SOAP authentication configured in app-context.xml

[Zoltaan Szabo]

Hi All,

I am trying to configure a SOAP client to connect and authenticate to a WS. This uses http basic authentication. The client is a Maven-Spring-Axis2 project.
My Java code is:

ApplicationContext context = new ClassPathXmlApplicationContext("META-INF/spring/app-context.xml");		
ContractService cs = (ContractService) context.getBean("client");	
cs.doSomething();

My app-context.xml causes errors:

13:36:38,503  INFO eans.factory.xml.XmlBeanDefinitionReader: 315 - Loading XML bean definitions from class path resource [META-INF/spring/app-context.xml]
Exception in thread "main" org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 10 in XML document from class path resource [META-INF/spring/app-context.xml] is invalid; nested exception is org.xml.sax.SAXParseException: cvc-complex-type.2.4.a: Invalid content was found starting with element 'http'. One of '{"http://www.springframework.org/schema/beans":description, "http://www.springframework.org/schema/beans":import, "http://www.springframework.org/schema/beans":alias, "http://www.springframework.org/schema/beans":bean, WC[##other:"http://www.springframework.org/schema/beans"]}' is expected.
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:396)
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:334)
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:302)
...
Caused by: org.xml.sax.SAXParseException: cvc-complex-type.2.4.a: Invalid content was found starting with element 'http'. One of '{"http://www.springframework.org/schema/beans":description, "http://www.springframework.org/schema/beans":import, "http://www.springframework.org/schema/beans":alias, "http://www.springframework.org/schema/beans":bean, WC[##other:"http://www.springframework.org/schema/beans"]}' is expected.
	at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:195)
	at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.error(ErrorHandlerWrapper.java:131)
...

The xml editor shows errors for the <http>, <authentication-manager>, <context:component-scan> tags. Obviously, the namespace is incorrect. I copied the <beans> starting element and the above mentioned elements from here:
http://static.springsource.org/spring-security/site/docs/3.1.x/reference/ns-config.html
and i also tried several Google hits from the net. None of them worked. My actual app-context.xml is:
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:security="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd"> <http auto-config='true'> <intercept-url pattern="/services/*" access="wsuser" /> <http-basic /> </http> <authentication-manager> <authentication-provider> <user-service> <user name="user1" password="pwd123" authorities="wsuser" /> </user-service> </authentication-provider> </authentication-manager> <description>Example configuration to get you started.</description> <context:component-scan base-package="hu.bz.ikti.soap.test" /> <bean id="client" class="hu.bz.ikti.insurance.service.insurer.ContractService" factory-bean="clientFactory" factory-method="create"/> <bean id="clientFactory" class="org.apache.cxf.jaxws.JaxWsProxyFactoryBean"> <property name="serviceClass" value="hu.bz.ikti.insurance.service.insurer.ContractService"/> <property name="address" value="http://localhost:8080/ikti/services/ContractService?wsdl=ContractService.wsdl"/> </bean> </beans>
My original app-context.xml was OK, but when i added the security related tags, it caused the same problem. Without them i got of course a 401 - Unauthorized error. Not xml related error.

Could anyone please answer with a valid app-context.xml (whatever it's name is) with http basic authentication?

[krishna atok]

Hi Zoltan,

Please download spring-seciruty-3.0.xsd,spring-beans-3.0.xsd from the following location http://www.springframework.org/schema/security/spring-security-3.0.xsd , http://www.springframework.org/schema/beans/spring-beans-3.0.xsd respectively and copy it to the same location where your app-context.xml resides.

After that modify the app-context.xml to look like below

<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security spring-security-3.0.xsd">

<security:http auto-config="true">
	<security:intercept-url pattern=""/>
	<security:http-basic/>
</security:http>

</beans

Please try the above and let me know you observations on initial step and then we can proceed with http authentication.

Thanks,
Keasva

[Zoltaan Szabo]

Thank you.
I made the changes but i got an error:


15:24:11,498 WARN eans.factory.xml.XmlBeanDefinitionReader: 47 - Ignored XML validation warning
org.xml.sax.SAXParseException: schema_reference.4: Failed to read schema document 'spring-security-3.0.xsd', because 1) could not find the document; 2) the document could not be read; 3) the root element of the document is not <xsd:schema>.
...
Exception in thread "main" org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 7 in XML document from class path resource [META-INF/spring/app-context.xml] is invalid; nested exception is org.xml.sax.SAXParseException: cvc-complex-type.2.4.c: The matching wildcard is strict, but no declaration can be found for element 'security:http'.

[Kesava Krishna]

I understand this issue. Please replace "http://www.springframework.org/schema/beans/spring-beans-3.0.xsd" to the location where you kept your spring-beans-3.0.xsd files. The location should start from WEB-INF. In the similar way also change the spring-security-3.0.xsd to the location where you kept your spring-security-3.0.xsd files

<beans xmlns="http://www.springframework.org/schema/beans"  
xmlns:security="http://www.springframework.org/schema/security"  
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"    
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security spring-security-3.0.xsd">   

Ideally it should look like this.

<beans xmlns="http://www.springframework.org/schema/beans"  
xmlns:security="http://www.springframework.org/schema/security"  
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"    
xsi:schemaLocation="http://www.springframework.org/schema/beans /WEB-INF/spring-beans-3.0.xsd http://www.springframework.org/schema/security /WEB-INF/spring-security-3.0.xsd">   

/WEB-INF/ is the place where you need to keep your app-context.xml.

Please try this and let me know the results.

Thanks,
Kesava

[Zoltaan Szabo]

I tried first to put spring-beans-3.0.xsd and spring-security-3.0.xsd to the same location where my app-context.xml resides. Then according to your reply i created a WEB-INF folder under the root of the project.
I still get an error:

org.xml.sax.SAXParseException: schema_reference.4: Failed to read schema document '/WEB-INF/spring-beans-3.0.xsd', because 1) could not find the document; 2) the document could not be read; 3) the root element of the document is not <xsd:schema>.
	at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:195)
	at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.warning(ErrorHandlerWrapper.java:96)
...
Exception in thread "main" org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 5 in XML document from class path resource [META-INF/spring/app-context.xml] is invalid; nested exception is org.xml.sax.SAXParseException: cvc-elt.1: Cannot find the declaration of element 'beans'.
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:396)
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:334)
...
Exception in thread "main" org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 5 in XML document from class path resource [META-INF/spring/app-context.xml] is invalid; nested exception is org.xml.sax.SAXParseException: cvc-elt.1: Cannot find the declaration of element 'beans'.
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:396)
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:334)
...
Caused by: org.xml.sax.SAXParseException: cvc-elt.1: Cannot find the declaration of element 'beans'.
	at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:195)
	at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.error(ErrorHandlerWrapper.java:131)
...

This is not a Web project. I created it from the template Sprig utility project. I am not sure if the WEB-INF folder should be under the root of the project, or under some other folder?

[Zoltaan Szabo]

Hi,
now my app-config.xml is:
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:security="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd"> <security:http auto-config="true"> <security:intercept-url pattern=""/> <security:http-basic/> </security:http> </beans>
and the error message is:
org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: pattern attribute cannot be empty or null

[Zoltaan Szabo]

My app-config.xml is as foolows, and causes no more parsing errors:
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:security="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd"> <security:http auto-config="true"> <security:intercept-url pattern="/services/*"/> <security:http-basic/> </security:http> <security:authentication-manager> <security:authentication-provider> <security:user-service> <security:user name="wsuser1" password="pw123" authorities="wsuser" /> </security:user-service> </security:authentication-provider> </security:authentication-manager> <bean id="client" class="hu.bz.ikti.insurance.service.insurer.ContractService" factory-bean="clientFactory" factory-method="create"/> <bean id="clientFactory" class="org.apache.cxf.jaxws.JaxWsProxyFactoryBean"> <property name="serviceClass" value="hu.bz.ikti.insurance.service.insurer.ContractService"/> <property name="address" value="http://localhost:8080/SpringMVCTest/services/ContractService?wsdl=ContractService.wsdl"/> </bean> </beans>

Now i get a org.apache.cxf.transport.http.HTTPException: HTTP response '401: Unauthorized' error. The http basic auth is configured in the servers web.xml:
<security-constraint> <web-resource-collection> <url-pattern>/services/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>wsuser</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>BASIC</auth-method> </login-config> <security-role> <role-name>webservice</role-name> </security-role>
In tomcat-users.xml the user is added:
<user username="wsuser1" password="pw123" roles="wsuser"/>

I can open the wsdl in the browser giving username/password.
What can cause this 401: Unauthorized error for the client?