How to disable a BSPRule for incoming messages?

[beth-soptim]

How can BSPRules be disabled for incoming messages that are reponses for outgoing messages?

How can BSPRules be disabled for incoming messages that have been initiated by external market participants?

For example BSPRule.R3058 needs to be deactived for the BDEW profile.

[phax]

Well, I never did this before, but this is how it should work, according to the code:

• Basically you need to provide a custom BSPEnforcer object that adds a list of ignored BSPRules in the constructor. So somethinglike new BSPEnforcer (Arrays.toList (BSPRule.R3058));
• This BSPEnforcer needs to be added to the RequestData object - this can be done by doing it in the IAS4DecryptParameterModifier implementation via the modifyRequestData method
  • Okay, the RequestData object has specialized methods for that

I created an example AbstractBDEWDecryptParameterModifier that you might use as the basis for your implementation of just copy the one line out of it (see commit da382bc )

This IAS4DecryptParameterModifier can be set in the sender builder via the decryptRequestDataModifier method and for the receiving side via the implementation of IAS4IncomingSecurityConfiguration

[beth-soptim]

Hi, thanks for your answer. I tested this with an outgoing message to another market participant that does not write any attributes in the <Reference> element in his answer. That's why R3058 has to be deactivated:

<KeyInfo>
    <SecurityTokenReference
            p6:TokenType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509PKIPathv1"
            xmlns:p6="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
            xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
        <Reference URI="#BST-3b7bec75-5bcb-4c81-ae59-e44d68086586"/>
    </SecurityTokenReference>
</KeyInfo>

It seems that modifyRequestData is not called before the rule gets evaluated (I also added some logging there -> was not logged). See attached stack trace:

Transmission result: TransmissionResultTransportError{exception=com.helger.phase4.util.Phase4Exception:
Error processing AS4 message, cause=org.apache.wss4j.common.ext.WSSecurityException: BSP:R3058: Any STR_REFERENCE ValueType at
tribute MUST contain a value for the referenced SECURITY_TOKEN specified by the corresponding security token profile}
: com.helger.phase4.util.Phase4Exception: Error processing AS4 message at
deployment.as4out.war//com.helger.phase4.servlet.AS4IncomingHandler.lambda$_parseMessage$4(AS4IncomingHandler.java:779) at
deployment.as4out.war//com.helger.phase4.servlet.AS4IncomingHandler.parseAS4Message(AS4IncomingHandler.java:336) at
deployment.as4out.war//com.helger.phase4.servlet.AS4IncomingHandler.parseMessage(AS4IncomingHandler.java:791) at
deployment.as4out.war//com.helger.phase4.servlet.AS4IncomingHandler.parseSignalMessage(AS4IncomingHandler.java:823) at
deployment.as4out.war//com.helger.phase4.sender.AS4BidirectionalClientHelper.sendAS4UserMessageAndReceiveAS4SignalMessage(AS4BidirectionalClientHelper.java:157) at
deployment.as4out.war//com.helger.phase4.sender.AbstractAS4UserMessageBuilderMIMEPayload.mainSendMessage(AbstractAS4UserMessageBuilderMIMEPayload.java:172) at
deployment.as4out.war//com.helger.phase4.sender.AbstractAS4MessageBuilder.sendMessage(AbstractAS4MessageBuilder.java:856) at
deployment.as4out.war//com.helger.phase4.sender.AbstractAS4UserMessageBuilder.sendMessageAndCheckForReceipt(AbstractAS4UserMessageBuilder.java:756) at
deployment.as4out.war//de.xxxx.as4.Phase4Sender.send(Phase4Sender.java:174) at
deployment.as4out.war//de.xxxx.as4.bdew.Phase4BdewSender$Proxy$$$WeldClientProxy.send(Unknown Source) at
deployment.as4out.war//de.xxxx.As4OutJob.as4Out(As4OutJob.java:358) at
deployment.as4out.war//de.xxxx.As4OutJob.run(As4OutJob.java:191) at
deployment.as4out.war//de.xxxx.As4OutJobAction.execute(As4OutJobAction.java:14) at
deployment.as4out.war//de.xxxx.As4OutJobAction$Proxy$$$_WeldSubclass.execute$$super(Unknown Source) at
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at
java.base/java.lang.reflect.Method.invoke(Method.java:568) at
[email protected]//org.jboss.weld.interceptor.proxy.TerminalAroundInvokeInvocationContext.
....
Caused by: org.apache.wss4j.common.ext.WSSecurityException: BSP:R3058: Any STR_REFERENCE ValueType at
tribute MUST contain a value for the referenced SECURITY_TOKEN specified by the corresponding security token profile at
deployment.as4out.war//org.apache.wss4j.common.bsp.BSPEnforcer.handleBSPRule(BSPEnforcer.java:57) at
deployment.as4out.war//org.apache.wss4j.dom.str.STRParserUtil.checkBinarySecurityBSPCompliance(STRParserUtil.java:140) at
deployment.as4out.war//org.apache.wss4j.dom.str.SignatureSTRParser.processPreviousResult(SignatureSTRParser.java:263) at
deployment.as4out.war//org.apache.wss4j.dom.str.SignatureSTRParser.parseSecurityTokenReference(SignatureSTRParser.java:95) at
deployment.as4out.war//org.apache.wss4j.dom.processor.SignatureProcessor.handleToken(SignatureProcessor.java:174) at
deployment.as4out.war//org.apache.wss4j.dom.engine.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:340) at
deployment.as4out.war//org.apache.wss4j.dom.engine.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:251) at
deployment.as4out.war//com.helger.phase4.servlet.soap.SOAPHeaderElementProcessorWSS4J._verifyAndDecrypt(SOAPHeaderElementProcessorWSS4J.java:177) at
deployment.as4out.war//com.helger.phase4.servlet.soap.SOAPHeaderElementProcessorWSS4J.processHeaderElement(SOAPHeaderElementProcessorWSS4J.java:473) at
deployment.as4out.war//com.helger.phase4.servlet.AS4IncomingHandler._processSoapHeaderElements(AS4IncomingHandler.java:415) at
deployment.as4out.war//com.helger.phase4.servlet.AS4IncomingHandler.processEbmsMessage(AS4IncomingHandler.java:593) at
deployment.as4out.war//com.helger.phase4.servlet.AS4IncomingHandler.lambda$_parseMessage$4(AS4IncomingHandler.java:762) ... 44 more

[phax]

Can you please make a breakpoint at SOAPHeaderElementProcessorWSS4J line 161 and check if the handler is called:

?
The _verifyAndDecrypt is called at line 177 a bit later...

[beth-soptim]

Thanks for the answer.

I fixed this problem by setting a IAS4DecryptParameterModifier on the BDEWUserMessageBuilder when generating outgoing messages.

The IAS4DecryptParameterModifier was previously only registered in the AS4XServletHandler. This is only used for incoming messages.

[phax]

Great news - yeah, you need to set if for sending and receiving separately - these functionalities are kind of separated.