[JBossWS] - Re: MTOM + WS Security = problem
by mrostan
Hi, we are also trying to use WS-Security + MTOM in JBossWS 2.0.1 and 2.0.3, we are sending big files so we need binary attachments instead of inline encoded data.
Here is the result of our tests:
- In JBossWS 2.0.1 you must change the configuration of the endpoint by adding ##SOAP11_HTTP_MTOM to the bindings protocol:
| <javaee:protocol-bindings>##SOAP11_HTTP ##SOAP11_HTTP_MTOM</javaee:protocol-bindings>
|
If ##SOAP11_HTTP_MTOM is not present, the handler is ignored, and the signature is not verified.
- In JBossWS 2.0.3 you don't need to add ##SOAP11_HTTP_MTOM, it seems to consider the handler anyway.
- In both versions we had problems sending the binary as an attachment (using SoapUI), we always receive: Signature is invalid
- Using a JBossWS client, we didn't find a way to send the binary data as an attachment, it is sent always encoded inline.
- If the binary data is sent inline the signature is verified (from the JBossWS client and also from SoapUI)
- So, we could not make MTOM + Attachments + WS-Security work together
Instead, we have moved to swaRef (simply annotating with @XmlAttachmentRef a DataHandler field) and everything works fine, you can remove the BindingType for MTOM.
- So, we have now swaRef + WS-Security working fine
There is some important difference between MTOM and swaRef? swaRef comes from ws-i, so I expect no interoperability problems.
Somebody has MTOM and WS-Security working?
Thanks,
Martin
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4131550#4131550
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4131550
18 years, 2 months