WLS saml client fails with PolicyViolationException against metro service

profile : wss11_saml_or_username_token_with_message_protection_service_policy
scenario : wls(saml client) ----------> metro 2.1 (service)

Error Message(server log Glassfish)
============================================================================
[#|2010-10-06T15:27:52.077+0530|INFO|glassfish3.1|com.sun.xml.ws.monitoring|_ThreadID=14;_ThreadName=Thread-1;|Metro
monitoring rootname successfully set to:
amx:pp=/mon/server-mon[server],type=WSEndpoint,name=/wss11_saml_or_username_token_with_message_protection_service_policy-Service-Saml_or_Username_token_Service-Saml_or_Username_token_ServicePort|#]

[#|2010-10-06T15:27:55.213+0530|SEVERE|glassfish3.1|com.sun.xml.wss.provider.wsit|_ThreadID=14;_ThreadName=Thread-1;|WSITPVD0035:
Error in Verifying Security in Inbound Message.
com.sun.xml.wss.impl.PolicyViolationException:
com.sun.xml.wss.XWSSecurityException: Policy verification error:Missing
reference for one of

{ BinarySecurityToken, SAMLToken} for Signature
at
com.sun.xml.wss.impl.policy.verifier.MessagePolicyVerifier.verifyPolicy(MessagePolicyVerifier.java:147)
at
com.sun.xml.wss.impl.policy.verifier.PolicyAlternativesVerifier.verifyPolicy(PolicyAlternativesVerifier.java:90)
at
com.sun.xml.ws.security.opt.impl.incoming.SecurityRecipient.createMessage(SecurityRecipient.java:985)
at
com.sun.xml.ws.security.opt.impl.incoming.SecurityRecipient.validateMessage(SecurityRecipient.java:227)
at
com.sun.xml.wss.provider.wsit.WSITServerAuthContext.verifyInboundMessage(WSITServerAuthContext.java:567)
at
com.sun.xml.wss.provider.wsit.WSITServerAuthContext.validateRequest(WSITServerAuthContext.java:341)
at
com.sun.xml.wss.provider.wsit.WSITServerAuthContext.validateRequest(WSITServerAuthContext.java:253)
at
com.sun.enterprise.security.webservices.CommonServerSecurityPipe.processRequest(CommonServerSecurityPipe.java:160)
at
com.sun.enterprise.security.webservices.CommonServerSecurityPipe.process(CommonServerSecurityPipe.java:131)
at
com.sun.xml.ws.api.pipe.helper.PipeAdapter.processRequest(PipeAdapter.java:115)
at com.sun.xml.ws.api.pipe.Fiber.__doRun(Fiber.java:637)
at com.sun.xml.ws.api.pipe.Fiber._doRun(Fiber.java:596)
at com.sun.xml.ws.api.pipe.Fiber.doRun(Fiber.java:581)
at com.sun.xml.ws.api.pipe.Fiber.runSync(Fiber.java:478)
at com.sun.xml.ws.server.WSEndpointImpl$2.process(WSEndpointImpl.java:310)
at
com.sun.xml.ws.transport.http.HttpAdapter$HttpToolkit.handle(HttpAdapter.java:600)
at com.sun.xml.ws.transport.http.HttpAdapter.handle(HttpAdapter.java:264)
at
com.sun.xml.ws.transport.http.servlet.ServletAdapter.handle(ServletAdapter.java:144)
at org.glassfish.webservices.JAXWSServlet.doPost(JAXWSServlet.java:159)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:755)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:848)
at org.apache.catalina.core.StandardWrapper.service(StandardWrapper.java:1522)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:281)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:655)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:595)
at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:98)
at
com.sun.enterprise.web.PESessionLockingStandardPipeline.invoke(PESessionLockingStandardPipeline.java:91)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:162)
at org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:326)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:227)
at
com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:170)
at com.sun.grizzly.http.ProcessorTask.invokeAdapter(ProcessorTask.java:824)
at com.sun.grizzly.http.ProcessorTask.doProcess(ProcessorTask.java:721)
at com.sun.grizzly.http.ProcessorTask.process(ProcessorTask.java:1014)
at
com.sun.grizzly.http.DefaultProtocolFilter.execute(DefaultProtocolFilter.java:220)
at
com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:135)
at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:102)
at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:88)
at com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:76)
at
com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:53)
at com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:57)
at com.sun.grizzly.ContextTask.run(ContextTask.java:69)
at
com.sun.grizzly.util.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:530)
at
com.sun.grizzly.util.AbstractThreadPool$Worker.run(AbstractThreadPool.java:511)
at java.lang.Thread.run(Thread.java:619)
Caused by: com.sun.xml.wss.XWSSecurityException: Policy verification
error:Missing reference for one of { BinarySecurityToken, SAMLToken}

for Signature
at
com.sun.xml.ws.security.opt.impl.incoming.TargetResolverImpl.resolveAndVerifyTargets(TargetResolverImpl.java:140)
at
com.sun.xml.wss.impl.policy.verifier.MessagePolicyVerifier.checkTargets(MessagePolicyVerifier.java:437)
at
com.sun.xml.wss.impl.policy.verifier.MessagePolicyVerifier.processPrimaryPolicy(MessagePolicyVerifier.java:324)
at
com.sun.xml.wss.impl.policy.verifier.MessagePolicyVerifier.verifyPolicy(MessagePolicyVerifier.java:142)
... 45 more

| #] |

[#|2010-10-06T15:27:55.940+0530|INFO|glassfish3.1|org.glassfish.admingui|_ThreadID=14;_ThreadName=Thread-1;|Update
Component count = 41|#]

===============================================================================

Client Side error message
===============================================================================
Exception in thread "main" javax.xml.ws.soap.SOAPFaultException:
com.sun.xml.wss.XWSSecurityException: Policy verification error:Missing
reference for one of

{ BinarySecurityToken, SAMLToken} for Signature
at com.sun.xml.ws.fault.SOAP11Fault.getProtocolException(SOAP11Fault.java:197)
at
com.sun.xml.ws.fault.SOAPFaultBuilder.createException(SOAPFaultBuilder.java:130)
at
com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:125)
at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:95)
at com.sun.xml.ws.client.sei.SEIStub.invoke(SEIStub.java:136)
at $Proxy43.echo(Unknown Source)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at
weblogic.wsee.jaxws.spi.ClientInstanceInvocationHandler.invoke(ClientInstanceInvocationHandler.java:84)
at $Proxy44.echo(Unknown Source)
at
com.oracle.webservice.client.Saml_or_Username_token_ServicePortClient.main(Saml_or_Username_token_ServicePortClient.java:27)
Caused by: javax.xml.ws.soap.SOAPFaultException:
com.sun.xml.wss.XWSSecurityException: Policy verification error:Missing
reference for one of { BinarySecurityToken, SAMLToken}

for Signature
at
com.sun.xml.ws.security.opt.impl.util.SOAPUtil.createSOAPFault(SOAPUtil.java:218)
at
com.sun.xml.ws.security.opt.impl.util.SOAPUtil.getSOAPFaultException(SOAPUtil.java:210)
at
com.sun.xml.wss.provider.wsit.WSITServerAuthContext.validateRequest(WSITServerAuthContext.java:353)
at
com.sun.xml.wss.provider.wsit.WSITServerAuthContext.validateRequest(WSITServerAuthContext.java:253)
at
com.sun.enterprise.security.webservices.CommonServerSecurityPipe.processRequest(CommonServerSecurityPipe.java:160)
at
com.sun.enterprise.security.webservices.CommonServerSecurityPipe.process(CommonServerSecurityPipe.java:131)
at
com.sun.xml.ws.api.pipe.helper.PipeAdapter.processRequest(PipeAdapter.java:115)
at com.sun.xml.ws.api.pipe.Fiber.__doRun(Fiber.java:637)
at com.sun.xml.ws.api.pipe.Fiber._doRun(Fiber.java:596)
at com.sun.xml.ws.api.pipe.Fiber.doRun(Fiber.java:581)
at com.sun.xml.ws.api.pipe.Fiber.runSync(Fiber.java:478)
at com.sun.xml.ws.server.WSEndpointImpl$2.process(WSEndpointImpl.java:310)
at
com.sun.xml.ws.transport.http.HttpAdapter$HttpToolkit.handle(HttpAdapter.java:600)
at com.sun.xml.ws.transport.http.HttpAdapter.handle(HttpAdapter.java:264)
at
com.sun.xml.ws.transport.http.servlet.ServletAdapter.handle(ServletAdapter.java:144)
at org.glassfish.webservices.JAXWSServlet.doPost(JAXWSServlet.java:159)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:755)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:848)
at org.apache.catalina.core.StandardWrapper.service(StandardWrapper.java:1522)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:281)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:655)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:595)
at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:98)
at
com.sun.enterprise.web.PESessionLockingStandardPipeline.invoke(PESessionLockingStandardPipeline.java:91)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:162)
at org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:326)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:227)
at
com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:170)
at com.sun.grizzly.http.ProcessorTask.invokeAdapter(ProcessorTask.java:824)
at com.sun.grizzly.http.ProcessorTask.doProcess(ProcessorTask.java:721)
at com.sun.grizzly.http.ProcessorTask.process(ProcessorTask.java:1014)
at
com.sun.grizzly.http.DefaultProtocolFilter.execute(DefaultProtocolFilter.java:220)
at
com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:135)
at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:102)
at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:88)
at com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:76)
at
com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:53)
at com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:57)
at com.sun.grizzly.ContextTask.run(ContextTask.java:69)
at
com.sun.grizzly.util.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:530)
at
com.sun.grizzly.util.AbstractThreadPool$Worker.run(AbstractThreadPool.java:511)
at java.lang.Thread.run(Thread.java:619)
Caused by: com.sun.xml.wss.impl.PolicyViolationException:
com.sun.xml.wss.XWSSecurityException: Policy verification error:Missing
reference for one of

{ BinarySecurityToken, SAMLToken} for Signature
at
com.sun.xml.wss.impl.policy.verifier.MessagePolicyVerifier.verifyPolicy(MessagePolicyVerifier.java:147)
at
com.sun.xml.wss.impl.policy.verifier.PolicyAlternativesVerifier.verifyPolicy(PolicyAlternativesVerifier.java:90)
at
com.sun.xml.ws.security.opt.impl.incoming.SecurityRecipient.createMessage(SecurityRecipient.java:985)
at
com.sun.xml.ws.security.opt.impl.incoming.SecurityRecipient.validateMessage(SecurityRecipient.java:227)
at
com.sun.xml.wss.provider.wsit.WSITServerAuthContext.verifyInboundMessage(WSITServerAuthContext.java:567)
at
com.sun.xml.wss.provider.wsit.WSITServerAuthContext.validateRequest(WSITServerAuthContext.java:341)
... 40 more
Caused by: com.sun.xml.wss.XWSSecurityException: Policy verification
error:Missing reference for one of { BinarySecurityToken, SAMLToken}

for Signature
at
com.sun.xml.ws.security.opt.impl.incoming.TargetResolverImpl.resolveAndVerifyTargets(TargetResolverImpl.java:140)
at
com.sun.xml.wss.impl.policy.verifier.MessagePolicyVerifier.checkTargets(MessagePolicyVerifier.java:437)
at
com.sun.xml.wss.impl.policy.verifier.MessagePolicyVerifier.processPrimaryPolicy(MessagePolicyVerifier.java:324)
at
com.sun.xml.wss.impl.policy.verifier.MessagePolicyVerifier.verifyPolicy(MessagePolicyVerifier.java:142)
... 45 more
Process exited with exit code 1.
#### Environment
Operating System: All
Platform: All
#### Affected Versions
[2.1]

Source: [https://github.com/javaee/metro-wsit/issues/1473](https://github.com/javaee/metro-wsit/issues/1473)
Author: glassfishrobot

Reproduce the WLS SAML client to Metro 2.1 service scenario described in the issue and start with the reported failure in SecurityRecipient, TargetResolverImpl, and MessagePolicyVerifier. Compare the inbound policy and message handling around the missing BinarySecurityToken or SAMLToken reference; done means the request completes without PolicyViolationException.

Written by the indexing model from the issue text.