topic The security token could not be authenticated or authorized in Alfresco Archive

The security token could not be authenticated or authorized

idahvedi — Tue, 18 Nov 2008 09:49:33 GMT

Hi!I'm trying to call the ContentService with path with WSSE header from soapUI, but get the following error message: <faultstring>WSDoAllReceiver: security processing failed; nested exception is: org.apache.ws.security.WSSecurityException: The security token could not be authentica

Re: The security token could not be authenticated or authorized

vsuarez — Fri, 21 Nov 2008 15:23:11 GMT

Have you called the startSession method? This method returns an AuthResult object and then you must pass in the WSSE header next parameters:

Username: your login name ("admin")

Password: the ticket returned in the AuthResult object

You must also add a Timestamp element into the header.

Regards,
Victor

Re: The security token could not be authenticated or authorized

newbie2004 — Tue, 25 Nov 2008 09:00:26 GMT

Hi vsuarez,

Can you tell us more how to add timestamp to header. Will we set the timestamp to this header ???

   <deployment xmlns='http://xml.apache.org/axis/wsdd/'
               xmlns:java='http://xml.apache.org/axis/wsdd/providers/java'>
      <transport name='http'
                 pivot='javarg.apache.axis.transport.http.HTTPSender'/>
      <globalConfiguration >
         <requestFlow >
            <handler type='javarg.apache.ws.axis.security.WSDoAllSender' >
               <parameter name='action' value='UsernameToken'/>
               <parameter name='user' value='ticket'/>
               <parameter name='passwordCallbackClass'
                value='org.alfresco.example.webservice.sample.WebServiceSample1'/>
               <parameter name='passwordType' value='PasswordText'/>
            </handler>
         </requestFlow >
      </globalConfiguration>
    </deployment>

thank you.

Re: The security token could not be authenticated or authorized

vsuarez — Tue, 25 Nov 2008 09:41:01 GMT

I am using JAX-WS, but I found some code of mine that uses Axis, and the "action" parameter looks like:

<parameter name="action" value="UsernameToken Timestamp"/>‍

Re: The security token could not be authenticated or authorized

idahvedi — Tue, 25 Nov 2008 12:21:00 GMT

Try to call the StartSession-method from SOAP UI:

<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <env:Body>
      <startSession xmlns="http://www.alfresco.org/ws/service/authentication/1.0">
         <username>admin</username>
         <password>admin</password>
      </startSession>
   </env:Body>
</env:Envelope>

but get the following error:
WSDoAllReceiver: Request does not contain required Security header

So, calling the StartSession-method first doesn't help…

-Ida-

Re: The security token could not be authenticated or authorized

vsuarez — Tue, 25 Nov 2008 13:24:25 GMT

Try to call the StartSession-method from SOAP UI:

<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <env:Body>
      <startSession xmlns="http://www.alfresco.org/ws/service/authentication/1.0">
         <username>admin</username>
         <password>admin</password>
      </startSession>
   </env:Body>
</env:Envelope>

but get the following error:
WSDoAllReceiver: Request does not contain required Security header

So, calling the StartSession-method first doesn't help…

-Ida-

Are you getting this error just calling startSession? This error must not happen when calling startSession because WSDoAllReceiver is not attached to this service (you have not ticket yet).

This error must only happen if you call other repository service without the credentials returned by startSession.

Which version of Alfresco are you using?

Re: The security token could not be authenticated or authorized

idahvedi — Wed, 26 Nov 2008 13:42:21 GMT

Thanks for quick response!

I'm using Alfresco 3.0 enterprise

Regards, Ida

Re: The security token could not be authenticated or authorized

kimmoilppola — Wed, 21 Jan 2009 17:08:46 GMT

I'm getting the same error with Alfresco 3.0.1E
My SOAPui test cases worked fine with 2.2E but I would like to know what has changed and how to get this working.

Re: The security token could not be authenticated or authorized

sameer1sharma — Thu, 10 Feb 2011 12:11:02 GMT

Hi,
    I'm trying to do load balancing between two alfresco server. But I'm getting below error.
    When both alfresco server and Apache HTTP server is up; and uploads content with alfresco web service client then in alfresco log file below error comes and the content is not uploaded in any alfresco server.
I'm using web services to upload content in alfresco.
With one alfresco with Apache HTTP server is working fine means content uploads in alfresco. But when both server is up and running then in the case I'm getting the error.

Error:
16:18:58,536 DEBUG [org.apache.axis.EXCEPTIONS] AxisFault:
AxisFault
faultCode: {http://schemas.xmlsoap.org/soap/envelope/}Server.generalException
faultSubcode:
faultString: WSDoAllReceiver: security processing failed; nested exception is:
   org.apache.ws.security.WSSecurityException: The security token could not be authenticated or authorized
faultActor:
faultNode:
faultDetail:
   {http://xml.apache.org/axis/}hostname:BVALF.LB77

WSDoAllReceiver: security processing failed; nested exception is:
   org.apache.ws.security.WSSecurityException: The security token could not be authenticated or authorized
   at org.apache.ws.axis.security.WSDoAllReceiver.invoke(WSDoAllReceiver.java:163)
   at org.apache.axis.strategies.InvocationStrategy.visit(InvocationStrategy.java:32)

Prerequisite:
                  Two Instance of alfresco server (Both are in separate server)
                   Apache HTTP Server
                   Mod JK Tomcat Connector

I've also done clustering and failover, both are working fine as of now, only issue is with load balancing.
Below are details:
worker.properties file

workers.tomcat_home=/apps/Alfresco
workers.java_home=/usr/java/jdk1.5.0_15
ps=/

worker.list=worker1,worker2,loadbalancer,jkstatus

#worker worker1
worker.worker1.host=10.102.150.77
worker.worker1.port=8009
worker.worker1.type=ajp13
worker.worker1.lbfactor=1

#worker worker2
worker.worker2.host=10.102.150.57
worker.worker2.port=8009
worker.worker2.type=ajp13
worker.worker2.lbfactor=1

#worker Load balancing
worker.loadbalancer.type=lb
worker.loadbalancer.balance_workers=worker1,worker2
worker.loadbalancer.sticky_session=1

#JKSTATUS
worker.jkstatus.type=status

httpd.conf

LoadModule jk_module modules/mod_jk-1.2.31-httpd-2.2.x.so
JkworkersFile conf/workers.properties

<VirtualHost 10.102.150.77:8021>
   ServerName BVALF.LB77
   JkLogFile logs/mod_jk.log
   JkMount /jkstatus/* jkstatus
   #JkMount /* loadbalancer
   JkMount /alfresco loadbalancer
   JkMount /alfresco/* loadbalancer
   #CertificatePath /etc/pki/tls/certs/
   JkLogLevel debug
   #JkStripSession On
</VirtualHost>

Server.xml changes in both alfresco server.

<Connector port="8010" protocol="HTTP/1.1" URIEncoding="UTF-8"
               connectionTimeout="20000"
               redirectPort="8443" />

<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" enableLookups="true" minProcessors="5" maxProcessors="75" minSpareThreads="200" maxThreads="1000" />

<Engine name="Catalina" defaultHost="BVALF.LB77" jvmRoute='worker1'>

<Host name="BVALF.LB77" appBase="webapps"
            unpackWARs="true" autoDeploy="true"
            xmlValidation="false" xmlNamespaceAware="false">

Same has done for second server.

Please resolve my issue. I'm struggling like anything.

Sameer Sharma

Re: The security token could not be authenticated or authorized

pacosm — Tue, 14 Jun 2011 16:15:23 GMT

hi there! I have the same exact problem as you. I'm trying to do load balancing between two alfresco server and I´m getting the same error. Did you solve it? Can you share the solution?

thanks a lot!

Re: The security token could not be authenticated or authorized

sameer1sharma — Wed, 15 Jun 2011 05:37:07 GMT

Hi,
I have changed loadbalancer method and added force sticky session.

Add below lines in your workers.properties file.

worker.loadbalancer.method=B
worker.loadbalancer.sticky_session_force=1

This will resolved your issue.

Re: The security token could not be authenticated or authorized

pacosm — Wed, 15 Jun 2011 11:03:15 GMT

Hi,

Thanks for you answer!! I'll try, and I will let you know if it works.