrik
  • omatzura's avatar
    omatzura
    Super Contributor
    17 years ago
    Hi!

    well, you would have to add a static WS-Security header to your request (ie not use the automatic feature in soapUI) and then a property-transfer from the previous response that transfers the assertion to the corresponding (prepared) element in the WS headers..

    regards!

    /Ole
    eviware.com
  • Fredrik_Granstr's avatar
    Fredrik_Granstr
    Occasional Contributor
    17 years ago
    Hi again,
      Don't know if I missunderstand you. Today I have configured my security header in the "Security Configurations" (TimeStamp, Signature). To activate this security header I open the request and select "Aut" tab and press the "outgoing WSS" button where I can select my security configuration. I also select the "WS-A" tab and select the checkbutton (Enable WS-A addressing).

    If I understan you correct I should remove all above and intead create my own security header. That is no problem, I have examples of headers so I can just copy and paste them. But I do not know where I can add not find where I can add this security header in soapUI.

    PS! We have bought IBM Rational Soa Tester for $$$$ and it can not handle SAML2.0 either. So I have requested a soapUIpro license now. A looked at your video and I think we can do the same performance tests with this tool so maybe we can kick out IBM now. :-)
  • omatzura's avatar
    omatzura
    Super Contributor
    17 years ago
    Hi!

    Remove the outgoing wss setting as you said (otherwise these will always get added to outgoing requests) and instead add these headers statically to the message from the request editors' right-button menu (Outoing WSS->...). The inserted headers can then be used as target for your transfers..

    Does that help?

    regards!

    /Ole
    eviware.com