Resolving 'No WSS User Name Token Found' Error After Identity Manager Upgrade

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

After upgrading to Identity Manager 14.4 CP2 or later, users may encounter the error "No WSS user name token found" in the application logs when making Task Execution Web Service (TEWS) calls. This occurs when Web Services Security (WSS) authentication is enabled, but the incoming SOAP request lacks the required WSS Username Token in the header, or when a configuration mismatch exists between the integration and the TewsSecurityFilter.

Environment

Release :  Identity Manager

Cause

The TewsSecurityFilter is configured to enforce WSS authentication. If this filter is enabled in the web.xml configuration, it expects all incoming TEWS requests to contain a valid WSS Username Token in the SOAP header. This error arises if the integration sending the request is not configured to include the token, or if the TewsSecurityFilter is unintentionally active for services that do not support WSS.

Resolution

 If your integration does not require WSS Username Token authentication, you can disable the TewsSecurityFilter.

1. Stop Application Server: Gracefully stop the application server (e.g., Wildfly/JBoss) running Identity Manager.
2. Edit Configuration: Navigate to the User Console web.xml file: [JBoss_or_Wildfly_Home]/standalone/deployments/iam_im.ear/user_console.war/WEB-INF/web.xml
3. Disable Filter: Comment out or remove the following lines associated with TEWSFilter:

   <!-- Comment out the TEWSFilter entries --><filter>  <filter-name>TEWSFilter</filter-name>  <filter-class>com.netegrity.ims.tews6.servletfilter.TewsSecurityFilter</filter-class></filter><filter-mapping>  <filter-name>TEWSFilter</filter-name>  <url-pattern>/TEWS6/*</url-pattern></filter-mapping>

4. Restart Application Server: Start the application server and verify the TEWS calls.

 

Additional Information

• If your integration requires WSS authentication, ensure your SOAP request includes the wsse:Security header.
• Per product documentation, when using WSS Authentication, the SOAP request must contain only the Body without the Envelope tag elements.
• For further details, refer to:
  • Authentication Using WSS Username Token
  • Enable WSS Authentication Support*