Multi-Profile handling using Single Servlet different URL

[duke-nuke]

Hi Philip
Hope you are good,

I am working on handling multiple profile in Phase4, i am using Spring-boot project as a starting point for this, followed your guide how to handle multi profile provided in the wiki , but getting errors,

I have implemented the Interface using below code.

`public class CustomHandler implements AS4XServletHandler.IHandlerCustomizer{

private AS4XServletHandler as4XServletHandler;
public CustomHandler(AS4XServletHandler handler) {
    this.as4XServletHandler = handler;
}
@Override
public void customizeBeforeHandling(@Nonnull IRequestWebScopeWithoutResponse iRequestWebScopeWithoutResponse,
                                    @Nonnull AS4UnifiedResponse as4UnifiedResponse,
                                    @Nonnull AS4RequestHandler as4RequestHandler) {

    try {
    if(iRequestWebScopeWithoutResponse.getRequestURIDecoded().startsWith("/as4")) {
        //IAS4CryptoFactory var3 = AS4CryptoFactoryProperties.getDefaultInstance();
        //AS4CryptoFactoryProperties.createCrypto()
        AS4CryptoFactoryProperties properties = new AS4CryptoFactoryProperties(AS4CryptoFactoryProperties.readCryptoPropertiesFromFile("cef.properties"));

        Supplier<IAS4CryptoFactory> supplier = () -> properties;

        this.as4XServletHandler.setCryptoFactorySignSupplier(supplier).setCryptoFactoryCryptSupplier(supplier);
        
        //MetaAS4Manager.getProfileMgr(); not sure how to set cef profile
        as4RequestHandler.handleRequest(iRequestWebScopeWithoutResponse, as4UnifiedResponse
        );

    } else {

            as4RequestHandler.handleRequest(iRequestWebScopeWithoutResponse, as4UnifiedResponse);

    }

    }catch (Exception ex){
        throw new RuntimeException(ex);
    }
}

}
`

Set this in the ServletConfig class
hdl.setHandlerCustomizer(new CustomHandler(hdl));

but when i am processing cef message i am getting on first request i get Private key not found for key , Look like the first request is picking up the keystore of peppol profile, but the next request i picking the certificate which i am using for cef but
then it gives the following error

Caused by: com.helger.phase4.util.Phase4Exception: Error validating incoming AS4 UserMessage with the profile Peppol following errors are present: [PartyInfo/From[0]/@type must be 'urn:fdc:peppol.eu:2017:identifiers:ap' instead of 'urn:oasis:names:tc:ebcore:partyid-type:unregistered', PartyInfo/To[0]/@type must be 'urn:fdc:peppol.eu:2017:identifiers:ap' instead of 'urn:oasis:names:tc:ebcore:partyid-type:unregistered', CollaborationInfo/AgreementRef is missing]
How can i select the profile based on the incoming message and also
in the above custom implementation the values are set per request or for all the requests ? will there be any multi request issues ? if this is working at instace level?

regards
Khurram Shahzad

[phax]

Hello @duke-nuke , sorry for the late response
Quick question aforehand: are you using v2.x or v3.x as it makes a difference in explanation?

Btw. you shouldn't call as4RequestHandler.handleRequest(iRequestWebScopeWithoutResponse, as4UnifiedResponse); manually - this will happen automatically.

[duke-nuke]

I am using v2.x , have plans to migrate to 3.x once its stable,

to handle incoming CEF do i have to provide implementation like Phase4PeppolServletMessageProcessorSPI.class or same implementation will handle the incoming message ?

regards
Khurram Shahzad

[phax]

Okay, so I assume you managed to get around the problem with the certificate selection.

To handle generic CEF messages and Peppol messages in parallel, it is a bit tricky, because they function best on different levels of abstraction on the SPI.
For CEF you simply implement IAS4IncomingMessageProcessorSPI whereas for Peppol you would implement the more specific IPhase4PeppolIncomingSBDHandlerSPI - having multiple SPI implementations in parallel works of course, but you would need to filter again.

I think it would be a good suggestion for improvement for v3, if the SPI implementations are able to filter by "AS4 profile" whether they are capable of dealing with it or not.

[duke-nuke]

No i am looking to handle only Invoice , CreditNote etc coming through CEF and they are in SBDH
i was thinking it should be handled by the current implementation but i am getting error
2024-10-14T22:09:14,381 ERROR [http-nio-9091-exec-8] c.h.j.LoggingJAXBReadExceptionHandler: Failed to parse XML document: cvc-elt.1.a: Cannot find the declaration of element 'Invoice'.

[phax]

Can you please provide more callstack. Feel free to send it by email, if you don't want to share it here

[duke-nuke]

Hi Phax
here is the log output, one thing is on client side i am setting crypto and signing params to use
builder.cryptParams().setKeyIdentifierType(ECryptoKeyIdentifierType.SKI_KEY_IDENTIFIER);
builder.signingParams().setKeyIdentifierType(ECryptoKeyIdentifierType.SKI_KEY_IDENTIFIER);

do we need to set the above on AS4 server as well in case of message coming from CEF ? if yes then how can i set this on request level.
below is the log for analysis

2024-10-15T11:01:05,280 INFO [http-nio-9091-exec-1] c.h.s.StaticServerInfo: Static server information set: [StaticServerInfo@0x395c84a1: scheme=http; serverName=172.31.21.117; serverPort=9091; contextPath=; fullServerPath=http://172.31.21.117:9091; fullServerAndContextPath=http://172.31.21.117:9091]
2024-10-15T11:01:05,312 INFO [http-nio-9091-exec-1] c.h.p.p.s.Phase4PeppolServletConfiguration: phase4 Peppol signing certificate revocation check is now disabled
2024-10-15T11:01:05,330 INFO [http-nio-9091-exec-1] c.h.p.s.AS4IncomingHandler: phase4 --- parsemessage:start
2024-10-15T11:01:05,869 INFO [http-nio-9091-exec-1] c.h.p.w.WSSConfigManager: None of the WSSConfig Security Providers is already installed - doing it now
2024-10-15T11:01:05,968 INFO [http-nio-9091-exec-1] c.h.p.s.s.SOAPHeaderElementProcessorWSS4J: phase4 --- verify-decrypt:start
2024-10-15T11:01:06,014 WARN [http-nio-9091-exec-1] c.h.p.s.s.AS4KeyStoreCallbackHandler: Found unsupported keystore alias 'einvoicingct_121_gw' and usage DECRYPT
2024-10-15T11:01:06,136 WARN [http-nio-9091-exec-1] o.a.j.x.d.i.d.DOMReference: The input bytes to the digest operation are null. This may be due to a problem with the Reference URI or its Transforms.
2024-10-15T11:01:06,141 INFO [http-nio-9091-exec-1] c.h.p.s.s.SOAPHeaderElementProcessorWSS4J: phase4 --- verify-decrypt:end
2024-10-15T11:01:06,141 WARN [http-nio-9091-exec-1] c.h.p.s.s.SOAPHeaderElementProcessorWSS4J: Found 2 different certificates in message. Using the first one.
2024-10-15T11:01:06,142 INFO [http-nio-9091-exec-1] c.h.p.s.s.SOAPHeaderElementProcessorWSS4J: phase4 --- attachment.storetemp:start
2024-10-15T11:01:06,145 INFO [http-nio-9091-exec-1] c.h.p.s.s.SOAPHeaderElementProcessorWSS4J: phase4 --- attachment.storetemp:end
2024-10-15T11:01:06,160 WARN [http-nio-9091-exec-1] c.h.p.p.s.Phase4PeppolServletMessageProcessorSPI: [[email protected]] The revocation check of the received signing certificate is disabled.
2024-10-15T11:01:06,273 ERROR [http-nio-9091-exec-1] c.h.j.LoggingJAXBReadExceptionHandler: Failed to parse XML document: cvc-elt.1.a: Cannot find the declaration of element 'Invoice'.
2024-10-15T11:01:06,279 ERROR [http-nio-9091-exec-1] c.h.p.p.s.Phase4PeppolServletMessageProcessorSPI: [[email protected]] Peppol SBDH Issue: [fatal_error] @ (15:90) cvc-elt.1.a: Cannot find the declaration of element 'Invoice'. (org.xml.sax.SAXParseException: cvc-elt.1.a: Cannot find the declaration of element 'Invoice'.)
2024-10-15T11:01:06,282 WARN [http-nio-9091-exec-1] c.h.p.s.AS4RequestHandler: Error invoking synchronous SPIs
2024-10-15T11:01:06,564 INFO [http-nio-9091-exec-1] c.h.p.m.c.AS4Signer: phase4 --- sign:start
2024-10-15T11:01:06,565 INFO [http-nio-9091-exec-1] c.h.p.m.c.AS4Signer: Now signing AS4 message [SOAP_12]. KeyIdentifierType=BST_DIRECT_REFERENCE; KeyAlias=cert; SignAlgo=http://www.w3.org/2001/04/xmldsig-more#rsa-sha256; DigestAlgo=http://www.w3.org/2001/04/xmlenc#sha256; C14NAlgo=http://www.w3.org/2001/10/xml-exc-c14n#
2024-10-15T11:01:06,619 INFO [http-nio-9091-exec-1] c.h.p.m.c.AS4Signer: phase4 --- sign:end
2024-10-15T11:01:06,647 INFO [http-nio-9091-exec-1] c.h.p.s.AS4IncomingHandler: phase4 --- parsemessage:end

regards

[duke-nuke]

Hi Philip
witing for your response .

Thanks

[phax]

Okay great. You mean you were able to solve it with 2 different receiving servlets?

[duke-nuke]

No I am using Same Servlet with two different Paths

[phax]

Okay, so you are using the Servlet class but different servlet mapping paths - correct?
As in this web.xml excerpt:

<servlet>
  <servlet-name>AS4Servlet</servlet-name>
  <servlet-class>com.helger.phase4.servlet.AS4Servlet</servlet-class>
</servlet>
<servlet-mapping>
  <servlet-name>AS4Servlet</servlet-name>
  <url-pattern>/as4peppol</url-pattern>
</servlet-mapping>
<servlet-mapping>
  <servlet-name>AS4Servlet</servlet-name>
  <url-pattern>/as4cef</url-pattern>
</servlet-mapping>

[duke-nuke]

Yes same strategy used but my project was bootstraped with Spring-boot-demo
there is one issue in mixed mode is sometimes crypto is not set properly and when i am sending CEF message both Peppol and CEF processors are invoked
i had to do this to call only CEFMessageHandler

ICommonsList cefProcessor = new CommonsArrayList();
cefProcessor.add(new CEFMessageHandler());
as4RequestHandler.setProcessorSupplier(()->cefProcessor);

is it correct way ?

as4RequestHandler.getProcessorOfType (CEFMessageHandler.class);
is not helping

[phax]

Yes, in your multi-profile setup, you should not use the SPI logic but use the code like you did:

ICommonsList cefProcessor = new CommonsArrayList();
cefProcessor.add(new CEFMessageHandler());
as4RequestHandler.setProcessorSupplier(()->cefProcessor);

and for the other Peppol path, you use

ICommonsList peppolProcessor = new CommonsArrayList();
peppolProcessor.add(new Phase4PeppolServletMessageProcessorSPI());
as4RequestHandler.setProcessorSupplier(()->peppolProcessor);

Also make sure that you have no META-INF/services/com.helger.phase4.incoming.spi.IAS4IncomingMessageProcessorSPI installed. However, for Phase4PeppolServletMessageProcessorSPI to work, you need to use the SPI definition in `META-INF/services/com.helger.phase4.peppol.servlet.IPhase4PeppolIncomingSBDHandlerSPI".

That also means, that you should not alter the predefined AS4RequestHandler code. The existing phase4 code is supposed to work with multiple profiles.

Hope that makes sense.