yes, maybe you have your Jar set up incorrectly .
Here is code for an example Java callout that successfully initializes wss4j.
The important parts of this code:
- the crypto.properties file is embedded as a resource into the JAR
- the org.apache.ws.security.crypto.merlin.keystore.file= setting in that file must point to another resource embedded into the JAR.
- I had to conditionally initialize the BouncyCastle security provider. When running in a test mode (outside the message processor) it's required to add BC as a provider. When running in the MP, it is forbidden to add BC as a provider. So wrap it in a condition. My code looks like this:
static {
// Initialize BouncyCastle conditionally. Security.addProvider() is not permitted when run within Apigee Edge,
// and is not necessary there, anyway, since Edge includes it. addProvider() is required when running outside
// of Edge, as with running unit tests, or in a standalone client.
if (java.security.Security.getProvider("BC") == null)
java.security.Security.addProvider(new BouncyCastleProvider());
}
- I also found that he order of initialization of the various security things was important. My code does this:
public Signature() throws Exception {
WSSConfig.setAddJceProviders(false);
org.apache.wss4j.stax.setup.WSSec.init();
org.apache.xml.security.Init.init();
WSSConfig.init();
}
I don't remember exactly what the problem was, but I do remember that if I did not include this particular combination in this order, then the callout class failed to initialize. I learned this through unit testing, by the way! Do you have unit tests on your callout? It's a good idea!
good luck!
LinkedIn
Twitter
