[WSS4J] Problems and constraints for STR Transform implementation

All,

during design and first try to implement the STR Transform
for X.509 as specified by WSS I hit some, IMO, serious problems
or constraints.

We have to distinguish two cases
- create a Signature
- verify it

For creating a Signature it seems straight forward to use
the STR Transform. The message creator instantiates a transform
object and can therefore configure it, e.g. to read a certificate
from a certificate store (this might happen if the certificate
is not included in a BinarySecurityToken inside the message but
is referenced by a SubjectKeyIdentifier).

During verfication this set up cannot be done because the 
instantiation of the transform object is done implicitly
by the XMLSignature parser. There is IMO no way to dynamically
configure the transform object to read from a certificate
store etc.

Thus, the STR Transform can work _only_ with Certificates

-  that are embedded in the message (e.g. BinarySecurityToken) 
-  that are referenced via a URL that points directly to the 
   certificate store and the certificate in the storage.

Some more toughts or ideas?

Another topic: during verification of a signature the 
WSSecurityEngine either uses an emebedded certificate or reads it
from a certificate store (depends of the message set up). 

For the latter case I assume the certificate store implicitly 
validates its certificates, their associated certificate chain 
up to the root certficate of some CA, and checks revocation 
lists. Are these assumptions true????

For the "embedded" case WSSecurityEngine just validates the 
Certificate (just expiry dates) that is contained in the message 
but does not check the certificate chain, the root CA, revocation 
lists etc. Anybody with some more know-how that can give
some ideas how to do it?

Regards,
Werner


-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn