Rejected by policy

Question

I'm using SOAPUI & a local Java wriiten client for sending SOAP Envelope to a third party SOAP service. In response to that I'm getting following execption,

SOAP Envelope:

<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">
   <env:Body>
      <env:Fault>
         <faultcode>env:Client</faultcode>
         <faultstring>Rejected by policy. (from client)</faultstring>
      </env:Fault>
   </env:Body>
</env:Envelope>

Exception:

AxisFault
 faultCode: {http://schemas.xmlsoap.org/soap/envelope/}Client
 faultSubcode: 
 faultString: Rejected by policy. (from client)
 faultActor: 
 faultNode: 
 faultDetail: 
    {http://xml.apache.org/axis/}stackTrace:Rejected by policy. (from client)
    at org.apache.axis.message.SOAPFaultBuilder.createFault(SOAPFaultBuilder.java:222)
    at org.apache.axis.message.SOAPFaultBuilder.endElement(SOAPFaultBuilder.java:129)
    at org.apache.axis.encoding.DeserializationContext.endElement(DeserializationContext.java:1087)
    at org.apache.xerces.parsers.AbstractSAXParser.endElement(Unknown Source)
    at org.apache.xerces.impl.XMLNSDocumentScannerImpl.scanEndElement(Unknown Source)
    at org.apache.xerces.impl.XMLDocumentFragmentScannerImpl$FragmentContentDispatcher.dispatch(Unknown Source)
    at org.apache.xerces.impl.XMLDocumentFragmentScannerImpl.scanDocument(Unknown Source)
    at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source)
    at org.apache.xerces.parsers.XML11Configuration.parse(Unknown Source)
    at org.apache.xerces.parsers.XMLParser.parse(Unknown Source)

Is the exception occuring on client side ?

Can anybody help me dig out the cause of this exception? I think that exception is occuring on client side.

Solution 1

(You may want to reformat your question as your text has run into your code).

I am pretty sure the error must be coming from the server as, when you have called it with soapUI, there is no client code as such. And the error text is in the server response, so it must be coming from the server. Not sure why it says "(from client)".

The server is most probably rejecting your request because the security header or other security policy details are not present. Do you know what the security requirements are of the service you're calling?

Solution 2

This is a Datapower (which is an old IBM security product between your call and the service) error. In my experience this has meant one of two things.

1. You're not part of the Active Directory group needed to hit the service.
2. Datapower can't find your username because the LDAP query to find your username is looking under a different domain or not a global catalog.

There's probably other reasons for this error but I'm sure these were my problems when I got this error.

Solution 3

When it's a rejection by policy. It could be an issue with username and password in the SOAP header.

  <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
   <wsse:UsernameToken>
     <wsse:Username>username</wsse:Username>
     <wsse:Password>password</wsse:Password>
   </wsse:UsernameToken>
</wsse:Security>

Please make sure you are sending the correct credentials.

Comments

[dinesh028]

Actually I don't think there might be any security credentials issue. If Username/password needed to be provided in Header or body of SOAP Envelope , it description must have been present in the schema or xsd file. But there nothing related to security , fields in schema are merely business related.

[davidfrancis]

Security requirements aren't necessarily present in the WSDL - we have seen plenty of web service endpoints like this. If you wish to be 100% sure whether the error is coming from the backend or from the client, you could monitor the network traffic using tcpmon or wireshark or similar. Using those tools you can see the exact text coming back from the server. But really soapUI is showing you that already, I believe - I've used soapUI a lot and really it just shows you the raw response from the server - I take it the XML response you posted is what soapUI shows you?

[Craig Nicholson]

Java soap - web services will return this when the username and password is missing or invalid. I have seen this from .Net clients posting to a java soap endpoint,