WS-Sec UsernameToken

I recently used the WS-Security UsernameToken profile spec as a guide to
encoding simple username/password credentials in XML messages. I am slightly
confused by one aspect which hopefully someone can clear up for me.

It is possible (given the relatively loose content model described in
secext.xsd) to encode more than one set of credentials within a single
<wsse:Security> header block (as below) assuming both tokens are intended
for the same recipient (I guess they could be differentiated in purpose
using the wsu:Id). Certainly toolkits such as .Net WSE support this. The
spec also says that where tokens are targetted for different recipients,
there should be more than one <wsse:Security> header block, differentiated
using the soap:actor (SOAP 1.1) or soap:role (SOAP 1.2) attribute value.

Is there anything I'm missing here in terms of understanding. In my case I
need a calling client to send two sets of creds, the first is used for
authentication purposes (and is not actually at an individual user level)
and the second does reference the actual user but is just used for auditing,
hence we don't need the password (see below).

All comments welcome (is there a WS-Sec newsgroup - I did look but ... ?)

<wsse:Security xmlns:wsse="http://schemas.xmlsoap.org/ws/2003/06/secext"

xmlns:wsu="http://schemas.xmlsoap.org/ws/2003/06/utility">

  <wsse:UsernameToken wsu:Id="AuthUser">
    <wsse:Username>User1</wsse:Username>
    <wsse:Password Type="wsse:PasswordDigest">kek...</wsse:Password>
    <wsse:Nonce EncodingType="wsse:Base64Binary">gaf...</wsse:Nonce>
    <wsse:Created>2003-12-06T22:53:20Z</wsse:Created>
  </wsse:UsernameToken>

  <wsse:UsernameToken wsu:Id="AuditUser">
    <wsse:Username>User2</wsse:Username>
  </wsse:UsernameToken>

</wsse:Security>

Regards

Fraser

_________________________________________________________________
It's fast, it's easy and it's free. Get MSN Messenger today!
http://www.msn.co.uk/messenger