SOAP WCF and WS-Security: the password rotated, the Fault says so

# A distributor's order service on WCF: BasicHttpBinding over HTTPS (TransportWithMessageCredential), the caller# authenticated by a WS-Security UsernameToken inside the envelope. The certificate is signed by the company's own# CA, trusted for this connector only. The password lives in lm secret, never in the manifest.apiVersion: connectors.lumnik.io/v1kind: Connectormetadata:  name: scenario-wcf-a  connector_type: rest-generic  scopes: [sales-wcf-a]spec:  base_url: https://wcf-orders:8443  tls:    ca_secret: SCENARIO_WCF_CA_A          # lm secret set SCENARIO_WCF_CA_A - < ca.crt  auth:    kind: none                            # no HTTP auth: the credential travels in the envelope  endpoints:    - id: open-orders      kind: soap      path: /OrderService.svc      soap_action: "http://distrib.example/orders/IOrderService/GetOpenOrders"      header: |        <wsse:Security soap:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">          <wsse:UsernameToken>            <wsse:Username>lumnik-reader</wsse:Username>            <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">{{secret:SCENARIO_WCF_PASSWORD_A}}</wsse:Password>          </wsse:UsernameToken>        </wsse:Security>      body: |        <GetOpenOrders xmlns="http://distrib.example/orders">          <page>{{page}}</page>          <pageSize>{{page_size}}</pageSize>        </GetOpenOrders>      pagination:        kind: soap        page_size: 10        last_page_path: "$.Body.GetOpenOrdersResponse.GetOpenOrdersResult.IsLastPage"        response_path: "$.Body.GetOpenOrdersResponse.GetOpenOrdersResult.Orders.Order"      target:        kind: hybrid        table: ext.scenario_wcf_a        unique_key: "$.OrderNo"        promote:          - { name: order_no, path: "$.OrderNo", type: text }          - { name: customer, path: "$.Customer", type: text }          - { name: promised_date, path: "$.PromisedDate", type: date }          - { name: confirmed_date, path: "$.ConfirmedDate", type: date }          - { name: warehouse, path: "$.Warehouse", type: text }          - { name: amount, path: "$.Amount", type: decimal }

apiVersion: apps.lumnik.io/v1kind: Processmetadata:  name: scenario-wcf-late-aspec:  scope: sales-wcf-a  on: { event: data.row.changed, table: ext.scenario_wcf_a }  when:    - "confirmed_date>{promised_date}"     # the warehouse confirms a ship date past the customer's promise  emit:    type: decision.confirmed-late-a    message: "{order_no} {customer}: promised {promised_date}, confirmed {confirmed_date} by {warehouse} — call the customer before they call"    key: order_no

# The same connector, speaking HTTP/1.1: the service answers a refused credential with its Fault, then# resets the HTTP/2 stream, and over HTTP/2 the answer is lost on the way (#1859).apiVersion: connectors.lumnik.io/v1kind: Connectormetadata:  name: scenario-wcf-a  connector_type: rest-generic  scopes: [sales-wcf-a]spec:  base_url: https://wcf-orders:8443  http_version: "1.1"                     # Kestrel resets an HTTP/2 stream after a Fault: ask for HTTP/1.1  tls:    ca_secret: SCENARIO_WCF_CA_A          # lm secret set SCENARIO_WCF_CA_A - < ca.crt  auth:    kind: none                            # no HTTP auth: the credential travels in the envelope  endpoints:    - id: open-orders      kind: soap      path: /OrderService.svc      soap_action: "http://distrib.example/orders/IOrderService/GetOpenOrders"      header: |        <wsse:Security soap:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">          <wsse:UsernameToken>            <wsse:Username>lumnik-reader</wsse:Username>            <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">{{secret:SCENARIO_WCF_PASSWORD_A}}</wsse:Password>          </wsse:UsernameToken>        </wsse:Security>      body: |        <GetOpenOrders xmlns="http://distrib.example/orders">          <page>{{page}}</page>          <pageSize>{{page_size}}</pageSize>        </GetOpenOrders>      pagination:        kind: soap        page_size: 10        last_page_path: "$.Body.GetOpenOrdersResponse.GetOpenOrdersResult.IsLastPage"        response_path: "$.Body.GetOpenOrdersResponse.GetOpenOrdersResult.Orders.Order"      target:        kind: hybrid        table: ext.scenario_wcf_a        unique_key: "$.OrderNo"        promote:          - { name: order_no, path: "$.OrderNo", type: text }          - { name: customer, path: "$.Customer", type: text }          - { name: promised_date, path: "$.PromisedDate", type: date }          - { name: confirmed_date, path: "$.ConfirmedDate", type: date }          - { name: warehouse, path: "$.Warehouse", type: text }          - { name: amount, path: "$.Amount", type: decimal }