Developing a Quarkus-CXF Application SOAP Client with Client Cert

[kaquintyn]

I'm building a SOAP Client with Quarkus CXF and generating the client stubs with the cxf-codegen-plugin, etc. I'm able to build/populate the appropriate client stub classes to formulate and make the request. However, the SOAP Request requires a client certificate. I have the truststore file (*.jks) and password, how do I configure this to work or be applied when the SOAP Request is made?

Regards,

KQ

[shumonsharif]

Hi @kaquintyn You can set the TLS client parameters on HTTPConduit.

Take a look at the link below for some examples, and let us know if you need further details.

https://quarkiverse.github.io/quarkiverse-docs/quarkus-cxf/dev/user-guide/advanced-soap-client-topics.html#code-config

[kaquintyn]

Thanks for the link. I found some great info. However, I misspoke or misunderstood what was required. Specifically, I need to sign the SOAP request using the client certificate. It looks like this is possible via configuring a WSS4JOutInterceptor (https://quarkiverse.github.io/quarkiverse-docs/quarkus-cxf/dev/reference/extensions/quarkus-cxf-rt-ws-security.html). I was able to configure it but unfortunately when I attempt to build I get the below exception/failure:

[ERROR] Failed to execute goal on project XXXXXXX Could not resolve dependencies for project XXXXXXXX The following artifacts could not be resolved: org.opensaml:opensaml-saml-impl:jar:4.2.0, org.opensaml:opensaml-xacml-impl:jar:4.2.0, org.opensaml:opensaml-xacml-saml-impl:jar:4.2.0: Failure to find org.opensaml:opensaml-saml-impl:jar:4.2.0 in https://nexus.enterprise-tools/XXXXXXXXX was cached in the local repository, resolution will not be reattempted until the update interval of delta-nexus has elapsed or updates are forced.

I cannot get the libraries because they are not found in our nexus repo.....nor do I think we are allowed to use these libraries due to the vulnerabilities. I'm not sure what to do at this point.

[shumonsharif]

@kaquintyn Have you tried forcing maven dependency updates using the -U flag? Also, assuming there is an opensaml version that addresses the vulnerabilities of concern, you should be able to override those dependencies in your local project. Feel free to attach a small reproducer in case you need help with it.

[ppalaga]

generating the client stubs with the cxf-codegen-plugin,

Tip: In recent 1.5.x and 2.1.x versions, you can use the built-in code generation instead of cxf-codegen-plugin : https://quarkiverse.github.io/quarkiverse-docs/quarkus-cxf/dev/user-guide/generate-java-from-wsdl.html

I need to sign the SOAP request using the client certificate

Our WS-SecurityPolicy test is doing something like that around here:

quarkus-cxf/integration-tests/ws-security-server/src/test/java/io/quarkiverse/cxf/it/ws/securitypolicy/server/CxfWssSecurityPolicyServerTest.java

Lines 26 to 39 in fa47ec7

	void encrypetdSigned() throws IOException {
	WssSecurityPolicyHelloService client = getPlainClient();
	Map<String, Object> ctx = ((BindingProvider) client).getRequestContext();
	ctx.put(SecurityConstants.CALLBACK_HANDLER, new PasswordCallbackHandler());
	ctx.put(SecurityConstants.SIGNATURE_PROPERTIES,
	Thread.currentThread().getContextClassLoader().getResource("alice.properties"));
	ctx.put(SecurityConstants.SIGNATURE_USERNAME, "alice");
	ctx.put(SecurityConstants.ENCRYPT_USERNAME, "bob");
	ctx.put(SecurityConstants.ENCRYPT_PROPERTIES,
	Thread.currentThread().getContextClassLoader().getResource("alice.properties"));
	Assertions.assertThat(client.sayHello("foo")).isEqualTo("Secure Hello foo!");
	}

That's a test class code, but something should work also in an application. Take care to have all required dependencies the test's pom.xml has.