{
// This is ok, we always allow faults to be received because WS-Security does not encrypt faults
if (soapMessage.getSOAPBody().getFault() != null)
return;
OperationMetaData opMetaData = ctx.getOperationMetaData();
if (opMetaData == null)
{
// Get the operation meta data from the soap message
// for the server side inbound message.
EndpointMetaData epMetaData = ctx.getEndpointMetaData();
opMetaData = soapMessage.getOperationMetaData(epMetaData);
}
String operation = opMetaData.getQName().toString();
String port = opMetaData.getEndpointMetaData().getPortName().getLocalPart();
if (hasRequirements(config, operation, port))
throw convertToFault(new InvalidSecurityHeaderException("This service requires <wsse:Security>, which is missing."));
return;
}
try
{
SecurityStore securityStore = new SecurityStore(config.getKeyStoreURL(), config.getKeyStoreType(), config.getKeyStorePassword(), config.getKeyPasswords(), config.getTrustStoreURL(),
config.getTrustStoreType(), config.getTrustStorePassword());
SecurityDecoder decoder = new SecurityDecoder(securityStore, config.getTimestampVerification());
decoder.decode(soapMessage.getSOAPPart(), secHeaderElement);
if (log.isTraceEnabled())
log.trace("Decoded Message:\n" + DOMWriter.printNode(soapMessage.getSOAPPart(), true));
OperationMetaData opMetaData = ctx.getOperationMetaData();
if (opMetaData == null)
{
// Get the operation meta data from the soap message
// for the server side inbound message.
EndpointMetaData epMetaData = ctx.getEndpointMetaData();
opMetaData = soapMessage.getOperationMetaData(epMetaData);
}
String operation = opMetaData.getQName().toString();
String port = opMetaData.getEndpointMetaData().getPortName().getLocalPart();
List<OperationDescription<RequireOperation>> operations = buildRequireOperations(config, operation, port);
decoder.verify(operations);
if(log.isDebugEnabled()) log.debug("Verification is successful");