Forum Discussion

ericacm's avatar
ericacm
Occasional Contributor
15 years ago

Cannot create outgoing WSS signature

Hi all:

I have created a simple keystore using:

keytool -genkey -dname "cn=Mark Jones, ou=JavaSoft, o=Sun, c=US" -alias genkey -keystore gen.keystore -storepass genkey -keypass genkey

I have added the keystore to SoapUI and it says the keystore status is OK.   On the keystore I set the default alias and alias password to genkey (I have also tried no alias/password).

Next I go to Outgoing WS-Security configurations, add a configuration and add a Signature to that configuration.   When I choose the Keystore that I added previously it dumps an error to stdout and no aliases are available to choose from.   Also if I send a request with this configuration no signature is added to the request.

Error message from stdout:
org.apache.ws.security.components.crypto.CredentialException: Failed to load credentials.
at org.apache.ws.security.components.crypto.AbstractCrypto.load(AbstractCrypto.java:174)
at com.eviware.soapui.impl.wsdl.support.wss.crypto.KeyMaterialWssCrypto$KeyMaterialCrypto.load(KeyMaterialWssCrypto.java:241)
at org.apache.ws.security.components.crypto.AbstractCrypto.(AbstractCrypto.java:135)
at org.apache.ws.security.components.crypto.AbstractCrypto.(AbstractCrypto.java:52)
at org.apache.ws.security.components.crypto.Merlin.(Merlin.java:66)
at com.eviware.soapui.impl.wsdl.support.wss.crypto.KeyMaterialWssCrypto$KeyMaterialCrypto.(KeyMaterialWssCrypto.java:222)
at com.eviware.soapui.impl.wsdl.support.wss.crypto.KeyMaterialWssCrypto$KeyMaterialCrypto.(KeyMaterialWssCrypto.java:218)
at com.eviware.soapui.impl.wsdl.support.wss.crypto.KeyMaterialWssCrypto.getCrypto(KeyMaterialWssCrypto.java:81)
at com.eviware.soapui.impl.wsdl.support.wss.entries.WssEntryBase$KeyAliasComboBoxModel.update(WssEntryBase.java:267)
at com.eviware.soapui.impl.wsdl.support.wss.entries.AddSignatureEntry$1.itemStateChanged(AddSignatureEntry.java:81)
...
at java.awt.EventDispatchThread.run(EventDispatchThread.java:122)
Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:771)
at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:38)
at java.security.KeyStore.load(KeyStore.java:1185)
at org.apache.ws.security.components.crypto.AbstractCrypto.load(AbstractCrypto.java:168)
... 64 more
Caused by: java.security.UnrecoverableKeyException: Password verification failed
at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:769)
... 67 more

SoapUI 3.5.1 2010/04/09
Mac OSX 10.5.8
java version "1.6.0_17"
Java(TM) SE Runtime Environment (build 1.6.0_17-b04-248-9M3125)
Java HotSpot(TM) 64-Bit Server VM (build 14.3-b01-101, mixed mode)

Thanks!

3 Replies

Sort By
  • ericacm's avatar
    ericacm
    Occasional Contributor
    15 years ago
    Update - I tried this on my PC and it worked.  So it's either a Mac-specific thing or something with my Mac in particular.  I will try it on another Mac and let you know how it worked,
  • ericacm's avatar
    ericacm
    Occasional Contributor
    15 years ago
    So it turns out that Apple changed the password on the cacerts keystore file.  By default, WSS4J tries to open that file with the "default" password of "changeit".  Some clever dude on the Apple Java mailing list found they had changed it to "changeme" (see http://lists.apple.com/archives/java-de ... 00097.html)

    There are a few ways to solve the problem.  Two are:
    1. Change the password on the cacerts keystore back to "changeit".    This is what I've done to get SoapUI working.  I'm not thrilled about this approach because who knows what is going to break.  Hopefully Apple will fix the problem.

    2. Add the following WSS4J property org.apache.ws.security.crypto.merlin.load.cacerts=false.  This would require hacking the soapui source (see src/java/com/eviware/soapui/impl/wsdl/support/wss/crypto/MerlinCrypto.java) which I am even less thrilled about.  Perhaps Eviware can put that in one of the upcoming releases.  I am not sure if SoapUI is dependent on the cacerts functionality of WSS4J - it doesn't seem to be but I wouldn't want to risk it.
  • ericacm's avatar
    ericacm
    Occasional Contributor
    14 years ago
    Looks like this is fixed with the latest Java update from Apple (java version "1.6.0_20")