Issue
The following error is thrown when you tried to execute a Endpoint Web Service SmartObject.
InvalidSecurity : error in processing the WS-Security security header
Resolution
Please check your web service's WSDL, and see if you can find a section similar to this in your WSDL:
<wsp:Policy xmlns="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="wss_username_token_service_policy" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <sp:SupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"> <wsp:Policy> <sp:UsernameToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient"> <wsp:Policy> <sp:WssUsernameToken10/> </wsp:Policy> </sp:UsernameToken> </wsp:Policy> </sp:SupportingTokens></wsp:Policy>
If you find something similar in your WSDL, then it means you have security policies defined in your web service. Your web service will expect a SOAP security header to be sent along with the SOAP request. Without the SOAP security header, your web service will return a InvalidSecurity error.
Unfortunately at the time this article was written, the Endpoint Web Service broker does not provide any means for you to insert the SOAP security header into the request you are sending. If you have control over your web service, then you can configure your web service to remove the security policy, and to support one of the authentication methods supported by the Endpoint Web Service broker.
If you cannot configure your web service to remove the security policy, and you are on K2 Five, then the alternative is to either
- Create your own service broker or
- Create an assembly to call your web service, and use the Endoint Assembly service broker to expose your custom assembly in K2.
Additional Information