Different SOAP namespaces in different environments - soap

Question

I wrote a client (Java) to a web service requiring WS Security headers. I used cxf to generate my sources from the WSDL. When I run my client on Tomcat, it works fine, however, when I move it to Websphere, I get a fault back from the service saying the signature is invalid. I compared the generated soap envelopes and all of the tags match between the two and the key values are the same. The only difference is that WAS has added the namespaces for soapenc, xsi and xsd. These prefixes then get added to the IncludedNamespaces of the canonicalized method. And from what I've read, can get in the mix of the signature. I can't tell if Websphere is adding these or if it is perhaps a different version of a class being picked up. Either way, the webservice will not accept it with these namespaces. Can these be removed?
WebSphere namespace inclusion
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<soapenv:Header xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
Websphere canonicalized tags
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="soapenc xsd xsi" />
</ds:Transform>
</ds:Transforms>
Tomcat namespace inclusion
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Header xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
Tomcat canonicalized tags
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="wsse soap" />
</ds:Transform>
</ds:Transforms>
Here is my WSS4jOutInterceptor Spring Config (some data removed)
<bean class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor"
id="outbound-security">
<constructor-arg>
<map>
<entry key="action" value="Timestamp Signature" />
<entry key="user" value=--REMOVED-- />
<entry key="signaturePropFile" value=--REMOVED-- />
<entry key="encryptionPropFile" value=--REMOVED-- />
<entry key="encryptionUser" value=--REMOVED--/>
<entry key="useSingleCertificate" value="true"/>
<entry key="signatureKeyIdentifier" value="DirectReference" />
<entry key="passwordCallbackClass" value=--REMOVED-- />
<entry key="signatureParts"
value="{Element}{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Timestamp;{Element}{http://schemas.xmlsoap.org/soap/envelope/}Body" />
<entry key="signatureAlgorithm" value="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
<entry key="sigCanonicalization" value="http://www.w3.org/2001/10/xml-exc-c14n#" />
<entry key="signatureDigestAlgorithm" value="http://www.w3.org/2001/04/xmlenc#sha256" />
</map>
</constructor-arg>
</bean>
EDIT: This looks to be caused by some archive in the runtime. Does anyone know what package builds the soap envelope in the jre and the websphere 8 runtime? That might be where the differences exist. Any help is greatly appreciated!

Answer 1

This actual turned out to have nothing to do with incorrect namespaces or the canonicalization methods. Websphere, by default, was making this call "BSP_compliant" which added some values to the key.
These lines fixed the problem.
Map<String, Object> ctx = ((BindingProvider)port).getRequestContext();
ctx.put(WSHandlerConstants.IS_BSP_COMPLIANT, "false");