title: Axis2+Rampart WebService Signing and Encryption
body: <p>i have a problem with the security between one webservice and his client.
  I use Axis2 and Rampart to build bottom up my webservice and than create the client from the generated wsdl.
  I show you my code and the concrete problem.</p>
  
  <p><strong>Client.java</strong></p>
  
  <pre><code>package de.security.tutorial;
  
  import java.io.InputStream;
  import java.rmi.RemoteException;
  
  import javax.xml.stream.XMLStreamException;
  import org.apache.axiom.om.impl.builder.StAXOMBuilder;
  import org.apache.axis2.client.Options;
  import org.apache.axis2.client.ServiceClient;
  import org.apache.axis2.context.ConfigurationContext;
  import org.apache.axis2.context.ConfigurationContextFactory;
  import org.apache.neethi.Policy;
  import org.apache.neethi.PolicyEngine;
  import org.apache.rampart.RampartMessageData;
  
  import de.security.tutorial.ServerStub.GetWelcomeResponse;
  
  public class Client {
  
      /**
       * Load policy file from classpath.
       */
      private static Policy loadPolicy(String name) throws XMLStreamException {
          ClassLoader loader = new ClassLoader() {};
          InputStream resource = loader.getResourceAsStream(name);
          StAXOMBuilder builder = new StAXOMBuilder(resource);
          return PolicyEngine.getPolicy(builder.getDocumentElement());
      }
  
      public static void main(String[] arg) throws RemoteException{
          String url = "http://localhost:8080/axis2/services/Server";
          try {
              // get Modulrepository
              ConfigurationContext ctx = ConfigurationContextFactory.createConfigurationContextFromFileSystem("WebContent/WEB-INF/", null);
  
              // create new Stub
              ServerStub stub = new ServerStub(ctx, url);
  
              // configure and engage Rampart
              ServiceClient client = stub._getServiceClient();
              Options options = client.getOptions();
  
              Policy policy = loadPolicy("policy.xml");
  //          client.getAxisService().getPolicySubject().attachPolicy(policy);
              options.setProperty(RampartMessageData.KEY_RAMPART_POLICY, policy);
              options.setUserName("libuser");
              options.setPassword("books");
  
              client.setOptions( options );           
              client.engageModule( "addressing" );        
              client.engageModule( "rampart" );
              stub._setServiceClient( client );
  
              // send request
              GetWelcomeResponse response = stub.getWelcome();
  
              // print response to console
              if(response.local_returnTracker){
                  String string = response.get_return();
                  System.out.println(string);
              }
  
          } catch(Exception e) {
              System.out.println("Exception: " + e.getMessage());
          }
  
      }
  
  }
  </code></pre>
  
  <p><strong>PasswordCallbackHandler.java</strong></p>
  
  <pre><code>package de.security.tutorial;
  
  import org.apache.ws.security.WSPasswordCallback;
  
  import javax.security.auth.callback.Callback;
  import javax.security.auth.callback.CallbackHandler;
  
  import java.io.IOException;
  
  /**
   * Simple password callback handler. This just checks if the password for the private key
   * is being requested, and if so sets that value.
   */
  public class PWCBHandler implements CallbackHandler
  {
      public void handle(Callback[] callbacks) throws IOException {
          for (int i = 0; i &lt; callbacks.length; i++) {
              WSPasswordCallback pwcb = (WSPasswordCallback)callbacks[i];
              String id = pwcb.getIdentifer();
              int usage = pwcb.getUsage();
              if (usage == WSPasswordCallback.DECRYPT || usage == WSPasswordCallback.SIGNATURE) {
  
                  // used to retrieve password for private key
                  if ("clientkey".equals(id)) {
                      pwcb.setPassword("clientpass");
                  }
  
              }
          }
      }
  }
  </code></pre>
  
  <p><strong>policy.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  
  &lt;wsp:Policy wsu:Id="SigEncr"
      xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
      xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"&gt;
      &lt;wsp:ExactlyOne&gt;
          &lt;wsp:All&gt;
              &lt;sp:AsymmetricBinding
                  xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"&gt;
                  &lt;wsp:Policy&gt;
                      &lt;sp:InitiatorToken&gt;
                          &lt;wsp:Policy&gt;
                              &lt;sp:X509Token
                                  sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient"&gt;
                                  &lt;wsp:Policy&gt;
                                      &lt;sp:RequireThumbprintReference /&gt;
                                      &lt;sp:WssX509V1Token10 /&gt;
                                  &lt;/wsp:Policy&gt;
                              &lt;/sp:X509Token&gt;
                          &lt;/wsp:Policy&gt;
                      &lt;/sp:InitiatorToken&gt;
                      &lt;sp:RecipientToken&gt;
                          &lt;wsp:Policy&gt;
                              &lt;sp:X509Token
                                  sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Never"&gt;
                                  &lt;wsp:Policy&gt;
                                      &lt;sp:RequireThumbprintReference /&gt;
                                      &lt;sp:WssX509V3Token10 /&gt;
                                  &lt;/wsp:Policy&gt;
                              &lt;/sp:X509Token&gt;
                          &lt;/wsp:Policy&gt;
                      &lt;/sp:RecipientToken&gt;
                      &lt;sp:AlgorithmSuite&gt;
                          &lt;wsp:Policy&gt;
                              &lt;sp:TripleDesRsa15 /&gt;
                          &lt;/wsp:Policy&gt;
                      &lt;/sp:AlgorithmSuite&gt;
                      &lt;sp:Layout&gt;
                          &lt;wsp:Policy&gt;
                              &lt;sp:Strict /&gt;
                          &lt;/wsp:Policy&gt;
                      &lt;/sp:Layout&gt;
                      &lt;sp:IncludeTimestamp /&gt;
                      &lt;sp:OnlySignEntireHeadersAndBody /&gt;
                  &lt;/wsp:Policy&gt;
              &lt;/sp:AsymmetricBinding&gt;
              &lt;sp:Wss10 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"&gt;
                  &lt;wsp:Policy&gt;
                      &lt;sp:MustSupportRefKeyIdentifier /&gt;
                      &lt;sp:MustSupportRefIssuerSerial /&gt;
                  &lt;/wsp:Policy&gt;
              &lt;/sp:Wss10&gt;
              &lt;sp:SignedParts
                  xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"&gt;
                  &lt;sp:Body /&gt;
              &lt;/sp:SignedParts&gt;
              &lt;sp:EncryptedParts
                  xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"&gt;
                  &lt;sp:Body /&gt;
              &lt;/sp:EncryptedParts&gt;
              &lt;ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy"&gt;
                  &lt;ramp:user&gt;clientkey&lt;/ramp:user&gt;
                  &lt;ramp:encryptionUser&gt;serverkey&lt;/ramp:encryptionUser&gt;
                  &lt;ramp:passwordCallbackClass&gt;de.security.tutorial.PWCBHandler
                  &lt;/ramp:passwordCallbackClass&gt;
                  &lt;ramp:signatureCypto&gt;
                      &lt;ramp:crypto provider="org.apache.ws.security.components.crypto.Merlin"&gt;
                          &lt;ramp:property
                              name="org.apache.ws.security.crypto.merlin.keystore.type"&gt;JKS&lt;/ramp:property&gt;
                          &lt;ramp:property name="org.apache.ws.security.crypto.merlin.file"&gt;D:/keystore/client.keystore
                          &lt;/ramp:property&gt;
                          &lt;ramp:property
                              name="org.apache.ws.security.crypto.merlin.keystore.password"&gt;nosecret&lt;/ramp:property&gt;
                      &lt;/ramp:crypto&gt;
                  &lt;/ramp:signatureCypto&gt;
  
                  &lt;ramp:encryptionCypto&gt;
                      &lt;ramp:crypto provider="org.apache.ws.security.components.crypto.Merlin"&gt;
                          &lt;ramp:property
                              name="org.apache.ws.security.crypto.merlin.keystore.type"&gt;JKS&lt;/ramp:property&gt;
                          &lt;ramp:property name="org.apache.ws.security.crypto.merlin.file"&gt;D:/keystore/client.keystore
                          &lt;/ramp:property&gt;
                          &lt;ramp:property
                              name="org.apache.ws.security.crypto.merlin.keystore.password"&gt;nosecret&lt;/ramp:property&gt;
                      &lt;/ramp:crypto&gt;
                  &lt;/ramp:encryptionCypto&gt;
  
              &lt;/ramp:RampartConfig&gt;
  
          &lt;/wsp:All&gt;
      &lt;/wsp:ExactlyOne&gt;
  &lt;/wsp:Policy&gt;
  </code></pre>
  
  <p>OK. I have a WebService called "Server" with one function "getWelcome" which returned a simple String. Importent is only the security.</p>
  
  <p><strong>The Problem:</strong>
  If i execute my client, he returned one NullPointerException and he didn´t was connected with the service. This line throws the exception:</p>
  
  <pre><code>GetWelcomeResponse response = stub.getWelcome();
  </code></pre>
  
  <p>But if i disable the rampart modul, then i get a connection to the service but he miss the security header. The Problem is this line:</p>
  
  <pre><code>client.engageModule( "rampart" );
  </code></pre>
  
  <p>Can anybody help me?</p>