In order to be able to connect to a SOAP+WSDL WebService from CMS (Medicare) I need to be able to:
- Include a timestamp element on the header which must be digitally signed
- Add the Services Security Binary Security Token to the Header
- Digitally sign an element of the Body (Payload)
I have used Eclipse/Axis2 to generate the WebService client using this WSDL:
http://www.caqh.org/SOAP/WSDL/CORERule2.2.0.wsdl
And I have engaged Rampart to the Axis2 service client:
CoreStub stub = new CoreStub();
ServiceClient sc = stub._getServiceClient();
sc.engageModule("rampart");
Options options = sc.getOptions();
options.setProperty(RampartMessageData.KEY_RAMPART_POLICY, loadPolicy("policy.xml"));
The policy.xml I am using is the following:
<?xml version="1.0" encoding="utf-8"?>
<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsp:ExactlyOne>
<wsp:All>
<sp:Wss11 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:MustSupportRefKeyIdentifier/>
<sp:MustSupportRefIssuerSerial/>
</wsp:Policy>
</sp:Wss11>
<wsp:Policy>
<sp:TransportBinding>
<wsp:Policy>
<sp:TransportToken>
<wsp:Policy>
<sp:HttpsToken>
<wsp:Policy>
<sp:RequireClientCertificate/>
</wsp:Policy>
</sp:HttpsToken>
<sp:HttpsToken RequestClientCertificate="true"/>
</wsp:Policy>
</sp:TransportToken>
</wsp:Policy>
</sp:TransportBinding>
</wsp:Policy>
<!--AsymmetricBinding configuration -->
<sp:AsymmetricBinding>
<wsp:Policy>
<!-- INITIATOR TOKEN -->
<sp:InitiatorToken>
<wsp:Policy>
<sp:X509Token
sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
<wsp:Policy>
<sp:RequireThumbprintReference />
<sp:WssX509V3Token10 />
</wsp:Policy>
</sp:X509Token>
</wsp:Policy>
</sp:InitiatorToken>
<!-- RECIPIENT TOKEN -->
<sp:RecipientToken>
<wsp:Policy>
<sp:X509Token
sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
<wsp:Policy>
<sp:RequireThumbprintReference />
<sp:WssX509V3Token10 />
</wsp:Policy>
</sp:X509Token>
</wsp:Policy>
</sp:RecipientToken>
<!-- ALGORITH SUITE -->
<sp:AlgorithmSuite>
<wsp:Policy>
<sp:Basic256Sha256/>
</wsp:Policy>
</sp:AlgorithmSuite>
<!-- INCLUDE TIMESTAMP -->
<sp:IncludeTimestamp/>
</wsp:Policy>
</sp:AsymmetricBinding>
<sp:EndorsingSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
<wsp:Policy>
<sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
<wsp:Policy>
<sp:WssX509V3Token10/>
</wsp:Policy>
</sp:X509Token>
</wsp:Policy>
</sp:EndorsingSupportingTokens>
<wsp:Policy wsu:Id="request_parts">
<sp:SignedElements>
<sp:XPath>/soapenv:Envelope/soapenv:Header/wsse:Security/wsu:Timestamp</sp:XPath>
<sp:XPath>/soapenv:Envelope/soapenv:Body/ns1:COREEnvelopeRealTimeRequest/Payload</sp:XPath>
</sp:SignedElements>
</wsp:Policy>
<wsp:Policy wsu:Id="response_parts">
<wsp:ExactlyOne>
<wsp:All>
<sp:SignedElements>
<sp:XPath>/soapenv:Envelope/soapenv:Header/wsse:Security/wsu:Timestamp</sp:XPath>
<sp:XPath>/soapenv:Envelope/soapenv:Body/ns1:COREEnvelopeRealTimeRequest/Payload</sp:XPath>
</sp:SignedElements>
</wsp:All>
<wsp:All>
<sp:SignedElements>
<sp:XPath>/soapenv:Envelope/soapenv:Header/wsse:Security/wsu:Timestamp</sp:XPath>
</sp:SignedElements>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
<!-- USING ADDRESSING -->
<wsaw:UsingAddressing xmlns:wsaw="http://www.w3.org/2005/08/addressing"/>
<!-- RAMPART CONFIGURATION -->
<ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy">
<ramp:user>...</ramp:user>
<ramp:passwordCallbackClass>org.caqh.www.soap.wsdl.PWCBHandler</ramp:passwordCallbackClass>
<ramp:signatureCrypto>
<ramp:crypto provider="org.apache.ws.security.components.crypto.Merlin">
<ramp:property name="org.apache.ws.security.crypto.merlin.keystore.type">...</ramp:property>
<ramp:property name="org.apache.ws.security.crypto.merlin.file">...</ramp:property>
<ramp:property name="org.apache.ws.security.crypto.merlin.keystore.password">...</ramp:property>
</ramp:crypto>
</ramp:signatureCrypto>
</ramp:RampartConfig>
<!-- END RAMPART CONFIGURATION -->
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
( I replaced the rampart configuration parameters with ... )
But this policy seems not to be working correctly, because when I inspect the SOAP envelope being created, I can see that the security header is correclty created, with the timestamp, but the body's element that I need to sign is not signed:
<soapenv:Body>
<ns1:COREEnvelopeRealTimeRequest xmlns:ns1="http://www.caqh.org/SOAP/WSDL/CORERule2.2.0.xsd">
<PayloadType>X12_270_Request_005010X279A1</PayloadType>
<ProcessingMode>RealTime</ProcessingMode>
<PayloadID>64f48269-06cb-463a-9907-72a60c1f09fd</PayloadID>
<TimeStamp>2020-07-203T20:07662Z</TimeStamp>
<SenderID>ABC123</SenderID>
<ReceiverID>CMS</ReceiverID>
<CORERuleVersion>2.2.0</CORERuleVersion>
<Payload><![CDATA[...]]></Payload>
</ns1:COREEnvelopeRealTimeRequest>
</soapenv:Body>
The element that needs to be digitally signed is
<Payload><![CDATA[...]]></Payload>
But I can only get to sign the soapenv:Body if I add
<sp:SignedParts>
<sp:Body/>
</sp:SignedParts>
I also tried using XPATH to reference the element that I need to sign, but I have not succedded.
<sp:XPath>/*[namespace-uri()='http://www.w3.org/2003/05/soap-envelope' and local-name()='Envelope']/*[namespace-uri()='http://www.w3.org/2003/05/soap-envelope' and local-name()='Body']/*[namespace-uri()='http://www.caqh.org/SOAP/WSDL/CORERule2.2.0.xsd' and local-name()='COREEnvelopeRealTimeRequest']/Payload</sp:XPath>
Any idea of what I am doing wrong in order to be able to digitally sign the Payload element?
Thanks