title: Apache CXF client for claims-mode xRM (Microsoft Dynamics CRM 2011)?
body: <p>I'm trying to create an Apache CXF (2.7.5) client for the Microsoft Dynamics CRM 2011 ("xRM") web services (which I understood to be based on WCF 4) where CRM is in claims mode, so that the WSDL for this web service points to an STS (in my case AD FS 2.0).</p>
  
  <p>My main question: <strong>Are there any tutorial, suggestions, blog posts to help me out (either describing how to send claims, or how to avoid them and instead use Windows authentication)?</strong></p>
  
  <p>Below is a description of what I've done until now.</p>
  
  <hr>
  
  <p>I already had working code for the same web service, which works when CRM is in <em>Windows authentication mode</em>.  That code is based on <a href="http://groovyjava-tom.blogspot.co.uk/2012/01/cxf-and-ms-crm-2011.html" rel="nofollow">"CXF and MS CRM 2011" on Groovy Tom's Blog</a>.</p>
  
  <p>To support <em>claims mode</em>, I additionally needed to include <a href="https://cxf.apache.org/docs/ws-metadataexchange.html" rel="nofollow">org.apache.cxf:cxf-rt-ws-mex</a>, so that the xRM WSDL can be parsed by CXF.  Then I needed to make the CXF built-in STS client use SOAP 1.2:</p>
  
  <pre><code>client.getRequestContext().put("ws-security.sts.client-soap12-binding", "true");
  </code></pre>
  
  <p>to avoid an error 500 from AD FS 2.0.  (Apparently AD FS 2.0 expects the /adfs/services/trust/mex endpoint to be called using SOAP 1.2, and CXF defaults to SOAP 1.1.  I had to find this out from <a href="http://technet.microsoft.com/en-us/library/adfs2-troubleshooting-configuring-computers.aspx" rel="nofollow">AD FS's WCF trace</a>, which reported</p>
  
  <blockquote>
    <p>System.ServiceModel.ProtocolException: Content Type text/xml; charset=UTF-8 was sent to a service expecting application/soap+xml; charset=utf-8. The client and service bindings may be mismatched.</p>
  </blockquote>
  
  <p>when Apache CXF used SOAP 1.1.)</p>
  
  <p>Then there was another problem: the WSDL returned by AD FS's /adfs/services/trust/mex endpoint seemed incomplete, in that it contains</p>
  
  <pre><code>&lt;wsdl:types&gt;
      &lt;xsd:schema
          targetNamespace="http://schemas.microsoft.com/ws/2008/06/identity/securitytokenservice/Imports"&gt;
          &lt;xsd:import namespace="http://schemas.microsoft.com/Message" /&gt;
          &lt;xsd:import namespace="http://schemas.xmlsoap.org/ws/2005/02/trust" /&gt;
          &lt;xsd:import namespace="http://docs.oasis-open.org/ws-sx/ws-trust/200512" /&gt;
      &lt;/xsd:schema&gt;
  &lt;/wsdl:types&gt;
  </code></pre>
  
  <p>so none of the <code>import</code>s has a <code>schemaLocation</code>.  This makes CXF complain that</p>
  
  <blockquote>
    <p>org.apache.cxf.wsdl11.WSDLRuntimeException: Part request defined as element {<a href="http://docs.oasis-open.org/ws-sx/ws-trust/200512" rel="nofollow">http://docs.oasis-open.org/ws-sx/ws-trust/200512</a>}RequestSecurityToken which is not in the schema.</p>
  </blockquote>
  
  <p>I found out what caused this: the schemas containing <code>RequestSecurityToken</code> etc. <em>are</em> in the mex SOAP call result, but in separate <code>&lt;wsx:MetadataSection Dialect="http://www.w3.org/2001/XMLSchema"&gt;</code> sections, which the code in <code>AbstractSTSClient</code> completely ignores.</p>
  
  <p>So I put in place my own WSDLFactory+WSDLReader (using property {{javax.wsdl.factory.WSDLFactory}}), which just inserts the schemas for the three namespaces into any WSDL it reads.</p>
  
  <p>Now I'm blocked at the next point: the xRM WSDL (after formatting) contains an <code>Address</code> of <code>http://www.w3.org/2005/08/addressing/anonymous</code> (see below), which somehow causes CXF to look up that endpoint in AD FS's metadata.  However, such an endpoint of course does not exist: it contains, e.g., <code>https://...:.../adfs/services/trust/2005/usernamemixed</code>.</p>
  
  <pre><code>&lt;wsdl:definitions
      targetNamespace="http://schemas.microsoft.com/xrm/2011/Contracts/Services"
      xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
      xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
      xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
      snipped="other xmlns attributes"&gt;
      &lt;wsp:Policy wsu:Id="CustomBinding_IOrganizationService_policy"&gt;
          &lt;wsp:ExactlyOne&gt;
              &lt;wsp:All&gt;
                  &lt;!-- snip --&gt;
                  &lt;sp:EndorsingSupportingTokens
                      xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"&gt;
                      &lt;wsp:Policy&gt;
                          &lt;sp:IssuedToken
                              sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient"&gt;
                              &lt;Issuer
                                  xmlns="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"&gt;
                                  &lt;Address xmlns="http://www.w3.org/2005/08/addressing"&gt;
                                      http://www.w3.org/2005/08/addressing/anonymous
                                  &lt;/Address&gt;
  </code></pre>
  
  <p>So what can I do now?</p>
  
  <hr>
  
  <p>More generally, my question is now: <strong>Am I on the right path for building a Java client for xRM-in-claims-mode?</strong>  How have others gotten this to work?  Or is there perhaps a way to <em>avoid</em> using claims, and instead use Windows authentication with xRM-in-claims-mode?</p>