You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ws.apache.org by co...@apache.org on 2021/11/12 10:03:54 UTC
svn commit: r1894972 [3/8] - in /webservices/website/wss4j: advisories/
apidocs/org/apache/wss4j/common/util/
apidocs/org/apache/wss4j/common/util/class-use/
testapidocs/org/apache/wss4j/common/token/
testapidocs/org/apache/wss4j/common/util/ testapido...
Added: webservices/website/wss4j/advisories/newfeatures20.html
URL: http://svn.apache.org/viewvc/webservices/website/wss4j/advisories/newfeatures20.html?rev=1894972&view=auto
==============================================================================
--- webservices/website/wss4j/advisories/newfeatures20.html (added)
+++ webservices/website/wss4j/advisories/newfeatures20.html Fri Nov 12 10:03:53 2021
@@ -0,0 +1,313 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<!-- Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2021-11-12 -->
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+ <head>
+ <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+ <title>Apache WSS4J – </title>
+ <style type="text/css" media="all">
+ @import url("./css/maven-base.css");
+ @import url("./css/maven-theme.css");
+ @import url("./css/site.css");
+ </style>
+ <link rel="stylesheet" href="./css/print.css" type="text/css" media="print" />
+ <meta http-equiv="Content-Language" content="en" />
+
+ </head>
+ <body class="composite">
+ <div id="banner">
+ <a href="http://ws.apache.org/wss4j" id="bannerLeft">
+ Apache WSS4Jâ¢
+ </a>
+ <a href="http://www.apache.org" id="bannerRight">
+ <img src="http://activemq.apache.org/images/asf-logo.png" alt="$alt" />
+ </a>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ <div id="breadcrumbs">
+
+ <div class="xleft">
+ <span id="publishDate">Last Published: 2021-11-12</span>
+ | <span id="projectVersion">Version: 2.5.0-SNAPSHOT</span>
+ </div>
+ <div class="xright">
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ <div id="leftColumn">
+ <div id="navcolumn">
+
+ <h5>Apache WSS4J</h5>
+ <ul>
+ <li class="none">
+ <a href="index.html" title="Home">Home</a>
+ </li>
+ <li class="none">
+ <a href="download.html" title="Download">Download</a>
+ </li>
+ <li class="none">
+ <a href="user_guide.html" title="User Guide">User Guide</a>
+ </li>
+ <li class="none">
+ <a href="security_advisories.html" title="Security Advisories">Security Advisories</a>
+ </li>
+ </ul>
+ <h5>Project Documentation</h5>
+ <ul>
+ <li class="collapsed">
+ <a href="project-info.html" title="Project Information">Project Information</a>
+ </li>
+ <li class="collapsed">
+ <a href="project-reports.html" title="Project Reports">Project Reports</a>
+ </li>
+ </ul>
+ <a href="http://maven.apache.org/" title="Built by Maven" class="poweredBy">
+ <img class="poweredBy" alt="Built by Maven" src="./images/logos/maven-feather.png" />
+ </a>
+
+ </div>
+ </div>
+ <div id="bodyColumn">
+ <div id="contentBox">
+ <div class="sect2">
+<h3 id="new_features_available_in_apache_wss4j_2_0_0">New features available in Apache WSS4J 2.0.0</h3>
+<div class="sect3">
+<h4 id="overview_of_new_features">Overview of new features</h4>
+<div class="paragraph">
+<p>Apache WSS4J 2.0.0 delivers the following major new features:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>Support for a streaming (StAX) based WS-Security implementation that
+covers all of the main specifications.</p>
+</li>
+<li>
+<p>A WS-SecurityPolicy model that can be shared between both DOM + StAX
+implementations.</p>
+</li>
+<li>
+<p>Support for "real-time" WS-SecurityPolicy validation for the StAX
+implementation.</p>
+</li>
+<li>
+<p>Support for the SOAP with Attachments (SWA) Profile 1.1 specification.</p>
+</li>
+<li>
+<p>Support for caching based on EhCache.</p>
+</li>
+<li>
+<p>Support for encrypting passwords in Crypto properties files using Jasypt.</p>
+</li>
+</ul>
+</div>
+</div>
+<div class="sect3">
+<h4 id="streaming_stax_based_ws_security_implementation">Streaming (StAX) based WS-Security implementation</h4>
+<div class="paragraph">
+<p>WSS4J 2.0.0 introduces a new streaming (StAX) based WS-Security implementation.
+Please see the dedicated <a href="streaming.html">page</a> for more information.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="ws_securitypolicy_support">WS-SecurityPolicy support</h4>
+<div class="paragraph">
+<p>WSS4J 2.0.0 introduces a new WS-SecurityPolicy model as part of the
+"wss4j-policy" module. This model can be shared between both the DOM and StAX
+WS-Security implementations. Web service stacks such as Apache CXF and
+Apache Axis/Rampart that use WSS4J for WS-Security no longer need to maintain
+their own model. In this way any bug fixes to the model will get picked up
+by all web service stacks that rely on WSS4J.</p>
+</div>
+<div class="paragraph">
+<p>In addition to the new WS-SecurityPolicy model, a significant new feature of
+WSS4J 2.0.0 is that the new streaming WS-Security implementation has the
+ability to perform "real-time" validation of a request against the set of
+applicable WS-SecurityPolicy policies. The DOM-based code in WSS4J does not
+have any concept of WS-SecurityPolicy, but instead processes an inbound
+request, and relies on the web service stack to compare the results against
+the applicable policies. The advantage of the streaming approach in WSS4J
+2.0.0 is that bogus requests can be rejected quicker, which may help to avoid
+DoS based scenarios.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="support_for_signing_and_encrypting_message_attachments">Support for signing and encrypting message attachments</h4>
+<div class="paragraph">
+<p>WSS4J 2.0.0 introduces support for signing and encrypting SOAP message
+attachments, via the the SOAP with Attachments (SWA) Profile 1.1 specification.
+Please see the dedicated <a href="attachments.html">page</a> for more
+information.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="replay_attack_detection_using_ehcache">Replay Attack detection using EhCache</h4>
+<div class="paragraph">
+<p>In WSS4J 1.6.x, a "ReplayCache" interface was introduced to cache tokens to
+guard against replay attacks for the following scenarios:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>Signed Timestamps</p>
+</li>
+<li>
+<p>UsernameToken nonces</p>
+</li>
+<li>
+<p>SAML OneTimeUse Assertions</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>However, replay attack detection was not "switched on" by default in WSS4J
+1.6.x. In WSS4J 2.0.x, replay attack detection is enabled by default using
+an implementation of the "ReplayCache" interface based on EhCache. The
+following configuration tags can be used to configure caching:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>ConfigurationConstants.TIMESTAMP_CACHE_INSTANCE ("timestampCacheInstance"):
+This holds a reference to a ReplayCache instance used to cache Timestamp
+Created Strings. The default instance that is used is the EHCacheReplayCache.</p>
+</li>
+<li>
+<p>ConfigurationConstants.ENABLE_TIMESTAMP_CACHE ("enableTimestampCache"):
+Whether to cache Timestamp Created Strings (these are only cached in
+conjunction with a message Signature). The default value is "true".</p>
+</li>
+<li>
+<p>ConfigurationConstants.NONCE_CACHE_INSTANCE ("nonceCacheInstance"): This
+holds a reference to a ReplayCache instance used to cache UsernameToken
+nonces. The default instance that is used is the EHCacheReplayCache.</p>
+</li>
+<li>
+<p>ConfigurationConstants.ENABLE_NONCE_CACHE ("enableNonceCache"): Whether to
+cache UsernameToken nonces. The default value is "true".</p>
+</li>
+<li>
+<p>ConfigurationConstants. SAML_ONE_TIME_USE_CACHE_INSTANCE
+("samlOneTimeUseCacheInstance"): This holds a reference to a ReplayCache
+instance used to cache SAML2 Token Identifier Strings (if the token contains a
+OneTimeUse Condition). The default instance that is used is the
+EHCacheReplayCache.</p>
+</li>
+<li>
+<p>ConfigurationConstants.ENABLE_SAML_ONE_TIME_USE_CACHE
+("enableSamlOneTimeUseCache"): Whether to cache SAML2 Token Identifiers, if
+the token contains a "OneTimeUse" Condition. The default value is "true".</p>
+</li>
+</ul>
+</div>
+</div>
+<div class="sect3">
+<h4 id="encrypting_passwords_in_crypto_property_files">Encrypting passwords in Crypto property files</h4>
+<div class="paragraph">
+<p>A typical example of the contents of a Crypto properties file (for Signature
+creation) is as follows:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>org.apache.wss4j.crypto.provider=org.apache.wss4j.common.crypto.Merlin</p>
+</li>
+<li>
+<p>org.apache.wss4j.crypto.merlin.keystore.type=jks</p>
+</li>
+<li>
+<p>org.apache.wss4j.crypto.merlin.keystore.password=security</p>
+</li>
+<li>
+<p>org.apache.wss4j.crypto.merlin.keystore.alias=wss40</p>
+</li>
+<li>
+<p>org.apache.wss4j.crypto.merlin.keystore.file=keys/wss40.jks</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>Note that the password used to load the keystore is in cleartext. One of the
+new features of Apache WSS4J 2.0.0 is the ability to instead store a (BASE-64
+encoded) encrypted version of the keystore password in the Crypto properties
+file. A new PasswordEncryptor interface is defined to allow for the
+encryption/decryption of passwords. A default implementation is now provided
+based on Jasypt called JasyptPasswordEncryptor, which uses
+"PBEWithMD5AndTripleDES".</p>
+</div>
+<div class="paragraph">
+<p>The WSPasswordCallback class has an additional "usage" called
+WSPasswordCallback.PASSWORD_ENCRYPTOR_PASSWORD, which is used to return the
+master password for use with the PasswordEncryptor implementation. When WSS4J
+is loading a Crypto implementation via a properties file, and it encounters a
+password encrypted in the format "ENC(encoded encrypted password)", it queries
+a CallbackHandler for a password via this WSPasswordCallback usage tag. It is
+possible to pass a custom PasswordEncryptor implementation to WSS4J via the
+new configuration tag ConfigurationConstants.PASSWORD_ENCRYPTOR_INSTANCE
+("passwordEncryptorInstance").</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="miscellaneous_new_features">Miscellaneous new features</h4>
+<div class="paragraph">
+<p>Support was added in WSS4J 1.6.x to obtain a Kerberos ticket from a KDC (Key
+Distribution Center) and include it in the security header of a request, as
+well as to process the received token. However, there was no built-in way to
+extract the secret key from the ticket to secure the request. Instead it was
+up to the user to plug in a custom "KerberosTokenDecoder" implementation to
+support this behaviour. In WSS4J 2.0.0, a default KerberosTokenDecoder
+implementation is provided, and so WSS4J now supports signing/encrypting using
+Kerberos tokens by default.</p>
+</div>
+<div class="paragraph">
+<p>A new "CustomToken" Action is defined in WSS4J 2.0.0. If this action is
+defined, a token (DOM Element) will be retrieved from a CallbackHandler via
+WSPasswordCallback.Usage.CUSTOM_TOKEN and written out as is in the security
+header. This provides for an easy way to write out tokens that have been
+retrieved out of band. Another related new feature is the ability to associate
+an action with a particular set of keys/algorithms. This means that it is now
+possible to configure two different Signature actions, that use different
+keys/algorithms.</p>
+</div>
+<div class="paragraph">
+<p>Support for enforcing the Basic Security Profile (BSP) 1.1 specification was
+added in WSS4J 1.6.x. In WSS4J 2.0.0, it is possible to disable individual
+BSP Rules for a non-compliant request, instead of having to disable BSP
+enforcement altogether as for WSS4J 1.6.x. The RequestData class has a
+setIgnoredBSPRules method, that takes a list of BSPRule Objects as an argument.
+The BSPRule class contains a complete list of Basic Security Profile rules
+that are enforced in WSS4J.</p>
+</div>
+<div class="paragraph">
+<p>WSS4J 2.0.0 now enforces the SubjectConfirmation requirements of an inbound
+SAML Token, instead of leaving it to the web services stack. For
+sender-vouches, a Signature must be present that covers both the SOAP Body and
+the SAML Assertion. For holder-of-key, a Signature must be present that signs
+some part of the SOAP request using the key information contained in the SAML
+Subject. Note that a Signature can be either a message or transport level
+Signature (i.e. using TLS is acceptable). A new configuration tag is defined
+that allows the user to switch off this validation if required
+(ConfigurationConstants.VALIDATE_SAML_SUBJECT_CONFIRMATION -
+"validateSamlSubjectConfirmation").</p>
+</div>
+</div>
+</div>
+ </div>
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ <div id="footer">
+ <div class="xright">
+ Apache WSS4J, WSS4J, Apache, the Apache feather logo are trademarks of The Apache Software Foundation.
+ All other marks mentioned may be trademarks or registered trademarks of their respective owners.
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ </body>
+</html>
Added: webservices/website/wss4j/advisories/package.html
URL: http://svn.apache.org/viewvc/webservices/website/wss4j/advisories/package.html?rev=1894972&view=auto
==============================================================================
--- webservices/website/wss4j/advisories/package.html (added)
+++ webservices/website/wss4j/advisories/package.html Fri Nov 12 10:03:53 2021
@@ -0,0 +1,902 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<!-- Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2021-11-12 -->
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+ <head>
+ <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+ <title>Apache WSS4J – </title>
+ <style type="text/css" media="all">
+ @import url("./css/maven-base.css");
+ @import url("./css/maven-theme.css");
+ @import url("./css/site.css");
+ </style>
+ <link rel="stylesheet" href="./css/print.css" type="text/css" media="print" />
+ <meta http-equiv="Content-Language" content="en" />
+
+ </head>
+ <body class="composite">
+ <div id="banner">
+ <a href="http://ws.apache.org/wss4j" id="bannerLeft">
+ Apache WSS4Jâ¢
+ </a>
+ <a href="http://www.apache.org" id="bannerRight">
+ <img src="http://activemq.apache.org/images/asf-logo.png" alt="$alt" />
+ </a>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ <div id="breadcrumbs">
+
+ <div class="xleft">
+ <span id="publishDate">Last Published: 2021-11-12</span>
+ | <span id="projectVersion">Version: 2.5.0-SNAPSHOT</span>
+ </div>
+ <div class="xright">
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ <div id="leftColumn">
+ <div id="navcolumn">
+
+ <h5>Apache WSS4J</h5>
+ <ul>
+ <li class="none">
+ <a href="index.html" title="Home">Home</a>
+ </li>
+ <li class="none">
+ <a href="download.html" title="Download">Download</a>
+ </li>
+ <li class="none">
+ <a href="user_guide.html" title="User Guide">User Guide</a>
+ </li>
+ <li class="none">
+ <a href="security_advisories.html" title="Security Advisories">Security Advisories</a>
+ </li>
+ </ul>
+ <h5>Project Documentation</h5>
+ <ul>
+ <li class="collapsed">
+ <a href="project-info.html" title="Project Information">Project Information</a>
+ </li>
+ <li class="collapsed">
+ <a href="project-reports.html" title="Project Reports">Project Reports</a>
+ </li>
+ </ul>
+ <a href="http://maven.apache.org/" title="Built by Maven" class="poweredBy">
+ <img class="poweredBy" alt="Built by Maven" src="./images/logos/maven-feather.png" />
+ </a>
+
+ </div>
+ </div>
+ <div id="bodyColumn">
+ <div id="contentBox">
+
+
+<div class="section">
+<h2><a name="Axis1_Deployment_Tutorial"></a>Axis1 Deployment Tutorial</h2>
+
+<p>
+WSS4J 1.5.x Axis handlers process SOAP requests according to the OASIS Web Service
+Security (WSS) specifications.
+</p>
+<p></p>
+<p>
+The WSS4J Axis handlers <tt>WSDoAllSender</tt> and <tt>WSDoAllReceiver
+</tt> control the creation and consumption of secure SOAP requests.
+The handlers work behind the scenes and are usually transparent to Web Service
+(WS) applications. The Axis deployment descriptor files (*.wsdd) may contain all
+necessary information to control the security processing.
+</p>
+<p></p>
+<p>
+A WS application may also set properties to control the handlers
+and provide default values. If the deployment descriptor sets the same
+property (parameter) then the deployment descriptor overwrites the application
+defined property. Thus, deployment settings overwrite application settings
+to fulfill site specific requirements.
+
+</p></div>
+
+<div class="section">
+<h2><a name="Prerequisites"></a>Prerequisites</h2>
+<p>
+The WS Security Axis handlers use the WSS4J classes (Web Service Security
+for Java) to process the SOAP messages. WSS4J in turn uses the Apache XML Security
+project to handle XML Security according to XML Signature and XML Encryption.
+
+</p>
+<ul>
+
+<li><a class="externalLink" href="http://ws.apache.org/wss4j/index.html">WSS4J</a></li>
+
+<li><a class="externalLink" href="http://xml.apache.org/security/index.html">XML Security</a></li>
+</ul>
+
+The WSS4J Axis handlers require Axis V1.2 because of some problems in previous
+Axis versions. WSS4J CVS contains the latest Axis libraries.
+
+</div>
+<div class="section">
+<h2><a name="Related_Documentation"></a>Related Documentation</h2>
+<p>
+The OASIS WSS specifications define a number of features and it is possible
+to combine them in several ways. The WSS4J Axis handlers already support
+a large number of WSS features and their combinations.
+<a class="externalLink" href="http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=wss">
+Here</a> are the WSS specifications.
+
+</p></div>
+<div class="section">
+<h2><a name="The_basics_-_a_simple_example_that_uses"></a>The basics - a simple example that uses</h2>
+<p>
+This chapter gives an overview and some examples how to deploy
+the WSS4J Axis handlers and how the parameters and their values control the
+handlers. For a better understanding of this chapter the reader shall
+have a knowledge of the OASIS WSS specifications.
+</p>
+<p></p>
+<p>
+The {@link org.apache.ws.security.handler.WSHandlerConstants},
+{@link org.apache.ws.axis.security.WSDoAllSender}, and
+{@link org.apache.ws.axis.security.WSDoAllReceiver}
+provide additional and detailed documentation.
+
+</p>
+<div class="section">
+<h3><a name="Axis_deployment_descriptor_to_insert_a"></a>Axis deployment descriptor to insert a</h3>
+<p>
+The following snippet shows a general layout how to deploy a WS Axis handler
+on the client (application) side.
+</p>
+<div class="source">
+<pre>
+ <!-- define the service, use the WSDoAllSender security handler in request flow -->
+ <service name="Ping1">
+ <requestFlow>
+ <handler type="java:org.apache.ws.axis.security.WSDoAllSender" >
+ <parameter name="action" value="UsernameToken"/>
+ <parameter name="user" value="werner"/>
+ <parameter name="passwordType" value="PasswordText" />
+ <parameter name="passwordCallbackClass"
+ value="org.apache.ws.axis.oasis.PWCallback1Out"/>
+ </handler>
+ </requestFlow>
+ </service>
+</pre></div>
+
+This is the standard way to deploy an Axis handler. Axis parses the deployment
+descriptor and provides the parameters and their value to the handler. Each
+service can have its own request and response flow definition, which provides
+a very flexible set-up of the security parameters.
+
+<p></p>
+<p>
+The above setup inserts the most simple security structure into a SOAP request:
+the simple <tt>UsernameToken</tt>. This token includes a username and the
+according password. Both fields are sent in cleartext, thus it provides no
+real security.
+</p>
+<p></p>
+<p>
+
+The parameters and their meanings are:
+</p>
+<ul>
+
+<li><tt>action</tt> defines the security action. The value <tt>
+ UsernameToken</tt> directs the handler to insert this token into
+ the SOAP request.
+</li>
+
+<li><tt>user</tt> specifies the username to include in the token.
+</li>
+
+<li><tt>passwordType</tt> is a pecific parameter for the <tt>
+ UsernameToken</tt> action and defines the encoding of the passowrd.
+ <tt>PasswordText</tt> specifies to send the password in
+ plain text, <tt>PasswordDigest</tt> specifies to send the
+ password in digest mode (refer to WSS UsernameToken Profile)
+</li>
+
+<li><tt>passwordCallbackClass</tt> contains the name of a class that
+ implements a method to get the user's password. Please refer to the
+ detailed documentation in
+ {@link org.apache.ws.security.handler.WSHandlerConstants#PW_CALLBACK_CLASS}.
+ </li>
+</ul>
+The WSS4J Axis security handler interprets the parameter values and controls
+the WSS4J modules to generate the following SOAP request:
+
+<div class="source">
+<pre>
+<?xml version="1.0" encoding="UTF-8"?>
+<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
+ xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+ <soapenv:Header>
+ <wsse:Security xmlns:wsse="http://schemas.xmlsoap.org/ws/2002/07/secext"
+ soapenv:mustUnderstand="true">
+ <wsse:UsernameToken>
+ <wsse:Username>werner</wsse:Username>
+ <wsse:Password Type="wsse:PasswordText">security</wsse:Password>
+ </wsse:UsernameToken>
+ </wsse:Security>
+ </soapenv:Header>
+ <soapenv:Body>
+ <Ping xmlns="http://xmlsoap.org/Ping">
+ <text>Scenario 1 text</text>
+ <ticket xmlns:ns1="http://xmlsoap.org/Ping"
+ xsi:type="ns1:ticketType">scenario1</ticket>
+ </Ping>
+ </soapenv:Body>
+</soapenv:Envelope>
+</pre></div>
+This is a pretty print of the real SOAP message.
+
+</div>
+<div class="section">
+<h3><a name="The_password_callback_class"></a>The password callback class</h3>
+<p>
+
+The deployment descriptor contains the user name that the handler inserts into
+the <tt>UsernameToken</tt> but not the password. In general it is not a
+good idea to store sensitive information like a password in cleartext. To
+get the password the WSS4J Axis handler uses a password callback
+technique similar to the JAAS mechansim. The parameter
+<tt>passwordCallbackClass</tt> contains the classname of the callback
+class. This class must implement the
+{@link javax.security.auth.callback.CallbackHandler}
+interface. The WSS4J Axis handler gets this class,
+instantiates it, and calls the <tt>handle</tt> method when it
+needs a password. Refer also to the
+{@link org.apache.ws.security.handler.WSHandlerConstants#PW_CALLBACK_CLASS
+ parameter} documentation.
+ </p>
+<p></p>
+<p>
+ The following code snippet shows a simple password callback class:
+ </p>
+<div class="source">
+<pre>
+package org.apache.ws.axis.oasis;
+
+import java.io.IOException;
+
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.UnsupportedCallbackException;
+
+import org.apache.ws.security.WSPasswordCallback;
+
+public class PWCallback implements CallbackHandler {
+
+ private static final byte[] key = {
+ (byte)0x31, (byte)0xfd, (byte)0xcb, (byte)0xda,
+ (byte)0xfb, (byte)0xcd, (byte)0x6b, (byte)0xa8,
+ (byte)0xe6, (byte)0x19, (byte)0xa7, (byte)0xbf,
+ (byte)0x51, (byte)0xf7, (byte)0xc7, (byte)0x3e,
+ (byte)0x80, (byte)0xae, (byte)0x98, (byte)0x51,
+ (byte)0xc8, (byte)0x51, (byte)0x34, (byte)0x04,
+ };
+
+ public void handle(Callback[] callbacks)
+ throws IOException, UnsupportedCallbackException {
+ for (int i = 0; i < callbacks.length; i++) {
+ if (callbacks[i] instanceof WSPasswordCallback) {
+ WSPasswordCallback pc = (WSPasswordCallback) callbacks[i];
+ /*
+ * here call a function/method to lookup the password for
+ * the given identifier (e.g. a user name or keystore alias)
+ * e.g.: pc.setPassword(passStore.getPassword(pc.getIdentfifier))
+ * for testing we supply a fixed name/fixed key here.
+ */
+ if (pc.getUsage() == WSPasswordCallback.KEY_NAME) {
+ pc.setKey(key);
+ }
+ else {
+ pc.setPassword("security");
+ }
+ } else {
+ throw new UnsupportedCallbackException(
+ callbacks[i], "Unrecognized Callback");
+ }
+ }
+ }
+}
+</pre></div>
+The Java {@link javax.security.auth.callback.CallbackHandler callback} handler
+documentation provides a detailed description of the interface and exceptions.
+
+<p></p>
+<p>
+The WSS4J library uses a specific class to get the required password or key
+informations. The <tt>WSSPasswordCallback</tt> class implements the
+{@link javax.security.auth.callback.Callback} interface according to the
+JAAS. Depending on it usage this class either carries the required password
+as a Java <tt>String </tt> or it carries the required key information
+as a Java <tt>byte[]</tt> array. Refer to
+{@link org.apache.ws.security.WSPasswordCallback} that contains a
+detailed description of the usage codes.
+</p>
+<p></p>
+<p>
+The WSS4J Axis handler or the WSS4J modules set the usage code before
+they call <tt>handle</tt> method.
+
+</p></div>
+<div class="section">
+<h3><a name="Application_sets_parameters_to_insert_in"></a>Application sets parameters to insert in</h3>
+<p>
+
+Sometimes it is not feasable or not possible to determine parameters
+and their values during deployment. In this case the application can
+set paramters during runtime. The WSS4J Axis handlers use the Axis
+<tt>setProperty</tt> method to support this feature.
+</p>
+<p></p>
+<p>
+The following code snippet shows an example how to use the dynamic setting
+of parameters and their values:
+</p>
+<div class="source">
+<pre>
+ ...
+ Service service = new Service();
+ Call call = (Call) service.createCall();
+ ...
+ call.setProperty(UsernameToken.PASSWORD_TYPE, WSConstants.PASSWORD_TEXT);
+ call.setProperty(WSHandlerConstants.USER, "werner");
+ ...
+</pre></div>
+Use this way if your application dynamically creates a <tt>call</tt>
+object. If your application uses stubs generated by Axis' <tt>WSDL2Java
+</tt> tool, the application uses the following functions:
+
+<div class="source">
+<pre>
+ ...
+ PingServiceLocator service = new PingServiceLocator();
+ ...
+ PingPort port = (PingPort) service.getPing1();
+ port._setProperty(UsernameToken.PASSWORD_TYPE, WSConstants.PASSWORD_TEXT);
+ port._setProperty(WSHandlerConstants.USER, "werner");
+ ...
+</pre></div>
+Please note that <tt>_setProperty</tt> is a Axis specific call.
+
+</div>
+<div class="section">
+<h3><a name="The_password_callback_object_reference"></a>The password callback object reference</h3>
+<p>
+
+In addition to the <a href="#pwCallBackClass">password callback class</a>
+an application may set a password callback object using the <tt>
+ setProperty()</tt> methods. Only applications (and Axis handlers that
+ preceed the WSS4J Axis handlers in a handler chain) can use this feature.
+ </p>
+<p></p>
+<p>
+ For example:
+ </p>
+<div class="source">
+<pre>
+public class Scenario1 implements CallbackHandler {
+
+ public static void main(String args[]) {
+ ...
+ PingServiceLocator service = new PingServiceLocator();
+ ...
+ PingPort port = (PingPort) service.getPing1();
+ ((org.apache.axis.client.Stub)port)._setProperty(UsernameToken.PASSWORD_TYPE, WSConstants.PASSWORD_TEXT);
+ ((org.apache.axis.client.Stub)port._setProperty(WSHandlerConstants.USER, "werner");
+ ((org.apache.axis.client.Stub)port._setProperty(WSHandlerConstants.PW_CALLBACK_REF, this);
+ ...
+ }
+
+ public void handle(Callback[] callbacks) {
+ ...
+ }
+}
+</pre></div>
+
+</div>
+<div class="section">
+<h3><a name="Deployment_of_the_WSS4J_Axis__handler"></a>Deployment of the WSS4J Axis handler</h3>
+<p>
+
+Similar to the deployment descriptor of the sending handler <tt>WSDoAllSender
+</tt> a deployment descriptor for the receiving handler exists. For the above
+example the deployment descriptor look like:
+</p>
+<div class="source">
+<pre>
+ <requestFlow>
+ <handler type="java:org.apache.ws.axis.security.WSDoAllReceiver">
+ <parameter name="passwordCallbackClass"
+ value="org.apache.ws.axis.oasis.PWCallback"/>
+ <parameter name="action" value="UsernameToken"/>
+ </handler>
+ </requestFlow>
+</pre></div>
+The receiving WSS4J Axis handler checks if the SOAP request matches the defined
+actions.
+
+</div></div>
+<div class="section">
+<h2><a name="Combining_security_actions"></a>Combining security actions</h2>
+<p>
+
+Often it is necessary to combine or concatenate several security actions, for
+example to encrypt parts of a message and sign some other parts. The WSS4J
+Axis handlers provide easy and simple methods to combine or concatenate
+security actions.
+</p>
+<p></p>
+<p>
+This chapter describes simple combinations of actions.
+
+</p>
+<div class="section">
+<h3><a name="Combine__and"></a>Combine and</h3>
+<p>
+
+The WS Interoperability specifications define this use case:
+</p>
+<ul>
+
+<li>Insert a <tt>UsernameToken</tt>, use <tt>PasswordText</tt>
+ to set the password. In addition add a timestamp and a nonce into
+ the <tt>UsernameToken</tt></li>
+
+<li>Encrypt the <tt>UsernameToken</tt> to protect the information.
+ </li>
+</ul>
+
+The Axis deplyment descriptor for this use case:
+
+<div class="source">
+<pre>
+ <requestFlow>
+ <handler type="java:org.apache.ws.axis.security.WSDoAllSender" >
+ <parameter name="action" value="UsernameToken Encrypt"/>
+ <parameter name="user" value="werner"/>
+ <parameter name="passwordCallbackClass"
+ value="org.apache.ws.axis.oasis.PWCallback"/>
+ <parameter name="passwordType" value="PasswordText" />
+ <parameter name="addUTElement" value="Nonce Created" />
+ <parameter name="encryptionPropFile" value="crypto.properties" />
+ <parameter name="encryptionKeyIdentifier" value="X509KeyIdentifier" />
+ <parameter name="encryptionUser"
+ value="16c73ab6-b892-458f-abf5-2f875f74882e" />
+ <parameter name="encryptionParts"
+ value="{Element}{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken" />
+ </handler>
+ </requestFlow>
+</pre></div>
+
+This descriptor contains some new parameters to control the <tt>UsernameToken
+</tt> element and its encryption. The new parameters and their meaning are:
+
+<ul>
+
+<li><tt>addUTElement</tt> - controls if the handler shall insert elements
+ into the <tt>UsernameToken</tt>. The value is a blank separated list of
+ element names to include. Only <tt>Nonce</tt> and <tt>Created</tt> are
+ supported.</li>
+
+<li><tt>encryptionPropFile</tt> - the name of a crypto property file. This
+ file contains parameters and property that control the encryption. Please refer
+ to the
+ {@link org.apache.ws.security.handler.WSHandlerConstants#ENC_PROP_FILE
+ detailed} description of the cyrpto property file.</li>
+
+<li><tt>encryptionKeyIdentifier</tt> - specifies the format in which the
+ handler inserts the encryption key into the SOAP request. Please refer
+ to the
+ {@link org.apache.ws.security.handler.WSHandlerConstants#ENC_KEY_ID
+ detailed} description.</li>
+
+<li><tt>encryptionUser</tt> - the name or identifier of the user who owns
+ the public key to encrypt the data. Usually this is the name or alias name
+ of the owner's certificate in a keystore.</li>
+
+<li><tt>encryptionParts</tt> - controls which part or parts the handler
+ of the SOAP shall encrypt. If this parameter is not defined, WSS4J encrypts
+ the whole SOAP Body in <tt>Content</tt> mode. The value of the
+ parameter in this example specifies to encrypt the element <tt>
+ UsernameToken</tt>, contained in the namespace
+ <tt>http://schemas.xmlsoap.org/ws/2002/07/secext</tt>. The encryption
+ module uses the <tt>Element</tt> mode to encrypt the element data.
+ Please refer to the
+ {@link org.apache.ws.security.handler.WSHandlerConstants#ENCRYPTION_PARTS
+ detailed} description.
+ </li>
+</ul>
+The matching receiver deployment descriptor:
+
+<div class="source">
+<pre>
+ <requestFlow>
+ <handler type="java:org.apache.ws.axis.security.WSDoAllReceiver">
+ <parameter name="passwordCallbackClass"
+ value="org.apache.ws.axis.oasis.PWCallback"/>
+ <parameter name="action" value="UsernameToken Encrypt"/>
+ <parameter name="decryptionPropFile" value="crypto.properties" />
+ </handler>
+ </requestFlow>
+</pre></div>
+The only new parameter here is the <tt>decryptionPropFile</tt>. This
+parameter defines the crypto property file at the receiver side. The value
+ of the <tt>action</tt> parameter matches the according value at the
+ sender side. The WSS4J Axis receiver checks if the SOAP request contains
+ the required security data.
+
+</div>
+<div class="section">
+<h3><a name="Combine_Signature_and_Encryption"></a>Combine Signature and Encryption</h3>
+<p>
+
+This is a very common usage of Web Service security. The WSS4J Axis handler
+provides flexible parameter settings that support several ways to use
+the Signature/Encryption combination.
+</p>
+<p></p>
+<p>
+A WSS4J Axis deployment descriptor for a simple Singature/Encryption of
+SOAP requests:
+</p>
+<div class="source">
+<pre>
+<requestFlow>
+ <handler type="java:org.apache.ws.axis.security.WSDoAllSender" >
+ <parameter name="user" value="16c73ab6-b892-458f-abf5-2f875f74882e"/>
+ <parameter name="passwordCallbackClass"
+ value="org.apache.ws.axis.oasis.PWCallback"/>
+ <parameter name="action" value="Signature Encrypt"/>
+ <parameter name="signaturePropFile" value="crypto.properties" />
+ </handler>
+</requestFlow>
+</pre></div>
+This simple deployment descriptor signs and encrypts the SOAP Body part.
+The only new parameter, <tt>signaturePropFile</tt>, specifies the
+name of the signature crypto property file to use. Because no
+<tt>encryptionPropFile</tt> is declared the handler also uses the signature
+property file to get the encryption certificate. The same holds true for
+the username. The password callback class must return a password
+to get the user's private key (the keystore is defined in the crypto
+property file) that WSS4J uses to generate the signature. The encryption
+method uses the user's public key to encrypt the dynamically generated
+session key.
+
+<p></p>
+<p>
+The <tt>action</tt> parameter defines <tt>Signature Encryption</tt>.
+Thus the handler first signs, then the encrypts the data.
+Because the deployment descriptor does not contain specific encryption or
+signature part parameters, WSS4J defaults to the data of the SOAP Body element.
+</p>
+<p></p>
+<p>
+Also all other parameters use their default setting, such as the format of the
+key identifiers, encryption modifiers, and so on. Please refer to the
+{@link org.apache.ws.security.handler.WSHandlerConstants detailed}
+documentation of the parameters.
+</p>
+<p></p>
+<p>
+If the WSS4J Axis handler shall perform encryption only, then the
+deployment descriptor must contain the encryption specific parameters. Only
+if sign <b>and</b> encryption is required the encryption method falls back to
+the signature parameters if the encryption specific parameters are not set.
+</p>
+<p></p>
+<p>
+The matching receiver deployment descriptor is also very simple:
+</p>
+<div class="source">
+<pre>
+<requestFlow>
+ <handler type="java:org.apache.ws.axis.security.WSDoAllReceiver">
+ <parameter name="passwordCallbackClass"
+ value="org.apache.ws.axis.oasis.PWCallback"/>
+ <parameter name="action" value="Signature Encrypt"/>
+ <parameter name="signaturePropFile" value="crypto.properties" />
+ </handler>
+ </requestFlow>
+</pre></div>
+To reverse the actions, just reverse the action specifiers. The WSS4J
+handler encrypts the SOAP Body first, then signs the encrypted data.
+
+</div></div>
+<div class="section">
+<h2><a name="Signing_and_encrypting_multiple_XML_elements"></a>Signing and encrypting multiple XML elements</h2>
+<p>
+
+Sometimes it is necessary to sign and/or encrypt several parts of a SOAP
+message. The deployment parameters <tt>signatureParts</tt> and
+<tt>encryptionParts</tt> control which SOAP elements to sign or
+to encrypt. Please refer to the
+{@link org.apache.ws.security.handler.WSHandlerConstants#ENCRYPTION_PARTS
+detailed} description of these parameters.
+</p>
+<p></p>
+<p>
+WSS4J signs or encrypts all declared parts using the same keys, that is
+the signature or encryption data structures directly reference the
+specified parts as described in the WSS specifications. The receiver
+automatically detects these references and verfies and decrypts the
+data parts. No special settings in the depolyment descriptor is necessary.
+
+</p></div>
+<div class="section">
+<h2><a name="Chaining_of_WSS4J_Axis_handlers"></a>Chaining of WSS4J Axis handlers</h2>
+<p>
+
+This is a very powerful feature that supports even more flexible signature and
+encryption processing such as signatures with multiple keys (overlapping
+signatures), multiple encryption algorithms, or different SOAP actor (role)
+defintions of the security headers.
+
+</p>
+<div class="section">
+<h3><a name="Deployment_at_the_client"></a>Deployment at the client</h3>
+<p>
+A deployment descriptor to chain handlers:
+</p>
+<div class="source">
+<pre>
+ <requestFlow>
+ <handler type="java:org.apache.ws.axis.security.WSDoAllSender" >
+ <parameter name="action" value="Signature NoSerialization"/>
+ <parameter name="user" value="firstUser"/>
+ <parameter name="passwordCallbackClass"
+ value="org.apache.ws.axis.oasis.PWCallback"/>
+ <parameter name="signaturePropFile" value="crypto.properties" />
+ <parameter name="signatureParts" value="{}{http://xmlsoap.org/Ping}ticket" />
+ </handler>
+ <handler type="java:org.apache.ws.axis.security.WSDoAllSender" >
+ <parameter name="action" value="Signature"/>
+ <parameter name="user" value="anotherUser"/>
+ <parameter name="passwordCallbackClass"
+ value="org.apache.ws.axis.oasis.PWCallback"/>
+ <parameter name="signaturePropFile" value="crypto.properties" />
+ </handler>
+ </requestFlow>
+</pre></div>
+Note the action specifier <tt>NoSerialization</tt> first handler.
+In a handler chain of WSS4J handlers every
+but the last handler <i>must</i> have this action specifier. This specifier
+surpresses the very last step of the handler's security processing: the
+serialization of the processed SOAP request in a XML string (document) that
+Axis sends to the reveiver. Only the last handler must perform this
+serialization.
+
+<p></p>
+<p>
+Every handler specification can have its own set of parameters that define
+the individual values for this handler instance. Thus the deployment
+descriptor can define different crypto property files, different usernames,
+and so on. In the example the first handler signs the <tt>ticket</tt>
+element and the second handler the SOAP Body (default).
+</p>
+<p></p>
+<p>
+Parameters set by the application with <tt>setProperty</tt> are valid for
+<b>all</b> handler instances in the handler
+chain (<tt>setProperty</tt> is defined on the SOAP request (call) level).
+As already decribed, deployment settings overrule application settings. Thus it
+is possible to combine various parameter specifications. A special case is the
+definition of the username. If an application sets the username and one
+handler instance in the chain does not have a <tt>user</tt> parameter
+in its deployment part, then this one handler instance uses the username set
+bey the application. After the handler copied the username from the username
+property, the handler sets the property's content to <tt>null</tt>.
+Handlers that follow in the chain cannot use this username anymore and
+must have a user (or encryption user) parameter in their deployment part.
+
+</p></div>
+<div class="section">
+<h3><a name="Deployment_at_the_server"></a>Deployment at the server</h3>
+<p>
+
+Note: Handler chaining at the receiver side is not yet fully tested.
+</p>
+<p></p>
+<p>
+Handlers at the receiver can only determine different security headers if their
+SOAP actors are different. The WSS4J handler processes each security structure
+inside one security header. Because the security structures contain most
+information to verify or decrypt the SOAP request this constraint is
+not too much of an issue.
+</p>
+<p></p>
+<p>
+Only the password call back class and the <tt>Crypto</tt> implementation
+(as defined in the crypto property file) must be able to handle all possible
+certificates, users, passwords, and keys that a security header may contain.
+The following deployment descriptor of a receiver shows this.
+</p>
+<div class="source">
+<pre>
+ <requestFlow>
+ <handler type="java:org.apache.ws.axis.security.WSDoAllReceiver">
+ <parameter name="passwordCallbackClass"
+ value="org.apache.ws.axis.oasis.PWCallback"/>
+ <parameter name="action" value="Signature Signature"/>
+ <parameter name="signaturePropFile" value="crypto.properties" />
+ </handler>
+ </requestFlow>
+</pre></div>
+The client uses two handlers in a chain, each signing a part of the SOAP
+request but with different certificates. Because the handlers do not
+specifiy a SOAP actor WSS4J puts both signatures in the security header
+of the default actor.
+To match the security actions the deployment descriptor of the receiver needs
+to contain the action declaration <tt>Signature Signature</tt>. This
+instructs the WSS4J handler to accept and verify two distinct signatures
+contained in one security header. Because the signatures use different
+certificates the <tt>Crypto</tt> implementation must be able to handle
+these certificates.
+
+<p></p>
+<p>
+Similar requirements are true for the password callback implementation if the
+sender uses handler chaining and uses different encryption parameters in the
+same security header.
+</p>
+<p></p>
+<p>
+If it is necessary to have different parameters for the distinct signature or
+decryption data then these should be put in different security headers. The
+easiest way to do this is to define different <tt>actor</tt> parameters
+for each handler in a WSS4J handler chain.
+
+</p></div></div>
+<div class="section">
+<h2><a name="Reporting_Security_results_to_services.2Fapplications"></a>Reporting Security results to services/applications</h2>
+<p>
+The WSS4J <tt>WSSecurityEngine</tt> processes the security elements inside
+a security header. If something goes wrong, for example a signature
+verfication fails, then the engine throws a fault. If the security engine
+could perform all operations sucessfully it returns a data structure
+that contains the results of the performed security actions. This data
+structure holds information about the performed action, the usernames or
+identifier in case the security engine performed signature or username token
+processing. Please refer to the
+{@link org.apache.ws.security.WSSecurityEngineResult result} structure.
+</p>
+<p></p>
+<p>
+The <tt>WSDoAllReceiver</tt> WSS4J handler takes this structure and
+checks if all required actions were performed. If this check fails, the
+WSS4J handler aborts the SOAP request and throws an Axis SOAP fault.
+Otherwise it creates its own data structure
+{@link org.apache.ws.axis.security.WSDoAllReceiverResult}, copies the
+security results in this structure, and adds the actor name of the
+security header. The it stores this new data structure in a vector and stores
+this vector in a specific
+{@link org.apache.ws.security.handler.WSHandlerConstants#RECV_RESULTS property}
+of the current message context. If WSS4J handlers are
+chained, then every handler in the chain adds its result to the vector. The
+vector contains the results in handler-chain order.
+</p>
+<p></p>
+<p>
+This code snippet shows how a Axis service can access the security result
+data:
+</p>
+<div class="source">
+<pre>
+ public void ping(javax.xml.rpc.holders.StringHolder text,
+ org.apache.ws.axis.oasis.ping.TicketType ticket)
+ throws java.rmi.RemoteException {
+
+ text.value = "Echo " + text.value.trim();
+
+ // get the message context first
+ MessageContext msgContext = MessageContext.getCurrentContext();
+ Message reqMsg = msgContext.getRequestMessage();
+
+ Vector results = null;
+ // get the result Vector from the property
+ if ((results =
+ (Vector) msgContext.getProperty(WSHandlerConstants.RECV_RESULTS))
+ == null) {
+ System.out.println("No security results!!");
+ }
+ System.out.println("Number of results: " + results.size());
+ for (int i = 0; i < results.size(); i++) {
+ WSHandlerResult hResult = (WSHandlerResult)results.get(i);
+ String actor = hResult.getActor();
+ Vector hResults = hResult.getResults();
+ for (int j = 0; j < hResults.size(); j++) {
+ WSSecurityEngineResult eResult = (WSSecurityEngineResult) hResults.get(j);
+ // Note: an encryption action does not have an associated principal
+ // only Signature and UsernameToken actions return a principal
+ if (eResult.getAction() != WSConstants.ENCR) {
+ System.out.println(eResult.getPrincipal().getName());
+ }
+ }
+ }
+ }
+</pre></div>
+The principal structure is either a
+{@link org.apache.ws.security.WSUsernameTokenPrincipal UsernameToken} principal
+or a {@link java.security.Principal X509Principal}. The
+princpals contain the names plus other information of the verified username
+token or signature certificate.
+
+</div>
+<div class="section">
+<h2><a name="Some_hints"></a>Some hints</h2>
+<div class="section">
+<h3><a name="Client"></a>Client</h3>
+<p>
+At the client side, the WSS4J Axis handler, as all other parts of Axis, run
+in the context of the calling application. Depending on the application,
+the callback classes may perform complex operations, even do some user
+interaction, to get the password or to access some database to get
+certificates or keys. There are no timeouts defined at the client side
+before the SOAP request is put on the wire.
+
+</p></div>
+<div class="section">
+<h3><a name="Server"></a>Server</h3>
+<p>
+On the server side the WSS4J handler run in the same context as the other part
+of the server, usually some servlet container, such as Tomcat. Also the server
+must be able to handle many requests in a short time. Thus the password
+callback as well as the <tt>Crypto</tt> implementation shall be
+as fast as possible. In general, no user interaction is possible at the
+server side to gather passwords. Also at this point of the SOAP request
+processing there are active timeouts, even if they are fairly long.
+
+</p></div>
+<div class="section">
+<h3><a name="Bi-directional_SOAP_Security"></a>Bi-directional SOAP Security</h3>
+<p>
+WSS4J fully supports bi-directional SOAP security. To enable bi-directional
+support just put <tt>WSDoAllSender</tt> on the
+<tt>responseFlow</tt> at the server and <tt>WSDoAllReceiver</tt>
+at the response flow of the client thus reversing the roles. Similar to
+the above hints, the server side part (now <tt>WSDoAllSender</tt>)
+runs in the server context and <tt>WSDoAllReceiver</tt>
+runs in the application (client) context. There are no Axis timeout
+constraints on the client side after Axis received the response
+and handed it over to the WSS4J handler.
+
+</p></div>
+<div class="section">
+<h3><a name="Handler_chaining"></a>Handler chaining</h3>
+<p>
+Usually WSS4J handlers are chained without any other handler between them in
+the chain. It is, however, possible to do so. In this case the intermediate
+handler <b>must not</b> modify the SOAP Envelope that is contained in the
+Axis message. This could (most probably will) invalidate or destroy any
+security actions done sofar. Such an intermediate handler may set some
+properties that may influence the processing of the following WSS4J handler,
+such as setting a new username, password callback class, and so on.
+
+
+@since WSS4J 1.0</p></div>
+</div>
+
+
+ </div>
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ <div id="footer">
+ <div class="xright">
+ Apache WSS4J, WSS4J, Apache, the Apache feather logo are trademarks of The Apache Software Foundation.
+ All other marks mentioned may be trademarks or registered trademarks of their respective owners.
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ </body>
+</html>
Added: webservices/website/wss4j/advisories/project-info.html
URL: http://svn.apache.org/viewvc/webservices/website/wss4j/advisories/project-info.html?rev=1894972&view=auto
==============================================================================
--- webservices/website/wss4j/advisories/project-info.html (added)
+++ webservices/website/wss4j/advisories/project-info.html Fri Nov 12 10:03:53 2021
@@ -0,0 +1,125 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<!-- Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2021-11-12 -->
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+ <head>
+ <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+ <title>Apache WSS4J – Project Information</title>
+ <style type="text/css" media="all">
+ @import url("./css/maven-base.css");
+ @import url("./css/maven-theme.css");
+ @import url("./css/site.css");
+ </style>
+ <link rel="stylesheet" href="./css/print.css" type="text/css" media="print" />
+ <meta http-equiv="Content-Language" content="en" />
+
+ </head>
+ <body class="composite">
+ <div id="banner">
+ <a href="http://ws.apache.org/wss4j" id="bannerLeft">
+ Apache WSS4Jâ¢
+ </a>
+ <a href="http://www.apache.org" id="bannerRight">
+ <img src="http://activemq.apache.org/images/asf-logo.png" alt="$alt" />
+ </a>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ <div id="breadcrumbs">
+
+ <div class="xleft">
+ <span id="publishDate">Last Published: 2021-11-12</span>
+ | <span id="projectVersion">Version: 2.5.0-SNAPSHOT</span>
+ </div>
+ <div class="xright">
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ <div id="leftColumn">
+ <div id="navcolumn">
+
+ <h5>Apache WSS4J</h5>
+ <ul>
+ <li class="none">
+ <a href="index.html" title="Home">Home</a>
+ </li>
+ <li class="none">
+ <a href="download.html" title="Download">Download</a>
+ </li>
+ <li class="none">
+ <a href="user_guide.html" title="User Guide">User Guide</a>
+ </li>
+ <li class="none">
+ <a href="security_advisories.html" title="Security Advisories">Security Advisories</a>
+ </li>
+ </ul>
+ <h5>Project Documentation</h5>
+ <ul>
+ <li class="expanded">
+ <strong>Project Information</strong>
+ <ul>
+ <li class="none">
+ <a href="issue-tracking.html" title="Issue Management">Issue Management</a>
+ </li>
+ <li class="none">
+ <a href="license.html" title="Licenses">Licenses</a>
+ </li>
+ <li class="none">
+ <a href="mail-lists.html" title="Mailing Lists">Mailing Lists</a>
+ </li>
+ <li class="none">
+ <a href="source-repository.html" title="Source Code Management">Source Code Management</a>
+ </li>
+ </ul>
+ </li>
+ <li class="collapsed">
+ <a href="project-reports.html" title="Project Reports">Project Reports</a>
+ </li>
+ </ul>
+ <a href="http://maven.apache.org/" title="Built by Maven" class="poweredBy">
+ <img class="poweredBy" alt="Built by Maven" src="./images/logos/maven-feather.png" />
+ </a>
+
+ </div>
+ </div>
+ <div id="bodyColumn">
+ <div id="contentBox">
+ <div class="section">
+<h2><a name="Project_Information"></a>Project Information</h2>
+<p>This document provides an overview of the various documents and links that are part of this project's general information. All of this content is automatically generated by <a class="externalLink" href="http://maven.apache.org">Maven</a> on behalf of the project.</p>
+<div class="section">
+<h3><a name="Overview"></a>Overview</h3>
+<table border="0" class="bodyTable">
+<tr class="a">
+<th>Document</th>
+<th>Description</th></tr>
+<tr class="b">
+<td><a href="issue-tracking.html">Issue Management</a></td>
+<td>This document provides information on the issue management system used in this project.</td></tr>
+<tr class="a">
+<td><a href="license.html">Licenses</a></td>
+<td>This document lists the project license(s).</td></tr>
+<tr class="b">
+<td><a href="mail-lists.html">Mailing Lists</a></td>
+<td>This document provides subscription and archive information for this project's mailing lists.</td></tr>
+<tr class="a">
+<td><a href="source-repository.html">Source Code Management</a></td>
+<td>This document lists ways to access the online source repository.</td></tr></table></div></div>
+ </div>
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ <div id="footer">
+ <div class="xright">
+ Apache WSS4J, WSS4J, Apache, the Apache feather logo are trademarks of The Apache Software Foundation.
+ All other marks mentioned may be trademarks or registered trademarks of their respective owners.
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ </body>
+</html>
Added: webservices/website/wss4j/advisories/project-reports.html
URL: http://svn.apache.org/viewvc/webservices/website/wss4j/advisories/project-reports.html?rev=1894972&view=auto
==============================================================================
--- webservices/website/wss4j/advisories/project-reports.html (added)
+++ webservices/website/wss4j/advisories/project-reports.html Fri Nov 12 10:03:53 2021
@@ -0,0 +1,131 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<!-- Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2021-11-12 -->
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+ <head>
+ <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+ <title>Apache WSS4J – Generated Reports</title>
+ <style type="text/css" media="all">
+ @import url("./css/maven-base.css");
+ @import url("./css/maven-theme.css");
+ @import url("./css/site.css");
+ </style>
+ <link rel="stylesheet" href="./css/print.css" type="text/css" media="print" />
+ <meta http-equiv="Content-Language" content="en" />
+
+ </head>
+ <body class="composite">
+ <div id="banner">
+ <a href="http://ws.apache.org/wss4j" id="bannerLeft">
+ Apache WSS4Jâ¢
+ </a>
+ <a href="http://www.apache.org" id="bannerRight">
+ <img src="http://activemq.apache.org/images/asf-logo.png" alt="$alt" />
+ </a>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ <div id="breadcrumbs">
+
+ <div class="xleft">
+ <span id="publishDate">Last Published: 2021-11-12</span>
+ | <span id="projectVersion">Version: 2.5.0-SNAPSHOT</span>
+ </div>
+ <div class="xright">
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ <div id="leftColumn">
+ <div id="navcolumn">
+
+ <h5>Apache WSS4J</h5>
+ <ul>
+ <li class="none">
+ <a href="index.html" title="Home">Home</a>
+ </li>
+ <li class="none">
+ <a href="download.html" title="Download">Download</a>
+ </li>
+ <li class="none">
+ <a href="user_guide.html" title="User Guide">User Guide</a>
+ </li>
+ <li class="none">
+ <a href="security_advisories.html" title="Security Advisories">Security Advisories</a>
+ </li>
+ </ul>
+ <h5>Project Documentation</h5>
+ <ul>
+ <li class="collapsed">
+ <a href="project-info.html" title="Project Information">Project Information</a>
+ </li>
+ <li class="expanded">
+ <strong>Project Reports</strong>
+ <ul>
+ <li class="none">
+ <a href="apidocs/index.html" title="Javadoc">Javadoc</a>
+ </li>
+ <li class="none">
+ <a href="testapidocs/index.html" title="Test Javadoc">Test Javadoc</a>
+ </li>
+ <li class="none">
+ <a href="xref/index.html" title="Source Xref">Source Xref</a>
+ </li>
+ <li class="none">
+ <a href="xref-test/index.html" title="Test Source Xref">Test Source Xref</a>
+ </li>
+ <li class="none">
+ <a href="dependency-check-report.html" title="dependency-check">dependency-check</a>
+ </li>
+ </ul>
+ </li>
+ </ul>
+ <a href="http://maven.apache.org/" title="Built by Maven" class="poweredBy">
+ <img class="poweredBy" alt="Built by Maven" src="./images/logos/maven-feather.png" />
+ </a>
+
+ </div>
+ </div>
+ <div id="bodyColumn">
+ <div id="contentBox">
+ <div class="section">
+<h2><a name="Generated_Reports"></a>Generated Reports</h2>
+<p>This document provides an overview of the various reports that are automatically generated by <a class="externalLink" href="http://maven.apache.org">Maven</a> . Each report is briefly described below.</p>
+<div class="section">
+<h3><a name="Overview"></a>Overview</h3>
+<table border="0" class="bodyTable">
+<tr class="a">
+<th>Document</th>
+<th>Description</th></tr>
+<tr class="b">
+<td><a href="apidocs/index.html">Javadoc</a></td>
+<td>Javadoc API documentation.</td></tr>
+<tr class="a">
+<td><a href="testapidocs/index.html">Test Javadoc</a></td>
+<td>Test Javadoc API documentation.</td></tr>
+<tr class="b">
+<td><a href="xref/index.html">Source Xref</a></td>
+<td>HTML based, cross-reference version of Java source code.</td></tr>
+<tr class="a">
+<td><a href="xref-test/index.html">Test Source Xref</a></td>
+<td>HTML based, cross-reference version of Java test source code.</td></tr>
+<tr class="b">
+<td><a href="dependency-check-report.html">dependency-check</a></td>
+<td>Generates a report providing details on any published vulnerabilities within project dependencies. This report is a best effort and may contain false positives and false negatives.</td></tr></table></div></div>
+ </div>
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ <div id="footer">
+ <div class="xright">
+ Apache WSS4J, WSS4J, Apache, the Apache feather logo are trademarks of The Apache Software Foundation.
+ All other marks mentioned may be trademarks or registered trademarks of their respective owners.
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ </body>
+</html>
Added: webservices/website/wss4j/advisories/resources.html
URL: http://svn.apache.org/viewvc/webservices/website/wss4j/advisories/resources.html?rev=1894972&view=auto
==============================================================================
--- webservices/website/wss4j/advisories/resources.html (added)
+++ webservices/website/wss4j/advisories/resources.html Fri Nov 12 10:03:53 2021
@@ -0,0 +1,149 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<!-- Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2021-11-12 -->
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+ <head>
+ <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+ <title>Apache WSS4J – </title>
+ <style type="text/css" media="all">
+ @import url("./css/maven-base.css");
+ @import url("./css/maven-theme.css");
+ @import url("./css/site.css");
+ </style>
+ <link rel="stylesheet" href="./css/print.css" type="text/css" media="print" />
+ <meta http-equiv="Content-Language" content="en" />
+
+ </head>
+ <body class="composite">
+ <div id="banner">
+ <a href="http://ws.apache.org/wss4j" id="bannerLeft">
+ Apache WSS4Jâ¢
+ </a>
+ <a href="http://www.apache.org" id="bannerRight">
+ <img src="http://activemq.apache.org/images/asf-logo.png" alt="$alt" />
+ </a>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ <div id="breadcrumbs">
+
+ <div class="xleft">
+ <span id="publishDate">Last Published: 2021-11-12</span>
+ | <span id="projectVersion">Version: 2.5.0-SNAPSHOT</span>
+ </div>
+ <div class="xright">
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ <div id="leftColumn">
+ <div id="navcolumn">
+
+ <h5>Apache WSS4J</h5>
+ <ul>
+ <li class="none">
+ <a href="index.html" title="Home">Home</a>
+ </li>
+ <li class="none">
+ <a href="download.html" title="Download">Download</a>
+ </li>
+ <li class="none">
+ <a href="user_guide.html" title="User Guide">User Guide</a>
+ </li>
+ <li class="none">
+ <a href="security_advisories.html" title="Security Advisories">Security Advisories</a>
+ </li>
+ </ul>
+ <h5>Project Documentation</h5>
+ <ul>
+ <li class="collapsed">
+ <a href="project-info.html" title="Project Information">Project Information</a>
+ </li>
+ <li class="collapsed">
+ <a href="project-reports.html" title="Project Reports">Project Reports</a>
+ </li>
+ </ul>
+ <a href="http://maven.apache.org/" title="Built by Maven" class="poweredBy">
+ <img class="poweredBy" alt="Built by Maven" src="./images/logos/maven-feather.png" />
+ </a>
+
+ </div>
+ </div>
+ <div id="bodyColumn">
+ <div id="contentBox">
+ <div class="sect1">
+<h2 id="further_resources">Further Resources</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>This section lists some further resources that describe how to use WSS4J in more
+detail.</p>
+</div>
+<div class="sect2">
+<h3 id="wss4j_2_0_0_articles">WSS4J 2.0.0 articles</h3>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="http://coheigea.blogspot.ie/2014/01/apache-wss4j-200-part-i.html">WSS4J 2.0.0 overview</a></p>
+</li>
+</ul>
+</div>
+</div>
+<div class="sect2">
+<h3 id="wss4j_1_6_x_articles">WSS4J 1.6.x articles</h3>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="http://coheigea.blogspot.ie/2011/01/wss4j-16-crypto-property-change.html">Crypto property changes in WSS4J 1.6.x</a></p>
+</li>
+<li>
+<p><a href="http://coheigea.blogspot.ie/2011/02/support-for-saml2-assertions-in-wss4j.html">Support for SAML 2.0 in WSS4J 1.6.x</a></p>
+</li>
+<li>
+<p><a href="http://coheigea.blogspot.ie/2011/02/usernametoken-processing-changes-in.html">UsernameToken processing changes in WSS4J 1.6.x</a></p>
+</li>
+<li>
+<p><a href="http://coheigea.blogspot.ie/2011/02/wspasswordcallback-changes-in-wss4j-16.html">WSPasswordCallback changes in WSS4J 1.6.x</a></p>
+</li>
+<li>
+<p><a href="http://coheigea.blogspot.ie/2011/02/wss4j-16-specifying-elements-to-sign-or.html">Specifying elements to sign or encrypt</a></p>
+</li>
+<li>
+<p><a href="http://coheigea.blogspot.ie/2011/03/wss4j-16-basic-security-profile-11.html">Basic Security Profile 1.1 compliance</a></p>
+</li>
+<li>
+<p><a href="http://coheigea.blogspot.ie/2011/03/wss4j-16-saml-property-changes.html">SAML property changes</a></p>
+</li>
+<li>
+<p><a href="http://coheigea.blogspot.ie/2011/04/wss4j-16-introducing-validators.html">WSS4J Validators</a></p>
+</li>
+<li>
+<p><a href="http://coheigea.blogspot.ie/2011/05/crl-support-in-wss4j-161.html">CRL support in WSS4J 1.6.1</a></p>
+</li>
+<li>
+<p><a href="http://coheigea.blogspot.ie/2011/08/saml-token-creation-in-apache-wss4j-16.html">Creating SAML Tokens</a></p>
+</li>
+<li>
+<p><a href="http://coheigea.blogspot.ie/2013/03/signature-and-encryption-key.html">Signature and Encryption Key Identifiers in Apache WSS4J</a></p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+</div>
+ </div>
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ <div id="footer">
+ <div class="xright">
+ Apache WSS4J, WSS4J, Apache, the Apache feather logo are trademarks of The Apache Software Foundation.
+ All other marks mentioned may be trademarks or registered trademarks of their respective owners.
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ </body>
+</html>
Added: webservices/website/wss4j/advisories/security_advisories.html
URL: http://svn.apache.org/viewvc/webservices/website/wss4j/advisories/security_advisories.html?rev=1894972&view=auto
==============================================================================
--- webservices/website/wss4j/advisories/security_advisories.html (added)
+++ webservices/website/wss4j/advisories/security_advisories.html Fri Nov 12 10:03:53 2021
@@ -0,0 +1,139 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<!-- Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2021-11-12 -->
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+ <head>
+ <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+ <title>Apache WSS4J – </title>
+ <style type="text/css" media="all">
+ @import url("./css/maven-base.css");
+ @import url("./css/maven-theme.css");
+ @import url("./css/site.css");
+ </style>
+ <link rel="stylesheet" href="./css/print.css" type="text/css" media="print" />
+ <meta http-equiv="Content-Language" content="en" />
+
+ </head>
+ <body class="composite">
+ <div id="banner">
+ <a href="http://ws.apache.org/wss4j" id="bannerLeft">
+ Apache WSS4Jâ¢
+ </a>
+ <a href="http://www.apache.org" id="bannerRight">
+ <img src="http://activemq.apache.org/images/asf-logo.png" alt="$alt" />
+ </a>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ <div id="breadcrumbs">
+
+ <div class="xleft">
+ <span id="publishDate">Last Published: 2021-11-12</span>
+ | <span id="projectVersion">Version: 2.5.0-SNAPSHOT</span>
+ </div>
+ <div class="xright">
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ <div id="leftColumn">
+ <div id="navcolumn">
+
+ <h5>Apache WSS4J</h5>
+ <ul>
+ <li class="none">
+ <a href="index.html" title="Home">Home</a>
+ </li>
+ <li class="none">
+ <a href="download.html" title="Download">Download</a>
+ </li>
+ <li class="none">
+ <a href="user_guide.html" title="User Guide">User Guide</a>
+ </li>
+ <li class="none">
+ <strong>Security Advisories</strong>
+ </li>
+ </ul>
+ <h5>Project Documentation</h5>
+ <ul>
+ <li class="collapsed">
+ <a href="project-info.html" title="Project Information">Project Information</a>
+ </li>
+ <li class="collapsed">
+ <a href="project-reports.html" title="Project Reports">Project Reports</a>
+ </li>
+ </ul>
+ <a href="http://maven.apache.org/" title="Built by Maven" class="poweredBy">
+ <img class="poweredBy" alt="Built by Maven" src="./images/logos/maven-feather.png" />
+ </a>
+
+ </div>
+ </div>
+ <div id="bodyColumn">
+ <div id="contentBox">
+
+
+<div class="section">
+<h2><a name="Security_Advisories"></a>Security Advisories</h2>
+
+<p>
+The following security advisories have been issued for Apache WSS4J™:
+</p>
+<ul>
+
+<li><b>2015</b></li>
+
+<ul>
+
+<li><a href="advisories/CVE-2015-0226.txt.asc">CVE-2015-0226</a> - Apache
+WSS4J is (still) vulnerable to Bleichenbacher's attack.</li>
+
+<li><a href="advisories/CVE-2015-0227.txt.asc">CVE-2015-0227</a> - Apache
+WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements
+property</li>
+</ul>
+</ul>
+
+
+<p>
+As Apache WSS4J is a library that provides WS-Security functionality to web
+service stacks such as Apache CXF and Apache Axis, security issues associated
+with WS-Security tend to be reported to these downstream projects. Therefore
+the best way to keep an eye on security issues involving WSS4J is to look at
+the security advisories pages of these projects.
+</p>
+
+<p>
+The security advisory page for Apache CXF is <a class="externalLink" href="http://cxf.apache.org/security-advisories.html">here</a>. In particular, the following security
+advisories are relevant to users of WSS4J:
+</p>
+
+<ul>
+
+<li><a class="externalLink" href="http://cxf.apache.org/cve-2012-5575.html">Note on CVE-2012-5575</a> - XML Encryption backwards compatibility attack on Apache CXF.</li>
+
+<li><a class="externalLink" href="http://cxf.apache.org/note-on-cve-2011-2487.html">Note on CVE-2011-2487</a> - Bleichenbacher attack against distributed symmetric key in WS-Security.</li>
+
+<li><a class="externalLink" href="http://cxf.apache.org/note-on-cve-2011-1096.html">Note on CVE-2011-1096</a> - XML Encryption flaw / Character pattern encoding attack.</li>
+</ul>
+
+</div>
+
+
+ </div>
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ <div id="footer">
+ <div class="xright">
+ Apache WSS4J, WSS4J, Apache, the Apache feather logo are trademarks of The Apache Software Foundation.
+ All other marks mentioned may be trademarks or registered trademarks of their respective owners.
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ </body>
+</html>
Added: webservices/website/wss4j/advisories/source-repository.html
URL: http://svn.apache.org/viewvc/webservices/website/wss4j/advisories/source-repository.html?rev=1894972&view=auto
==============================================================================
--- webservices/website/wss4j/advisories/source-repository.html (added)
+++ webservices/website/wss4j/advisories/source-repository.html Fri Nov 12 10:03:53 2021
@@ -0,0 +1,125 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<!-- Generated by Apache Maven Doxia Site Renderer 1.7.4 at 2021-11-12 -->
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+ <head>
+ <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+ <title>Apache WSS4J – Source Code Management</title>
+ <style type="text/css" media="all">
+ @import url("./css/maven-base.css");
+ @import url("./css/maven-theme.css");
+ @import url("./css/site.css");
+ </style>
+ <link rel="stylesheet" href="./css/print.css" type="text/css" media="print" />
+ <meta http-equiv="Content-Language" content="en" />
+
+ </head>
+ <body class="composite">
+ <div id="banner">
+ <a href="http://ws.apache.org/wss4j" id="bannerLeft">
+ Apache WSS4Jâ¢
+ </a>
+ <a href="http://www.apache.org" id="bannerRight">
+ <img src="http://activemq.apache.org/images/asf-logo.png" alt="$alt" />
+ </a>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ <div id="breadcrumbs">
+
+ <div class="xleft">
+ <span id="publishDate">Last Published: 2021-11-12</span>
+ | <span id="projectVersion">Version: 2.5.0-SNAPSHOT</span>
+ </div>
+ <div class="xright">
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ <div id="leftColumn">
+ <div id="navcolumn">
+
+ <h5>Apache WSS4J</h5>
+ <ul>
+ <li class="none">
+ <a href="index.html" title="Home">Home</a>
+ </li>
+ <li class="none">
+ <a href="download.html" title="Download">Download</a>
+ </li>
+ <li class="none">
+ <a href="user_guide.html" title="User Guide">User Guide</a>
+ </li>
+ <li class="none">
+ <a href="security_advisories.html" title="Security Advisories">Security Advisories</a>
+ </li>
+ </ul>
+ <h5>Project Documentation</h5>
+ <ul>
+ <li class="expanded">
+ <a href="project-info.html" title="Project Information">Project Information</a>
+ <ul>
+ <li class="none">
+ <a href="issue-tracking.html" title="Issue Management">Issue Management</a>
+ </li>
+ <li class="none">
+ <a href="license.html" title="Licenses">Licenses</a>
+ </li>
+ <li class="none">
+ <a href="mail-lists.html" title="Mailing Lists">Mailing Lists</a>
+ </li>
+ <li class="none">
+ <strong>Source Code Management</strong>
+ </li>
+ </ul>
+ </li>
+ <li class="collapsed">
+ <a href="project-reports.html" title="Project Reports">Project Reports</a>
+ </li>
+ </ul>
+ <a href="http://maven.apache.org/" title="Built by Maven" class="poweredBy">
+ <img class="poweredBy" alt="Built by Maven" src="./images/logos/maven-feather.png" />
+ </a>
+
+ </div>
+ </div>
+ <div id="bodyColumn">
+ <div id="contentBox">
+ <div class="section">
+<h2><a name="Overview"></a>Overview</h2><a name="Overview"></a>
+<p>This project uses <a class="externalLink" href="http://git-scm.com/">Git</a> to manage its source code. Instructions on Git use can be found at <a class="externalLink" href="http://git-scm.com/documentation">http://git-scm.com/documentation</a>.</p></div>
+<div class="section">
+<h2><a name="Web_Browser_Access"></a>Web Browser Access</h2><a name="Web_Browser_Access"></a>
+<p>The following is a link to a browsable version of the source repository:</p>
+<div class="source">
+<pre><a class="externalLink" href="https://gitbox.apache.org/repos/asf?p=ws-wss4j.git;a=summary">https://gitbox.apache.org/repos/asf?p=ws-wss4j.git;a=summary</a></pre></div></div>
+<div class="section">
+<h2><a name="Anonymous_Access"></a>Anonymous Access</h2><a name="Anonymous_Access"></a>
+<p>The source can be checked out anonymously from Git with this command (See <a class="externalLink" href="http://git-scm.com/docs/git-clone">http://git-scm.com/docs/git-clone</a>):</p>
+<div class="source">
+<pre>$ git clone https://gitbox.apache.org/repos/asf/ws-wss4j.git</pre></div></div>
+<div class="section">
+<h2><a name="Developer_Access"></a>Developer Access</h2><a name="Developer_Access"></a>
+<p>Only project developers can access the Git tree via this method (See <a class="externalLink" href="http://git-scm.com/docs/git-clone">http://git-scm.com/docs/git-clone</a>).</p>
+<div class="source">
+<pre>$ git clone https://gitbox.apache.org/repos/asf/ws-wss4j.git</pre></div></div>
+<div class="section">
+<h2><a name="Access_from_Behind_a_Firewall"></a>Access from Behind a Firewall</h2><a name="Access_from_Behind_a_Firewall"></a>
+<p>Refer to the documentation of the SCM used for more information about access behind a firewall.</p></div>
+ </div>
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ <div id="footer">
+ <div class="xright">
+ Apache WSS4J, WSS4J, Apache, the Apache feather logo are trademarks of The Apache Software Foundation.
+ All other marks mentioned may be trademarks or registered trademarks of their respective owners.
+ </div>
+ <div class="clear">
+ <hr/>
+ </div>
+ </div>
+ </body>
+</html>