[jira] Commented: (WSS-40) WSSecurityEngine does not support chained certificates

["Seumas Soltysik (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/WSS-40?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12914322#action_12914322 ] 

Seumas Soltysik commented on WSS-40:
------------------------------------

WSSecurityEngine.processSecurityHeader() returns a Vector of WSSecurityEngineResult objects. One of those WSSecurityEngineResult objects does indeed only contain the root certificate of the CertificateChain which is the Certificate used to sign the message. However, there is another WSSecurityEngineResult object in the Vector that contains the CertificateChain from the BST. While this chain is not validated against the local keystore it seems to me that this can be easily done in your code by first getting the CertificateChain from the WSSecurityEngineResult and then calling Crypto.validateCertPath(certs). It would look something like this:

                Vector certsResults = new Vector();
                certsResults = 
                    WSSecurityUtil.fetchAllActionResults(wsResult, WSConstants.BST, certsResults);

                if (!certsResults.isEmpty()) {
                    for (int i = 0; i < certsResults.size(); i++) {
                        WSSecurityEngineResult result = 
                            (WSSecurityEngineResult) certsResults.get(i);
                        X509Certificate[] certs = (X509Certificate[])result.get(WSSecurityEngineResult.TAG_X509_CERTIFICATES);
                        reqData.getSigCrypto().validateCertPath(certs);
                    }
                }

Would this provide the type of validation you require?

> WSSecurityEngine does not support chained certificates
> ------------------------------------------------------
>
>                 Key: WSS-40
>                 URL: https://issues.apache.org/jira/browse/WSS-40
>             Project: WSS4J
>          Issue Type: Bug
>    Affects Versions: 1.5.6
>         Environment: WSS4J 1.0.0, Axis 1.2.1, Sun JDK 1.4.2
>            Reporter: Guy Rixon
>            Assignee: Colm O hEigeartaigh
>             Fix For: 1.6
>
>
> My project, which is associated with the Grid, uses limited proxy certificates for digital signature. I.e., the signing application holds a user's permanent certificate, signed by a CA and a proxy certificate signed with the permanent certificate. The application signs a message using the proxy certificate and includes both the proxy and permanent certificates in the message header as a WS-Security direct reference to a BinarySecurityToken. The service has the CA certificate with which the user's permanent certficate was signed. Therefore, to establish trust, the service has to chain back from the proxy to the permanent certificate and then to the CA certificate.
> WSSignEnvelope includes both certificates correctly but WSSecurityEngine fails when checking the chain of trust. WSSecurityEngine..processSecurityHeader() only adds one certificate to the results passed back to WSDoAllReceiver; it ignores the intermediate certificate in the chain.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.


---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org