Getting "org.apache.wss4j.common.ext.WSSecurityException: The message has expired" error with CXF WSS4JInInterceptor
Issue
We have configured our camel-cxf consumer endpoint with CXF WSS4JInInterceptor:
<bean id="wss4jInInterceptor" class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
<property name="properties">
<map>
<entry key="action" value="Timestamp UsernameToken" />
<entry key="passwordType" value="PasswordText"/>
<entry key="ws-security.callback-handler" ref="serviceKeystorePasswordCallback"/>
<entry key="timeToLive" value="18000" />
</map>
</property>
</bean>
There is a significant time difference between the client and your server, and the client has to send <wsu:Created> element for UsernameToken. Then we are getting following error:
org.apache.wss4j.common.ext.WSSecurityException: The message has expired
at org.apache.wss4j.dom.processor.UsernameTokenProcessor.handleUsernameToken(UsernameTokenProcessor.java:175)[262:org.apache.wss4j.wss4j-ws-security-dom:2.0.3]
at org.apache.wss4j.dom.processor.UsernameTokenProcessor.handleToken(UsernameTokenProcessor.java:69)[262:org.apache.wss4j.wss4j-ws-security-dom:2.0.3]
at org.apache.wss4j.dom.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:427)[262:org.apache.wss4j.wss4j-ws-security-dom:2.0.3]
at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessageInternal(WSS4JInInterceptor.java:278)[268:org.apache.cxf.cxf-rt-ws-security:3.0.4.redhat-620
Environment
- JBoss Fuse
- 6.2
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.