title: CXF Service throws WSSecurityException: No certificates were found for decryption (KeyId)
body: <p>I am working with a CXF-STS application following the example from <a href="http://web-gmazza.rhcloud.com/blog/entry/cxf-sts-tutorial" rel="nofollow">http://web-gmazza.rhcloud.com/blog/entry/cxf-sts-tutorial</a>. I am able to generate SAML assertion but it fails when it hits the Service Provider.</p>
  
  <p>I have the PasswordCallback at Service as,</p>
  
  <pre><code>@Override
      public void handle(Callback[] callbacks) throws IOException,
              UnsupportedCallbackException {
          for (int index = 0; index &lt; callbacks.length; index++) {
              WSPasswordCallback pc = (WSPasswordCallback)callbacks[index];
              int usage = pc.getUsage();
              if (usage == WSPasswordCallback.DECRYPT || usage == WSPasswordCallback.SIGNATURE) {
                  String pass = (String) passwords.get(pc.getIdentifier());
                  if (pass != null) {
                      pc.setPassword(pass);
                      return;
                  }
              }
          }
  </code></pre>
  
  <p>The WSPasswordCallback type is found as SECRETKEY or something but <code>not WSPasswordCallback.DECRYPT or WSPasswordCallback.SIGNATURE</code></p>
  
  <p>The identifier when debugged in above code shows as <code>_0bfaf221-9588-4033-b3fa-db9ecbd478fe</code> or some random text. On service provider I have Symmetric binding with Keytype - SymmetricKey as</p>
  
  <pre><code>&lt;sp:SymmetricBinding&gt;
                 &lt;wsp:Policy&gt;
                    &lt;sp:ProtectionToken&gt;
                       &lt;wsp:Policy&gt;
                          &lt;sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient"&gt;
                             &lt;sp:RequestSecurityTokenTemplate&gt;
                                &lt;t:TokenType&gt;http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1&lt;/t:TokenType&gt;
                                &lt;t:KeyType&gt;http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey&lt;/t:KeyType&gt;
                                &lt;t:KeySize&gt;256&lt;/t:KeySize&gt;
                             &lt;/sp:RequestSecurityTokenTemplate&gt;
                             &lt;wsp:Policy&gt;
                                &lt;sp:RequireInternalReference/&gt;
                             &lt;/wsp:Policy&gt;
                             &lt;sp:Issuer&gt;
                                &lt;wsaw:Address&gt;http://localhost:8080/StsService/services/STS&lt;/wsaw:Address&gt;
                                &lt;wsaw:Metadata&gt;
                                   &lt;wsx:Metadata&gt;
                                      &lt;wsx:MetadataSection&gt;
                                         &lt;wsx:MetadataReference&gt;
                                            &lt;wsaw:Address&gt;http://localhost:8080/StsService/services/STS/mex&lt;/wsaw:Address&gt;
                                         &lt;/wsx:MetadataReference&gt;
                                      &lt;/wsx:MetadataSection&gt;
  </code></pre>
  
  <p>On STS end I am providing public key of Service provider for encryption as </p>
  
  <pre><code>&lt;bean id="utSTSProperties"
           class="org.apache.cxf.sts.StaticSTSProperties"&gt;
          &lt;property name="signaturePropertiesFile" value="springconfig/keystore.properties"/&gt;
          &lt;property name="signatureUsername" value="${stskeyalias}"/&gt;
          &lt;property name="callbackHandlerClass" value="com.security.sts.security.StsPasswordCallbackHandler"/&gt;
          &lt;property name="encryptionUsername" value="${serverkeyalias}" /&gt;
          &lt;property name="encryptionPropertiesFile" value="springconfig/keystore.properties" /&gt;
          &lt;property name="issuer" value="cieron"/&gt;
      &lt;/bean&gt;
  </code></pre>
  
  <p>Following suggestions at <a href="http://mail-archives.apache.org/mod_mbox/cxf-users/201112.mbox/%3CCAB8XdGABkphcJXTbtVpDfBZ3KcymtZYX-Rmv0H8QiuwYNHP5OQ@mail.gmail.com%3E" rel="nofollow">http://mail-archives.apache.org/mod_mbox/cxf-users/201112.mbox/%3CCAB8XdGABkphcJXTbtVpDfBZ3KcymtZYX-Rmv0H8QiuwYNHP5OQ@mail.gmail.com%3E</a> and <a href="http://coheigea.blogspot.in/2011/05/ws-trust-sample-in-talend-service.html" rel="nofollow">http://coheigea.blogspot.in/2011/05/ws-trust-sample-in-talend-service.html</a></p>
  
  <p>I am not sure how the symmetric key is available for Service Provider as it is enrypted. </p>
  
  <p>I have checked all related files and everything seems intact. I have my example at <a href="https://github.com/sampleref/CXFSecurity" rel="nofollow">https://github.com/sampleref/CXFSecurity</a> for reference. I am facing error when running the client, with service provider logs showing </p>
  
  <pre><code>at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
      at java.lang.Thread.run(Thread.java:722)
  Caused by: org.apache.wss4j.common.ext.WSSecurityException: No certificates were found for decryption (KeyId)
      at org.apache.wss4j.dom.processor.EncryptedKeyProcessor.getCertificatesFromEncryptedKey(EncryptedKeyProcessor.java:372)
      at org.apache.wss4j.dom.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:137)
      at org.apache.wss4j.dom.saml.WSSSAMLKeyInfoProcessor.processSAMLKeyInfo(WSSSAMLKeyInfoProcessor.java:80)
      at org.apache.wss4j.common.saml.SAMLUtil.getCredentialFromKeyInfo(SAMLUtil.java:225)
      at org.apache.wss4j.common.saml.SAMLUtil.getCredentialFromSubject(SAMLUtil.java:152)
      at org.apache.wss4j.common.saml.SamlAssertionWrapper.parseSubject(SamlAssertionWrapper.java:672)
      at org.apache.wss4j.dom.processor.SAMLTokenProcessor.handleSAMLToken(SAMLTokenProcessor.java:193)
      at org.apache.wss4j.dom.processor.SAMLTokenProcessor.handleToken(SAMLTokenProcessor.java:79)
      at org.apache.wss4j.dom.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:427)
      at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:257)
  </code></pre>
  
  <p>No Certificates found. Please provide some suggestions</p>
  
  <p>Thanks</p>