Re: [SignServer-develop] Client certificate authentication required - AdminWS

[Markus K. <mar...@pr...>]

On 11/07/2017 07:13 AM, Raj Murtinty wrote:
>
> Hi,
>
Hi Raj,

(I removed the dropbox URL from the subject as it was not mentioned in
the mail body what it was about and thus looked like spam)

> I'm trying to test the web services call using SOAPui to the sign
> server and I've come across the following error:
>
>
> <soapenv:Envelope
> xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
> xmlns:adm="http://adminws.signserver.org/">
>    <soapenv:Header/>
>    <soapenv:Body>
>       <adm:addAuthorizedClient>
>          <workerId>1</workerId>
>          <!--Optional:-->
>          <authClient>
>             <!--Optional:-->
>             <certSN>client certSN</certSN>      (In yellow are client
> certificate credentials)
>             <!--Optional:-->
>             <issuerDN>C=.., O=...., CN=....</issuerDN>
>          </authClient>
>       </adm:addAuthorizedClient>
>    </soapenv:Body>
> </soapenv:Envelope>
>
>
> Response:
>
> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
>    <soap:Body>
>       <soap:Fault>
>          <faultcode>soap:Server</faultcode>
>          <faultstring>Administrator not authorized to resource. Client
> certificate authentication required.</faultstring>
>          <detail>
>             <ns1:AdminNotAuthorizedException
> xmlns:ns1="http://adminws.signserver.org/"/>
>          </detail>
>       </soap:Fault>
>    </soap:Body>
> </soap:Envelope>
>
> I also have myClient certificate in the SSL settings in SOAPui.
>
> Also I have added myClient.pem to the signserver using the
> signserver addauthorizedclient  command
>
> I'd like to know, which credentials need to be given and are there
> additional information to be added in the soap body apart from the
> above parameters.
>

Are you using an endpoint URL with a port that requires
client-certificate authentication?
In our installation guide that would be port 8443. Please make sure you
invoke port 8443 and that the WSDL that you get from the server contains
an endpoint URL with 8443.

> Thanks
> Raj..

Cheers,
Markus
PrimeKey Solutions

Save time and money with an Enterprise support subscription. Please see
www.primekey.com for more information.
https://www.primekey.com/products/software/