RE: Do you plan to port WSS4J to J2SE 1.3 (X509 certificate exten sion problem - resolved)

[Marcin Cinik <Ma...@pbpolsoft.com.pl>]

I think I've resolved the problem. The problem was that You use sun.*
classes in the code.
Read this e-mail step by step, please, and You will discover what was the
problem and how it can be resolved. It's a portability issue. Read it
please, because it shows that WSS4J doesn't compile with SUN JDK1.3 (but for
me this is not a problem anymore).

First,
I've been trying to compile with diffrent JDK's and:

List of packages which don't compile with Sun JDK1.3 or IBM WebSphere 5.0
JRE Express
Grouped by cause

not resolved classes:
	javax.security.auth.callback.CallbackHandler
	javax.security.auth.callback.Callback
	javax.security.auth.callback.UnsupportedCallbackException

org.apache.ws.axis.security.WsDoAllReceiver
org.apache.ws.axis.security.WsDoAllSender
org.apache.ws.axis.security.trust.secconv.interop.PWCallBackHandler
org.apache.ws.security.WSPasswordCallback
org.apache.ws.security.WSSecurityEngine
org.apache.ws.security.conversation.ConversationEngine
org.apache.ws.security.conversation.ConversationManager
org.apache.ws.security.conversation.DerivedKeyCallbackHandler
org.apache.ws.security.conversation.message.token.RequestedProofToken
org.apache.ws.security.handler.WSS4JHandler



not resolved classes:
	java.security.cert.CertPath
	java.security.cert.CertPathValidator
	java.security.cert.CertPathValidatorException

org.apache.ws.security.components.crypto.Merlin



not resolved classes: 
	java.net.URI
	java.net.URISyntaxException
	java.net.URISyntaxException

org.apache.ws.security.trust2.RequestSecurityToken  
org.apache.ws.security.trust2.SecurityTokenMessage  
org.apache.ws.security.trust2.TokenTypes
org.apache.ws.security.trust2.TrustConstants
org.apache.ws.security.trust2.WSAddTokenRequest
org.apache.ws.security.trust2.serialization.TestSerialization 



cause: method not visible:
org.apache.ws.security.trust.message.token.LifeTime.getTimeInMillis
org.apache.ws.security.trust.message.token.LifeTime.setTimeInMillis



Those problems dissapear when I use IBM WebSphere 5.1 JRE. Then I have just
two other problems:

class: org.apache.ws.axis.security.trust.secconv.interop.SAML2SCTRequester
problem: sun.security.x509.KeyIdentifier not resolved

class:
org.apache.ws.axis.security.trust.secconv.interop.InteropSAMLIssuerImpl
problem: sun.security.util.DerValue not resolved

Using Sun 1.4.2 JDK there are no compilation errors!

XML Security library:
- SUN JDK1.4.2 OK
- SUN JDK1.3.0.02 many errors
- IBM WebSphere 5.1 JRE - sun.security.util.DerValue,
sun.security.x509.X500Name not resolved , 
  but when I added 

So now I've switched to IBM WebSphere 5.1 JRE (I can't use SUN's
implementation).

I've been reading source code of
org.apache.ws.axis.security.trust.secconv.interop.InteropSAMLIssuerImpl. I
found that author uses SUN's classes in the code.
Then I found something interesting:
http://java.sun.com/products/jdk/faq/faq-sun-packages.html

"The sun.* packages are not part of the supported, public interface.
A Java program that directly calls into sun.* packages is not guaranteed to
work on all Java-compatible platforms. In fact, such a program is not
guaranteed to work even in future versions on the same platform. "

Now I know that I can't compile wss4j because I'm using IBM WebSphere 5.1
JRE, where there is no SUN's implementation. And You (Ruchith who borrowed
not portable code from Merlin)use sun.* classes in the code.

I started to resolve the problem and:

- DER is encoding for X.509 certificates
- go to
http://java.sun.com/j2se/1.4.2/docs/api/java/security/cert/X509Certificate.h
tml please, and look for 2.5.29.14 in the text. This is
"SubjectKeyIdentifier". 

Ruchith made a comment in the code: "data =
cert.getExtensionValue("2.5.29.14");//Not sure what this is !!!!" at
InteropSAMLIssuerImpl:487. 
Answer is: this is an extension to X.509 which provides You a possibility to
put Identifier of subject's key into certificates (am I wrong ? ? ?). 

Now I'm going to check if it is possible to use extensions with IBM
WebSphere JDK 5.1 and if it is possible to make my own implementation of
java.security.cert.X509Extension . If I make it, then I will give you piece
of code to commit (if it is needed - maybe there is another solution).



-----Original Message-----
From: Werner.Dittmann@t-online.de [mailto:Werner.Dittmann@t-online.de]
Sent: Monday, December 27, 2004 1:13 PM
To: Marcin Cinik
Cc: 'fx-dev@ws.apache.org'
Subject: Re: Do you plan to port WSS4J to J2SE 1.3 ?


Marcin,

IMHO it is possible to compile WSS4J with J2SE 1.3.x, at least we had done
some tests some time ago and also modified some 1.4 specific things to
be compliant with 1.3.x.

If you find an non 1.3 class/method cna you pls report it. Thanks.
(I have no 1.3.x on my development system anymore).

I'm not sure if this is true for the supporting libraries such as xmlsec

regards,
Werner

Marcin Cinik schrieb:

>Do you have plans to port WSS4J to J2SE 1.3 ? Many application servers (IBM
>WebSphere) still use JDK version 1.3. 
>Is there any possibility to use WSS4J with J2SE 1.3 ? I don't need xml
>encryption. Only signing and digital signature verification.
>
>Marcin Cinik
>
>
>  
>