title: CXF Keystore security - org.apache.cxf.binding.soap.SoapFault: Empty username for specified action
body: <p>I'm trying to use keystore security but I'm, hitting the following problem and not sure how to proceed further. <strong><em>org.apache.cxf.binding.soap.SoapFault: Empty username for specified action</em></strong>.
   Here is my setup. </p>
  
  <p><strong>My Certificates are generated by the following commands</strong> </p>
  
  <pre><code>keytool -genkeypair -alias aka -keypass myAliasPassword -keystore privatestore.jks -storepass keyStorePassword -dname "CN=aka" -keyalg RSA
  
  keytool -selfcert -alias aka -keystore privatestore.jks -storepass keyStorePassword -keypass myAliasPassword
  
  keytool -export -alias aka -file key.rsa -keystore privatestore.jks -storepass keyStorePassword
  
  keytool -import -alias aka  -file key.rsa -keystore publicstore.jks -storepass keyStorePassword
  </code></pre>
  
  <p><strong>and they look like this</strong> </p>
  
  <pre><code>C:\test\employee-usertoken&gt;keytool -list -v -keystore privatestore.jks
  Enter keystore password:
  
  Keystore type: JKS
  Keystore provider: SUN
  
  Your keystore contains 1 entry
  
  Alias name: myalias
  Creation date: Apr 29, 2013
  Entry type: PrivateKeyEntry
  Certificate chain length: 1
  Certificate[1]:
  Owner: CN=myCN
  Issuer: CN=myCN
  Serial number: 517e8a5e
  Valid from: Mon Apr 29 10:57:34 EDT 2013 until: Sun Jul 28 10:57:34 EDT 2013
  Certificate fingerprints:
           MD5:  AE:D8:7E:89:33:55:82:41:30:88:6D:D3:F7:7E:CA:AD
           SHA1: 02:A5:11:E7:D1:EB:61:0E:39:2C:8D:50:EF:EB:46:88:DF:86:34:94
           Signature algorithm name: SHA1withRSA
           Version: 3
  
  
  *******************************************
  *******************************************
  
  C:\test\employee-usertoken&gt;keytool -list -v -keystore publicstore.jks
  Enter keystore password:
  
  Keystore type: JKS
  Keystore provider: SUN
  
  Your keystore contains 1 entry
  
  Alias name: myalias
  Creation date: Apr 29, 2013
  Entry type: trustedCertEntry
  
  Owner: CN=myCN
  Issuer: CN=myCN
  Serial number: 517e8a5e
  Valid from: Mon Apr 29 10:57:34 EDT 2013 until: Sun Jul 28 10:57:34 EDT 2013
  Certificate fingerprints:
           MD5:  AE:D8:7E:89:33:55:82:41:30:88:6D:D3:F7:7E:CA:AD
           SHA1: 02:A5:11:E7:D1:EB:61:0E:39:2C:8D:50:EF:EB:46:88:DF:86:34:94
           Signature algorithm name: SHA1withRSA
           Version: 3
  
  
  *******************************************
  *******************************************
  
  
  
  C:\test\employee-usertoken&gt;
  </code></pre>
  
  <p><strong>My Client Spring config is as follows</strong> </p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:jaxws="http://cxf.apache.org/jaxws"
      xsi:schemaLocation="
  http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
  http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd"&gt;
  
      &lt;import resource="classpath:META-INF/cxf/cxf.xml" /&gt;
      &lt;import resource="classpath:META-INF/cxf/cxf-servlet.xml" /&gt;
  
        &lt;bean id="clientKeystoreTokenCallback" class="com.jpmorgan.ibanker.client.ClientKeyStoreTokenCallback" /&gt;
  
         &lt;jaxws:client id="empGreetClient"
                    serviceClass="com.jpmorgan.ibanker.EmployeeGreet"
                    address="http://localhost:100/employee-usertoken/webservices/EmpGreet" &gt;        
                  &lt;jaxws:outInterceptors&gt; 
                      &lt;bean class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor"&gt; 
                          &lt;constructor-arg&gt; 
                              &lt;map&gt;
                                 &lt;entry key="action" value="Signature"/&gt;                     
                                 &lt;entry key="signaturePropFile" value="client_sign.properties"/&gt;
                                 &lt;entry key="passwordCallbackRef"&gt;
                                    &lt;ref bean="clientKeystoreTokenCallback"/&gt;
                                 &lt;/entry&gt;
                              &lt;/map&gt;
                          &lt;/constructor-arg&gt; 
                      &lt;/bean&gt; 
                  &lt;/jaxws:outInterceptors&gt; 
          &lt;/jaxws:client&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p><strong>My server side spring config is as follows</strong> </p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8" standalone="no"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:jaxws="http://cxf.apache.org/jaxws"
      xsi:schemaLocation="
  http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
  http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd"&gt;
  
      &lt;import resource="classpath:META-INF/cxf/cxf.xml" /&gt;
      &lt;import resource="classpath:META-INF/cxf/cxf-servlet.xml" /&gt;
  
  &lt;bean id="keyStoreTokenCallback" class="com.jpmorgan.ibanker.ServerKeyStoreTokenCallback" /&gt;
        &lt;jaxws:endpoint 
        id="empGreetSecure" 
        implementor="com.jpmorgan.ibanker.EmployeeGreetImpl" 
        address="/EmpGreet" &gt;   
               &lt;jaxws:inInterceptors&gt;
                &lt;bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor"&gt;
                   &lt;constructor-arg&gt;
                      &lt;map&gt;
                          &lt;entry key="action" value="Signature"/&gt;                     
                         &lt;entry key="signaturePropFile" value="server_sign.properties"/&gt;
                         &lt;entry key="passwordCallbackRef"&gt;
                            &lt;ref bean="keyStoreTokenCallback"/&gt;
                         &lt;/entry&gt;
                      &lt;/map&gt;
                   &lt;/constructor-arg&gt;
                &lt;/bean&gt;
             &lt;/jaxws:inInterceptors&gt;
  
       &lt;/jaxws:endpoint&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p><strong>The client_sign properties file is as follows</strong></p>
  
  <pre><code>org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
  org.apache.ws.security.crypto.merlin.keystore.type=JKS
  org.apache.ws.security.crypto.merlin.keystore.password=keyStorePassword
  org.apache.ws.security.crypto.merlin.keystore.alias=aka
  org.apache.ws.security.crypto.merlin.keystore.file=publicstore.jks
  </code></pre>
  
  <p><strong>The server_sign properties is as follows</strong> </p>
  
  <pre><code>org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
  org.apache.ws.security.crypto.merlin.keystore.type=JKS
  org.apache.ws.security.crypto.merlin.keystore.password=keyStorePassword
  org.apache.ws.security.crypto.merlin.keystore.alias=aka
  org.apache.ws.security.crypto.merlin.keystore.file=privatestore.jks
  </code></pre>
  
  <p><strong>The stack trace is as follows</strong> </p>
  
  <pre><code>2013-04-29 15:04:06,827 [Main Thread] INFO  org.apache.cxf.service.factory.ReflectionServiceFactoryBean - Creating Service {http://ibanker.jpmorgan.com/}EmployeeGreetService from class com.jpmorgan.ibanker.EmployeeGreet
  2013-04-29 15:04:07,748 [Main Thread] WARN  org.apache.cxf.phase.PhaseInterceptorChain - Interceptor for {http://ibanker.jpmorgan.com/}EmployeeGreetService#{http://ibanker.jpmorgan.com/}getEmployee has thrown exception, unwinding now
  org.apache.cxf.binding.soap.SoapFault: Empty username for specified action.
      at org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor$WSS4JOutInterceptorInternal.handleMessage(WSS4JOutInterceptor.java:226)
      at org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor$WSS4JOutInterceptorInternal.handleMessage(WSS4JOutInterceptor.java:136)
      at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
      at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:532)
      at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:464)
      at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:367)
      at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:320)
      at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:89)
      at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:134)
      at $Proxy36.getEmployee(Unknown Source)
      at com.jpmorgan.ibanker.client.EmpGreetClient.main(EmpGreetClient.java:20)
  Exception in thread "Main Thread" javax.xml.ws.soap.SOAPFaultException: Empty username for specified action.
      at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:156)
      at $Proxy36.getEmployee(Unknown Source)
      at com.jpmorgan.ibanker.client.EmpGreetClient.main(EmpGreetClient.java:20)
  Caused by: org.apache.cxf.binding.soap.SoapFault: Empty username for specified action.
      at org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor$WSS4JOutInterceptorInternal.handleMessage(WSS4JOutInterceptor.java:226)
      at org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor$WSS4JOutInterceptorInternal.handleMessage(WSS4JOutInterceptor.java:136)
      at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262)
      at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:532)
      at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:464)
      at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:367)
      at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:320)
      at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:89)
      at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:134)
      ... 2 more
  </code></pre>
  
  <p>I have googled around etc but with no luck.Couple of similar questions on mailing lists have been unanswered.I would appreciate if someone here can help me with this.</p>
  
  <p><strong>I'm using java 1.6 and cxf 2.7.x</strong> </p>