Re: [WSS4J] XML-Signature with signer certificate - how to?
[email protected] (Werner Dittmann) Wed, 25 Feb 2004 13:39:47 +0100
| Newsgroups | gmane.text.xml.wss4j |
|---|---|
| Message-ID | <01d501c3fb9c$7410bdb0$fe78a8c0@nonehome> |
This is a multi-part message in MIME format. ------=_NextPart_000_01D2_01C3FBA4.D5A5D850 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi, this is not yet supported (will be shortly). Currently, is you specify IssuerSerial, the WSS4J library looks in the = keystore to locate a matching certificate. I'm just working on additonal functions that = support to include the matching certficate directly in the SOAP message as a = BinarySecurityToken.=20 But I would recommend to use the DirectReference = (WSConstants.BST_DIRECT_REFERENCE) that includes the certificate and a reference to it directly in the = message.=20 To protect the included certificate itself, you shall define to sign the = token itself together with the Body. To do so pls refer to the dcoumentation in the *axis.security package, (WSDoAllConstants), SIGNATURE_PARTS. Just take care of the correct = namespace names. Regards, Werner ----- Original Message -----=20 From: Nachiappan Narayanan=20 To: [email protected]=20 Cc: [email protected]=20 Sent: Wednesday, February 25, 2004 7:11 AM Subject: [WSS4J] XML-Signature with signer certificate - how to? All, Im exploring on XML-Signature. The default KeyIdentifier Type is = WSConstants.ISSUER_SERIAL This format sends the Key Information as follows: <ds:KeyInfo Id=3D"id-610399"> <wsse:SecurityTokenReference> <ds:X509IssuerSerial> <ds:X509IssuerName>CN=3DNithya Mani</ds:X509IssuerName> = <ds:X509SerialNumber>44369778256217224370984914847992022613</ds:X509Seria= lNumber> </ds:X509IssuerSerial> </wsse:SecurityTokenReference> </ds:KeyInfo> =20 Here, the tag <wsse:SecurityTokenReference>.... is it proprietary to = WSS4J?=20 =20 =20 =20 =20 I want to send the Sender/Signer's Public Key along with the SOAP = Request as follows: =20 <dsig:KeyInfo> =20 <dsig:X509Data> <dsig:X509SubjectName>CN=3DNithya Mani, OU=3DRoxer, = O=3DInfravio, L=3DChennai, ST=3DTN, C=3DIN</dsig:X509SubjectName> <dsig:X509Certificate> = MIIEqTCCA5GgAwIBAgIBATANBgkqhkiG9w0BAQQFADCBjzELMAkGA1UEBhMC = SUUxDzANBgNVBAgTBkR1YmxpbjERMA8GA1UEBxMIRHVibGluIDQxFDASBgNV = BAoTC1ZvcmRlbCBMdGQuMSEwHwYDVQQLExhSZXNlYXJjaCBBbmQgRGV2ZWxv = cG1lbnQxIzAhBgNVBAMTGlZvcmRlbCBDQSBTZWxmIFNpZ25lZCBSb290MB4X = DTAzMDcwMjE2MTU1NloXDTEzMDYyOTE2MTU1NlowgYAxCzAJBgNVBAYTAklF = MQ8wDQYDVQQIEwZEdWJsaW4xETAPBgNVBAcTCER1YmxpbiA0MRQwEgYDVQQK = EwtWb3JkZWwgTHRkLjEhMB8GA1UECxMYUmVzZWFyY2ggQW5kIERldmVsb3Bt = ZW50MRQwEgYDVQQDEwtTYW1wbGUgVXNlcjCCASIwDQYJKoZIhvcNAQEBBQAD = ggEPADCCAQoCggEBALo5Y51NZy++4//SabaNmBuVpDZwAKdCgn8MQ6CnSdS3 = 5Hhg7Qs3FzKzX+N55/wmLh9A3ON10VTqMZw3qGDQMM28wZWIMrsq1eqUoe56 = s2whA/vHsU20uyfdprFCWqfVjYG5u9xUfqhFTd/pTJ54Ue5meivAMt2hnolH = osJ+RDqnI2sB2T9+V6MmPCDPG1q3tnlVriQ3Ze/4f3DDdr/vOJEZeLZfq3Es = GXoR8o5DJfyBp/x9mkrBtmWj0CjdGUJw85MXlUaWP7kan9nAZPfRYDg/gg10 = L36MbBlnK0Bgqm8VJ/5jo7bm95LPbF4EdrDuImDgO8kHGVx/0q7ie/OeKTUC = AwEAAaOCARswggEXMAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5T = U0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBRl4c0FfIzcF1S3 = UDjbmXu7X+duATCBvAYDVR0jBIG0MIGxgBSMFNQiJRrpUiLgYM2vM74gLA/7 = Q6GBlaSBkjCBjzELMAkGA1UEBhMCSUUxDzANBgNVBAgTBkR1YmxpbjERMA8G = A1UEBxMIRHVibGluIDQxFDASBgNVBAoTC1ZvcmRlbCBMdGQuMSEwHwYDVQQL = ExhSZXNlYXJjaCBBbmQgRGV2ZWxvcG1lbnQxIzAhBgNVBAMTGlZvcmRlbCBD = QSBTZWxmIFNpZ25lZCBSb290ggEAMA0GCSqGSIb3DQEBBAUAA4IBAQCyCwQu = GElQ4JlAgYujLDI9ZyCKw6hqadYEiQUX+wG5lIIUAX8lPn5P+ncoWBI6DFtt = EGlKVeaIsf5xpY5Xfzwh+auLUqghc++R8xRpW611ISrp7iQS1clgiKwbCT5B = jHIgZT16s44XXRXK+d93DGyn8gXzkICNDxiXgSwS3yDW7ibsUmEZfT+TlJef = 4GjuGPRyZ35eNsGgOMHdmyHxOFntgSV3NtVRHqwLFAIm8EFwI5/YR5x9MB7L = 9nJdwf6IS3Lp4fweteBY8kOJ7ekd+hB5hOvZnID1/qI5b4jhQ+Z0Dz0jtym5 P4Lh2TqGntQDlpL5zzX4b1cXXTid1XluWoT/ </dsig:X509Certificate> </dsig:X509Data> </dsig:KeyInfo> =20 In order to do so, what type of KeyIdentifier should i set to the = WSSignEnvelope Object? Regards, Nachiappan.N =20 ------=_NextPart_000_01D2_01C3FBA4.D5A5D850 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <META content=3D"MSHTML 6.00.2722.900" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><FONT face=3DArial size=3D2>Hi,</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>this is not yet supported (will be=20 shortly).</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>Currently, is you specify IssuerSerial, = the WSS4J=20 library looks in the keystore to locate</FONT></DIV> <DIV><FONT face=3DArial size=3D2>a matching certificate. I'm just = working on=20 additonal functions that support to include</FONT></DIV> <DIV><FONT face=3DArial size=3D2>the matching certficate directly in the = SOAP=20 message as a BinarySecurityToken. </FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>But I would recommend to use the = DirectReference=20 (<FONT size=3D2>WSConstants.BST_DIRECT_REFERENCE)</FONT></FONT></DIV> <DIV><FONT face=3DArial size=3D2>that includes the certificate and a = reference to it=20 directly in the message. </FONT></DIV> <DIV><FONT face=3DArial size=3D2>To protect the included certificate = itself, you=20 shall define to sign the token itself together</FONT></DIV> <DIV><FONT face=3DArial size=3D2>with the Body.</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>To do so pls refer to the dcoumentation = in the=20 *axis.security package,</FONT></DIV> <DIV><FONT face=3DArial size=3D2>(WSDoAllConstants), SIGNATURE_PARTS. = Just take care=20 of the correct namespace names.</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2>Regards,</FONT></DIV> <DIV><FONT face=3DArial size=3D2>Werner</FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV>----- Original Message ----- </DIV> <BLOCKQUOTE dir=3Dltr=20 style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; = BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px"> <DIV=20 style=3D"BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: = black"><B>From:</B>=20 <A title=3DNachi-KbPxBdIIuGhWk0Htik3J/[email protected] = href=3D"mailto:Nachi-KbPxBdIIuGhWk0Htik3J/[email protected]">Nachiappan=20 Narayanan</A> </DIV> <DIV style=3D"FONT: 10pt arial"><B>To:</B> <A=20 title=3Dwss4j-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org=20 = href=3D"mailto:[email protected]">[email protected]= eforge.net</A>=20 </DIV> <DIV style=3D"FONT: 10pt arial"><B>Cc:</B> <A = [email protected]=20 href=3D"mailto:[email protected]">[email protected]</A> </DIV> <DIV style=3D"FONT: 10pt arial"><B>Sent:</B> Wednesday, February 25, = 2004 7:11=20 AM</DIV> <DIV style=3D"FONT: 10pt arial"><B>Subject:</B> [WSS4J] XML-Signature = with=20 signer certificate - how to?</DIV> <DIV><BR></DIV> <DIV><FONT face=3DArial size=3D2>All,</FONT></DIV> <DIV> </DIV> <DIV><FONT face=3DArial size=3D2> Im exploring on XML-Signature. = The default=20 KeyIdentifier Type is WSConstants.ISSUER_SERIAL<BR>This format sends = the Key=20 Information as follows:</FONT></DIV> <DIV> </DIV> <DIV><FONT face=3DArial size=3D2> <ds:KeyInfo=20 = Id=3D"id-610399"><BR> <wsse:SecurityTokenRef= erence><BR> <ds:X509IssuerSerial><B= R> <ds:X509IssuerName>CN=3DNithy= a=20 = Mani</ds:X509IssuerName><BR> <= ;ds:X509SerialNumber>44369778256217224370984914847992022613</ds:X50= 9SerialNumber><BR> </ds:X509IssuerSeri= al><BR> </wsse:SecurityTokenReference><BR= > </ds:KeyInfo><BR> <BR> Her= e,=20 the tag <wsse:SecurityTokenReference>.... is it proprietary to = WSS4J?=20 <BR> <BR> <BR> <BR> <BR> I want to send the=20 Sender/Signer's Public Key along with the SOAP Request as=20 follows:<BR> <BR> =20 <dsig:KeyInfo><BR> =20 <BR> = <dsig:X509Data></FONT></DIV> <DIV> </DIV> <DIV><FONT face=3DArial=20 size=3D2> =20 <dsig:X509SubjectName>CN=3DNithya Mani, OU=3DRoxer, = O=3DInfravio, L=3DChennai,=20 ST=3DTN, C=3DIN</dsig:X509SubjectName></FONT></DIV> <DIV> </DIV> <DIV><FONT face=3DArial=20 size=3D2> =20 <dsig:X509Certificate></FONT></DIV> <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = MIIEqTCCA5GgAwIBAgIBATANBgkqhkiG9w0BAQQFADCBjzELMAkGA1UEBhMC</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = SUUxDzANBgNVBAgTBkR1YmxpbjERMA8GA1UEBxMIRHVibGluIDQxFDASBgNV</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = BAoTC1ZvcmRlbCBMdGQuMSEwHwYDVQQLExhSZXNlYXJjaCBBbmQgRGV2ZWxv</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = cG1lbnQxIzAhBgNVBAMTGlZvcmRlbCBDQSBTZWxmIFNpZ25lZCBSb290MB4X</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = DTAzMDcwMjE2MTU1NloXDTEzMDYyOTE2MTU1NlowgYAxCzAJBgNVBAYTAklF</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = MQ8wDQYDVQQIEwZEdWJsaW4xETAPBgNVBAcTCER1YmxpbiA0MRQwEgYDVQQK</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = EwtWb3JkZWwgTHRkLjEhMB8GA1UECxMYUmVzZWFyY2ggQW5kIERldmVsb3Bt</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = ZW50MRQwEgYDVQQDEwtTYW1wbGUgVXNlcjCCASIwDQYJKoZIhvcNAQEBBQAD</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = ggEPADCCAQoCggEBALo5Y51NZy++4//SabaNmBuVpDZwAKdCgn8MQ6CnSdS3</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = 5Hhg7Qs3FzKzX+N55/wmLh9A3ON10VTqMZw3qGDQMM28wZWIMrsq1eqUoe56</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = s2whA/vHsU20uyfdprFCWqfVjYG5u9xUfqhFTd/pTJ54Ue5meivAMt2hnolH</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = osJ+RDqnI2sB2T9+V6MmPCDPG1q3tnlVriQ3Ze/4f3DDdr/vOJEZeLZfq3Es</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = GXoR8o5DJfyBp/x9mkrBtmWj0CjdGUJw85MXlUaWP7kan9nAZPfRYDg/gg10</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = L36MbBlnK0Bgqm8VJ/5jo7bm95LPbF4EdrDuImDgO8kHGVx/0q7ie/OeKTUC</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = AwEAAaOCARswggEXMAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5T</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = U0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBRl4c0FfIzcF1S3</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = UDjbmXu7X+duATCBvAYDVR0jBIG0MIGxgBSMFNQiJRrpUiLgYM2vM74gLA/7</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = Q6GBlaSBkjCBjzELMAkGA1UEBhMCSUUxDzANBgNVBAgTBkR1YmxpbjERMA8G</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = A1UEBxMIRHVibGluIDQxFDASBgNVBAoTC1ZvcmRlbCBMdGQuMSEwHwYDVQQL</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = ExhSZXNlYXJjaCBBbmQgRGV2ZWxvcG1lbnQxIzAhBgNVBAMTGlZvcmRlbCBD</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = QSBTZWxmIFNpZ25lZCBSb290ggEAMA0GCSqGSIb3DQEBBAUAA4IBAQCyCwQu</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = GElQ4JlAgYujLDI9ZyCKw6hqadYEiQUX+wG5lIIUAX8lPn5P+ncoWBI6DFtt</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = EGlKVeaIsf5xpY5Xfzwh+auLUqghc++R8xRpW611ISrp7iQS1clgiKwbCT5B</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = jHIgZT16s44XXRXK+d93DGyn8gXzkICNDxiXgSwS3yDW7ibsUmEZfT+TlJef</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = 4GjuGPRyZ35eNsGgOMHdmyHxOFntgSV3NtVRHqwLFAIm8EFwI5/YR5x9MB7L</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 = 9nJdwf6IS3Lp4fweteBY8kOJ7ekd+hB5hOvZnID1/qI5b4jhQ+Z0Dz0jtym5</FONT></DIV>= <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2> &nbs= p;=20 P4Lh2TqGntQDlpL5zzX4b1cXXTid1XluWoT/</FONT></DIV> <DIV> </DIV> <DIV><FONT face=3DArial=20 size=3D2> =20 </dsig:X509Certificate></FONT></DIV> <DIV> </DIV> <DIV><FONT face=3DArial = size=3D2> =20 </dsig:X509Data></FONT></DIV> <DIV> </DIV> <DIV><FONT face=3DArial size=3D2> =20 </dsig:KeyInfo><BR> </FONT></DIV> <DIV> </DIV> <DIV><FONT face=3DArial size=3D2> In order to do so, what type of = KeyIdentifier should i set to the WSSignEnvelope Object?</FONT></DIV> <DIV> </DIV> <DIV><FONT face=3DArial=20 = size=3D2><BR>Regards,<BR>Nachiappan.N<BR> <BR></FONT></DIV></BLOCKQU= OTE></BODY></HTML> ------=_NextPart_000_01D2_01C3FBA4.D5A5D850-- ------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click