Why does Membrane API Gateway return 500 with Could not apply WS-Security to the SOAP message?

The wsSecurity plugin parsed the SOAP message, but an unexpected error occurred while it validated or secured the message, typically in the cryptographic processing. Failed security checks are answered with a SOAP fault instead.

How do I fix the Could not apply WS-Security error in Membrane?

Look for the log line Could not apply WS-Security. in the gateway log and check that the key in the keystore matches the configured signature algorithm, for example an RSA key for an RSA signature algorithm.

How do I hide the details in Membrane error responses?

Enable production mode by adding a configuration document with production: true to your apis.yaml. Membrane then leaves out detailed information from error responses.

500 Internal Server Error: Could Not Apply WS-Security

Membrane API Gateway returns 500 Internal Server Error with the detail Could not apply WS-Security to the SOAP message. when the wsSecurity plugin runs into an unexpected error while validating or securing a SOAP message.

The Error Response

The response contains the status 500 Internal Server Error, the detail Could not apply WS-Security to the SOAP message., the problem type https://membrane-api.io/problems/internal and a link to this page. The type internal means that the gateway could not complete the processing of the message. The error can occur in the request and in the response flow; in both cases the client receives a 500. In production mode, the title is replaced by Internal Server Error and the details are left out.

What the WS-Security Plugin Does

The wsSecurity plugin checks incoming SOAP messages with its validate part (signatures, timestamps, username tokens, decryption) and signs, encrypts or timestamps outgoing messages with its secure part, using the keys from its keystore and truststore. Failed security checks, such as a missing header, a bad signature or an expired timestamp, are answered with a SOAP fault and do not lead to this page. Configuration mistakes are reported when the gateway starts. This error is what is left: a runtime failure in the processing.

Common Causes

The Key Does Not Fit the Signature Algorithm

Signing or encrypting the outgoing message fails in the Java cryptography layer, for example because the private key in the keystore does not fit the configured signatureAlgorithm. At startup only the algorithm names are checked, not whether the key type matches, so an EC key combined with an RSA signature algorithm fails only when a message is processed.

Another Error in the Validate or Secure Part

Any other unexpected error while applying a validate or secure part ends up here. Only a few concrete causes are known, so the exception in the log is the best source of information.

An Unexpected Exception in the Plugin

Any exception that the wsSecurity plugin does not turn into an error response itself is also reported under this URL by Membrane's generic error handler. The detail then reads Aborting! Exception caused in … flow. and names the plugin, the request URI and the flow. Unless the exception points to your configuration or to the message, this usually indicates a bug in Membrane.

How to Fix It

Check the gateway log. Membrane logs Could not apply WS-Security. with the full exception at warn level.
Check that the key in the keystore matches the signature algorithm, for example an RSA key for an RSA signature algorithm.
If the configuration looks correct, report the problem with the stack trace on GitHub Issues.

For SOAP in Membrane in general, see the SOAP tutorial.

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem. These details may reveal information about your setup. In production, turn them off:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---. The response then only contains a log key. Search the gateway log for this key to find the exception.

If the plugin is nested inside a request, response or abort element, the exception message, the stack trace and the link to this page are currently sent even in production mode. Fix the failing plugin rather than relying on production mode to hide them.