WSSecurityException Error

[sakasaka19]

Hello
After sending a transmission using Phase 4, I received a signal message from one of the recipients.
However, a WSSecurityException error occurred when receiving the signal message.

When I checked the signal message, I found that there were multiple "BinarySecurityToken" elements, but only one "SignatureInfo" element.
Is this something wrong with the signal message?
Or is there something wrong with the sender's configuration?
In case you are wondering, the following log is output.
Failed to process SOAP header element {http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Security with processor com.helger.phase4.servlet.soap.SOAPHeaderElementProcessorWSS4J@3b0c3951; error details: [ [ SingleError@0x060f77af: ErrorLevel=ERROR; ErrorID=EBMS:0102; ErrorLocation=[]; ErrorText=[Text=[Processing] The encrypted data reference the Security header intended for the \"ebms\" SOAP actor could not be decrypted by the Security Module.] ] ]

Best regards

[phax]

Hello,
The "BinarySecurityToken" is usually the Base64 encoded X.509 certificate. So if it contains 2 it is okay - one for the public certificate used for signing and one for the public part used to encrypt it.
Inside the "SignatureInfo" element should be an ID that points to the correct "BinarySecurityToken" that is to be used for signature verificiation.

The error message [Processing] The encrypted data reference the Security header intended for the \"ebms\" SOAP actor could not be decrypted by the Security Module. indicates, that the sender was using the wrong certificate for encrypting the message.

If you are using this in the context of Peppol, did you eventually forget to update the Endpoint certificate in the Peppol SMP???

hth, Philip

[sakasaka19]

Thanks for the answer.
I checked my certificate and it was fine.
I tried sending to TestBed 2.0 (Beta version) which was recently released and I still get a WSSecurityException Error.
The SignalMessage from TestBed is like this, do you know the cause?

<?xml version="1.0" encoding="UTF-8"?> <S12:Envelope xmlns:S12="http://www.w3.org/2003/05/soap-envelope"> <S12:Header> <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" S12:mustUnderstand="true"> <wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="X509-4fd39b88-33e7-4da2-98e5-e9aba3a3414d">MIIFxDCCA6ygAwIBAgIQUe4KUBFI+s30LJLw2nUfZDANBgkqhkiG9w0BAQsFADBrMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQT3BlblBFUFBPTCBBSVNCTDEWMBQGA1UECxMNRk9SIFRFU1QgT05MWTEpMCcGA1UEAxMgUEVQUE9MIEFDQ0VTUyBQT0lOVCBURVNUIENBIC0gRzIwHhcNMjEwMzE4MDAwMDAwWhcNMjMwMzA4MjM1OTU5WjBRMQswCQYDVQQGEwJCRTEZMBcGA1UECgwQT3BlblBlcHBvbCBBSVNCTDEXMBUGA1UECwwOUEVQUE9MIFRFU1QgQVAxDjAMBgNVBAMMBVBQX0MzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyT/VCkrzsKE0l664wPoAzpLSloyqeYmgcJ7Z+AsscgN8DWBev0jYrTXKb/XuaKFPFYs2yVEFqBToGSj2z8M2IJqTyUr/tOsTeNzUK11tJXLRs1497ZPyozWZugulPEs1ona2nQffd+FCAWlh+ln3intv+jA4L4zhrA/2uOJh8CnDPQzYpFcjaNyj9pruhRwADOL5MmDlpFh2rOy8DOkloDhYvxAtnx6AaPQmxg/MfuT7VpE8fX4PtwZz2PeuEILpZsePoTJx6PRqJ6VQ89x5Y6PA59iVEKtRZguiBQ498/JsuMLsTt3e1Zx7Z5f28SzKgfjVZnvyZM5Li7LScEHX5wIDAQABo4IBfDCCAXgwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCA6gwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFMrMqAuvgE00ysIGFJ5MNxDmtMy0MF0GA1UdHwRWMFQwUqBQoE6GTGh0dHA6Ly9wa2ktY3JsLnN5bWF1dGguY29tL2NhXzZhOTM3NzM0YTM5M2EwODA1YmYzM2NkYThiMzMxMDkzL0xhdGVzdENSTC5jcmwwNwYIKwYBBQUHAQEEKzApMCcGCCsGAQUFBzABhhtodHRwOi8vcGtpLW9jc3Auc3ltYXV0aC5jb20wHwYDVR0jBBgwFoAUa29LtvE3uis8fxjNuiuyuXwqN+swLQYKYIZIAYb4RQEQAwQfMB0GE2CGSAGG+EUBEAECAwEBgamQ4QMWBjk1NzYwODA5BgpghkgBhvhFARAFBCswKQIBABYkYUhSMGNITTZMeTl3YTJrdGNtRXVjM2x0WVhWMGFDNWpiMjA9MA0GCSqGSIb3DQEBCwUAA4ICAQABaxs22QIjArTWOL3rWhw4rN7Lt4UANYYMUK/jlBoW8Xfu/w+uyulYWvrOJGkH69+SA+gY4+7vZ7FlChZxo18Q8RN/E/cPfnPRtD06AjJk02EHnwQv7/FOq7RnaQznkeAgwQCUz8MGFJZfDJjSKewrDQIQYw6zNbohdfhg7isyJpCaUNQupI29pObUsfixjAKJsIrrI6aFa41eU+oZCIg50clGOOTIaocgJylKoozhD4KwKGAA7HWTDahVh5Rh9Kyj76rDzh9CTh4uQjX5a99l4FIvLGKWYbc/eFHXCj9DFRJp3bYO0IK23efERXTpbMkfbec5QAD8CvGJ8Pc30mHKJoYRU6+ElvsoPm2wGb0CL+BNuQu1rjHz8CmXVFhUD7q1RUhzNvou/HcS2d4lHt0bl4PUcmaoBFBu3bgKEGhAASUG5X2jEyDn0bq8D6WAvWbM8Ar4WMwEZfw3UGs3jkhR3D04i/r6Nch5xtC9V9vN5tgzKt3HkWczvosz0NdCEh/6fFMvxzDj5aLBZa3DBvpjQmzuRFPNdH+mtG3AIl9H6GrZd2iTPyRAEGVv4CI1J20pVBOV3kq/k2TJO6Dt4JaH4v/KbW/6dxFEplJ2eqOl+aAuoZsFaqF5IK/CH7Le7MmFq3G3IcsryCVBQuescj6b0qQToxWw15+Ejbq0IxLmMA==</wsse:BinarySecurityToken> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="SIG-97a3e7a7-8030-44ea-a3ee-7760918a7d79"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="S12" /> </ds:CanonicalizationMethod> <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /> <ds:Reference URI="#phase4-msg-1d56b35c-fd28-4355-9671-977bb369e6b2"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /> <ds:DigestValue>DHBPwUmiAA/i4Yb9rOMz7cIBLqvYU8mB5pZT4cjtAHE=</ds:DigestValue> </ds:Reference> <ds:Reference URI="#id-4c5531a7-05e6-4f28-ac10-33e7b820af77"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /> <ds:DigestValue>EdwwGG150OdyzQLIrm3TkXzkvrLSRnXmkrXLIbeSv5U=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue>Wh4r0Xhcz7BhW5yZVzd/5DEIdUHNGzRERjfL/eM0MeTiXryVAEjZTVrX3ZfdsMRHvEfkY7Rj/2WO2dRVYT4qbNTNy/gmo4yrakggjBg/4hk5+I3zT6t8tHXosd0VTKyywrLhp8KHwsCSZnyuwTNokzIswMvxrAkptjJ8m3U1mMg1zoDiwIy/6n2IR1BUygVdlS0iyZyO8uvWJW0fkEs4BrBSBa0KtRoVbrDtjG2nFFO643apLPw9G7oJRM2e5rHBCWztul4N61lMBaK6HYKJpoUkWi6nloeWX8/ziTqgxJryLa2vAyfvR5JMsb4GgpOeOXKqCWMY//yciTEyyUYZqg==</ds:SignatureValue> <ds:KeyInfo Id="KI-b67ce804-b70f-407a-957f-5822258e2c55"> <wsse:SecurityTokenReference wsu:Id="STR-364c0880-47c6-4dca-9528-7bd835a03646"> <wsse:Reference URI="#X509-4fd39b88-33e7-4da2-98e5-e9aba3a3414d" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" /> </wsse:SecurityTokenReference> </ds:KeyInfo> </ds:Signature> </wsse:Security> <eb:Messaging xmlns:S11="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:eb="http://docs.oasis-open.org/ebxml-msg/ebms/v3.0/ns/core/200704/" xmlns:ebbp="http://docs.oasis-open.org/ebxml-bp/ebbp-signals-2.0" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:xlink="http://www.w3.org/1999/xlink" S12:mustUnderstand="true" wsu:Id="phase4-msg-1d56b35c-fd28-4355-9671-977bb369e6b2"> <eb:SignalMessage> <eb:MessageInfo> <eb:Timestamp>2022-11-11T06:12:01.272Z</eb:Timestamp> <eb:MessageId>8eed7f0f-93e6-4805-aa46-8286445edb59@phase4.openpeppol.playground</eb:MessageId> <eb:RefToMessageId>XXXXXXXXXXXXXXXXXXXXXXXXXXX</eb:RefToMessageId> </eb:MessageInfo> <eb:Receipt> <ebbp:NonRepudiationInformation> <ebbp:MessagePartNRInformation> <ds:Reference URI="#phase4-msg-10b85318-906e-4ed9-a171-c23d783cb685"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /> <ds:DigestValue>KI0m9AGdyyOdc0W61kttSaWl+2kYqp7bi7F+5WcM+sw=</ds:DigestValue> </ds:Reference> </ebbp:MessagePartNRInformation> <ebbp:MessagePartNRInformation> <ds:Reference URI="#id-f4ecfbfb-03e5-46dd-abce-78ba80ae6b8d"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /> <ds:DigestValue>S9aSf2t1oz9fHugKcBBRtNe60KBrrp9DD1cW83XC1nE=</ds:DigestValue> </ds:Reference> </ebbp:MessagePartNRInformation> <ebbp:MessagePartNRInformation> <ds:Reference URI="cid:phase4-att-e13ac763-ee2c-4a57-b6c2-3938cc5b98fc@cid"> <ds:Transforms> <ds:Transform Algorithm="http://docs.oasis-open.org/wss/oasis-wss-SwAProfile-1.1#Attachment-Content-Signature-Transform" /> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /> <ds:DigestValue>NAPiqli7fejSTOwwaasFQzW2UR10P0/2eEKAjOHrLxM=</ds:DigestValue> </ds:Reference> </ebbp:MessagePartNRInformation> </ebbp:NonRepudiationInformation> </eb:Receipt> </eb:SignalMessage> </eb:Messaging> </S12:Header> <S12:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="id-4c5531a7-05e6-4f28-ac10-33e7b820af77" /> </S12:Envelope>

[phax]

@sakasaka19 that message indicates Success :)
If the response SignalMessage contains an eb:Receipt your are good.
It may however be the case, that you are facing a Testbed specific error here.

[sakasaka19]

Thanks for the reply.
I will try again when the Testbed version changes.