PK85910: THE WS-SECURITY RUNTIME DOES NOT SKIP AN UNRECOGNIZED SAML TOKEN WHEN MUSTUNDERSTAND='0' IN THE SOAP SECURITY HEADER

Fixes are available

APAR status

Closed as program error.

Error description

When a SAML token is sent in the WS-Security header of a SOAP
message, the WS-Security runtime will always encounter the
following error, regardless of the mustUnderstand setting:

faultCode:
{http://schemas.xmlsoap.org/soap/envelope/}Server.securityExcept
ion
faultString: com.ibm.wsspi.wssecurity.SoapSecurityException:
WSEC5503E:
Unknown element wsse:SecurityTokenReference in the wsse:Security
element.
faultActor: null
faultDetail:
com.ibm.wsspi.wssecurity.SoapSecurityException: WSEC5503E:
Unknown element wsse:SecurityTokenReference in the wsse:Security
element.
   at com.ibm.ws.webservices.engine.WebServicesFault.
makeUserFault(WebServicesFault.java:223)
   at com.ibm.ws.webservices.wssecurity.handler.
WSSecurityConsumerBase.invoke(WSSecurityConsumerBase.java:101)
.
The wsse:Security header with a SAML token looks as follows.
<wsse:Security>
  <wsse:SecurityTokenReference soapenv:mustUnderstand="1"
wsu:Id="
SecurityTokenReference-3720982240">
    <wsse:Embedded>
      <saml:Assertion>
        ...
      </saml:Assertion>
    </wsse:Embedded>
  </wsse:SecurityTokenReference>
</wsse:Security>

NOTE: This is a problem that did not exist prior to WebSphere
Application Server 6.0.2.29.

Local fix

Taking the SAML token out of the SecurityTokenReference
and putting it straight under the wss:security header works
example

<wsse:Security>
  <saml:Assertion>
        ...
  </saml:Assertion>
</wsse:Security>

Problem summary

****************************************************************
* USERS AFFECTED:  WebSphere Application Server users of       *
*                  WS-Security enabled web services            *
*                  applications that receive SAML tokens       *
****************************************************************
* PROBLEM DESCRIPTION: The WS-Security runtime does not skip   *
*                      an unrecognized SAML token when         *
*                      mustUnderstand='0' in the SOAP          *
*                      Security header                         *
****************************************************************
* RECOMMENDATION:  Install a fix pack that contains this APAR. *
****************************************************************
When a SAML token is sent in the WS-Security header of a SOAP
message, the WS-Security runtime will ordinarily throw an
exception unless a custom handler is configured for the SAML
token.  If mustUnderstand='0' in the WS-Security header, the
SAML token should be skipped by the WS-Security runtime, but an
exception still occurs.

A message similar to the following can be found in the trace
or an FFDC log:

faultCode:
{http://schemas.xmlsoap.org/soap/envelope/}Server.securityExcept
ion
faultString: com.ibm.wsspi.wssecurity.SoapSecurityException:
WSEC5503E:
Unknown element wsse:SecurityTokenReference in the wsse:Security
element.
faultActor: null
faultDetail:

com.ibm.wsspi.wssecurity.SoapSecurityException: WSEC5503E:
Unknown element wsse:SecurityTokenReference in the wsse:Security
element.

at com.ibm.ws.webservices.engine.WebServicesFault.
makeUserFault(WebServicesFault.java:223)

at com.ibm.ws.webservices.wssecurity.handler.
WSSecurityConsumerBase.invoke(WSSecurityConsumerBase.java:101)
...

Problem conclusion

The root of the problem is that, when an element occurs in the
wsse namespace, and the element is not explicitly
BinarySecurityToken or UsernameToken, an error will occur
regardless of the mustUnderstand setting.  Because the SAML
token is a SecurityTokenReference in the wsse namespace, an
error will occur regardless of the mustUnderstand setting.

The WS-Security runtime was updated to honor the
mustUnderstand setting when tokens are encountered in the wsse
namespace that are not a BinarySecurityToken or a
UsernameToken.  This, in effect, will enable the WS-Security
runtime to skip an unrecognized SAML token when the
mustUnderstand setting for the SOAP Security header is '0'.

The wsse namespace is:
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecuri
ty-secext-1.0.xsd

The fix for this APAR is currently targeted for inclusion in
fix packs 6.0.2.39, 6.1.0.29, 7.0.0.7.  Please refer to the
Recommended Updates page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Temporary fix

Comments

APAR Information

APAR number
PK85910
Reported component name
WEBSPHERE APP S
Reported component ID
5724J0800
Reported release
60A
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2009-05-05
Closed date
2009-07-11
Last modified date
2009-09-24

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBSPHERE APP S
Fixed component ID
5724J0800

Applicable component levels

R60A PSY
UP
R60H PSY
UP
R60I PSY
UP
R60P PSY
UP
R60S PSY
UP
R60W PSY
UP
R60Z PSY
UP
R61A PSY
UP
R61H PSY
UP
R61I PSY
UP
R61P PSY
UP
R61S PSY
UP
R61W PSY
UP
R61Z PSY
UP
R700 PSY
UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"6.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
29 December 2021

Tips

PK85910: THE WS-SECURITY RUNTIME DOES NOT SKIP AN UNRECOGNIZED SAML TOKEN WHEN MUSTUNDERSTAND='0' IN THE SOAP SECURITY HEADER

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R60A PSY

R60H PSY

R60I PSY

R60P PSY

R60S PSY

R60W PSY

R60Z PSY

R61A PSY

R61H PSY

R61I PSY

R61P PSY

R61S PSY

R61W PSY

R61Z PSY

R700 PSY

Document Information

Share your feedback

Need support?