You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by sram <sr...@hotmail.com> on 2012/02/11 21:59:00 UTC
Signing Message parts
I'm testing out a usecase combining DoubleIT_TransportEndorsingPolicy and
#DoubleItBinding_DoubleIt_Input_Policy.
<sp:TransportBinding>
<wsp:Policy>
<sp:TransportToken>
<wsp:Policy>
<sp:HttpsToken RequireClientCertificate="false" />
</wsp:Policy>
</sp:TransportToken>
<sp:Layout>
<wsp:Policy>
<sp:Lax />
</wsp:Policy>
</sp:Layout>
*<sp:IncludeTimestamp />
<sp:OnlySignEntireHeadersAndBody /> *
<sp:AlgorithmSuite>
<wsp:Policy>
<sp:Basic128 />
</wsp:Policy>
</sp:AlgorithmSuite>
</wsp:Policy>
</sp:TransportBinding>
<wsp:Policy wsu:Id="DoubleItBinding_DoubleIt_Input_Policy">
<wsp:ExactlyOne>
<wsp:All>
<sp:SignedParts>
*<sp:Body />*
</sp:SignedParts>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
On the client I generate signatures using WSS4j,
wss4jOut.setProperty(WSHandlerConstants.ACTION,
WSHandlerConstants.TIMESTAMP + " "
+ WSHandlerConstants.USERNAME_TOKEN + " " +
WSHandlerConstants.SIGNATURE);
wss4jOut.setProperty(WSHandlerConstants.SIGNATURE_PARTS,
"{Element}{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Timestamp;");
All works fine, even if client signs only the timestamp part and not any
message body part. Even though I add DoubleItBinding_DoubleIt_Input_Policy
reference to my SOAP message input part, I suspect the server is only
checking for timestamp.
>>>>>>> WSDL
<binding name="pingBinding" type="p0:pingPortType">
<wsp:PolicyReference URI="#DoubleIT_TransportEndorsingPolicy" />
<soap:binding transport="http://schemas.xmlsoap.org/soap/http"
style="document" />
<operation name="ping">
<soap:operation soapAction="" />
<input>
<soap:body use="literal" />
<wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy" />
</input>
<output>
<soap:body use="literal" />
...
I wanted client to sign message parts which can be authenticated on the
server side using clients X.509 token, flowing in as part of TLS binding as
an endorsing supporting token.
>>>>>>>>> Logs
[2/11/12 15:44:04:747 EST] 0000004e SignatureProc 1
org.apache.ws.security.processor.SignatureProcessor handleToken Found
signature element
[2/11/12 15:44:04:747 EST] 0000004e SignatureTrus 1
org.apache.ws.security.validate.SignatureTrustValidator verifyTrustInCert
Transmitted certificate has subject
CN=L151ATS033040.ams.mycomp.net,O=Harvard,C=US
[2/11/12 15:44:04:747 EST] 0000004e SignatureTrus 1
org.apache.ws.security.validate.SignatureTrustValidator verifyTrustInCert
Transmitted certificate has issuer
CN=L151ATS033040.ams.mycomp.net,O=Harvard,C=US (serial 1328709293)
[2/11/12 15:44:04:747 EST] 0000004e SignatureTrus 1
org.apache.ws.security.validate.SignatureTrustValidator
isCertificateInKeyStore Direct trust for certificate with
CN=L151ATS033040.ams.mycomp.net,O=Harvard,C=US
[2/11/12 15:44:04:747 EST] 0000004e SignatureProc 1
org.apache.ws.security.processor.SignatureProcessor verifyXMLSignature
Verify XML Signature
[2/11/12 15:44:04:747 EST] 0000004e UsernameToken 1
org.apache.ws.security.processor.UsernameTokenProcessor handleToken Found
UsernameToken list element
[2/11/12 15:44:04:747 EST] 0000004e UsernameToken 1
org.apache.ws.security.validate.UsernameTokenValidator validate
UsernameToken user stanforduser
[2/11/12 15:44:04:747 EST] 0000004e UsernameToken 1
org.apache.ws.security.validate.UsernameTokenValidator validate
UsernameToken password type
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText
[2/11/12 15:44:04:747 EST] 0000004e SystemOut O stanforduser :
workbench
[2/11/12 15:44:04:747 EST] 0000004e TimestampProc 1
org.apache.ws.security.processor.TimestampProcessor handleToken Found
Timestamp list element
[2/11/12 15:44:04:747 EST] 0000004e Timestamp 1
org.apache.ws.security.message.token.Timestamp <init> Current time:
2012-02-11T20:44:04.747Z
[2/11/12 15:44:04:747 EST] 0000004e Timestamp 1
org.apache.ws.security.message.token.Timestamp <init> Timestamp created:
2012-02-11T20:44:04.310Z
[2/11/12 15:44:04:747 EST] 0000004e Timestamp 1
org.apache.ws.security.message.token.Timestamp <init> Timestamp expires:
2012-02-11T20:49:04.310Z
[2/11/12 15:44:04:747 EST] 0000004e Timestamp 1
org.apache.ws.security.message.token.Timestamp verifyCreated Validation of
Timestamp: Everything is ok
[2/11/12 15:44:04:747 EST] 0000004e PingPortTypeI I Executing operation
ping
[2/11/12 15:44:04:747 EST] 0000004e SystemOut O System.getProperty
user.name
--
View this message in context: http://cxf.547215.n5.nabble.com/Signing-Message-parts-tp5475654p5475654.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Signing Message parts
Posted by Colm O hEigeartaigh <co...@apache.org>.
> Not following here. I removed <sp:OnlySignEntireHeadersAndBody />
> section under TLS security binding, retained
> <DoubleItBinding_DoubleIt_Input_Policy> body part singing in my policy; but
> did not sign the body part (only signs timestamp). I expect server to
> complain since I did not sign body using clients X.509, and it does not.
So you have a SignedParts policy as a child of the
EndorsingSupportingTokens policy? The validation code does not
currently enforce SignedParts or EncryptedParts for
EndorsingSupportingTokens (feel free to raise a JIRA if you want). In
other words, it will check to see if the required part has been
signed, but not specifically by that EndorsingSupportingToken. In this
case, the “message signature” is provided by the underlying transport
protocol.
Colm.
On Mon, Feb 13, 2012 at 2:31 PM, sram <sr...@hotmail.com> wrote:
> "If you want to sign the SOAP Body, you'll have to add it to the
> SignatureParts list..."
>
> Agreed. But even without signing it works though server policy indicates
> signing is required. I was thinking body part signing will be expected from
> server using X.509 under <EndorsedSupportingToken> section.
>
> "you are using TLS and this fulfills the message signing requirements.."
>
> Not following here. I removed <sp:OnlySignEntireHeadersAndBody />
> section under TLS security binding, retained
> <DoubleItBinding_DoubleIt_Input_Policy> body part singing in my policy; but
> did not sign the body part (only signs timestamp). I expect server to
> complain since I did not sign body using clients X.509, and it does not.
>
>
>
>>>>>>>>>>
>
> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
> <soap:Header>
> <wsse:Security soap:mustUnderstand="1"
> xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
> xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
> <wsse:BinarySecurityToken
> EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
> ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
> wsu:Id="X509-D94D656F6D5F405EE113291420330101">MIICCTCCAXKgAwIBAgIETzJ+rTANBgkqhkiG9w0BAQQFADBJMQswCQYDVQQGEwJVUzEQMA4GA1UEChMHSGFydmFyZDEoMCYGA1UEAxMfTDE1MUFUUzAzMzA0MC5hbXMuYm55bWVsbG9uLm5ldDAeFw0xMjAyMDgxMzU0NTNaFw0xMzAyMDcxMzU0NTNaMEkxCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdIYXJ2YXJkMSgwJgYDVQQDEx9MMTUxQVRTMDMzMDQwLmFtcy5ibnltZWxsb24ubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCr0lLoMJDRGrrXT/wU2JrzS3tmsHNw16dN0c8pGNBDgBzUZGsNYU4F/9MOhw4G7t/XEtsYo8FkHT3i4Z3sDYJLtBeLF4NS9oKRX308EshLFCG5QyIB5ChZsbjWMbhuOAvkTZqAs1W5Oo/6Knewdd5lJgBVLQjDtvqgWqNbUwzZ6QIDAQABMA0GCSqGSIb3DQEBBAUAA4GBACdXxjE+fUW35Pt/0pqtlptY3yUek+EaFrY7m8DAaU2Q5BqRfOj8Zv7appyM4NW4QGjWKS/4hfkuvDDNtN1tr0mGpieznaXu3G3PW3yn6oYBSYnTeZ7yrnKxrFzKeJUTnyChSo/OrLRIDk+nDKh5cBnImGlTzP8WMGAGeGzWIVfb</wsse:BinarySecurityToken>
> <ds:Signature Id="SIG-3"
> xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:SignedInfo>
> <ds:CanonicalizationMethod
> Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
> <ec:InclusiveNamespaces PrefixList="soap"
> xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
> </ds:CanonicalizationMethod>
> <ds:SignatureMethod
> Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
> <ds:Reference URI="#TS-1">
> <ds:Transforms>
> <ds:Transform
> Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
> <ec:InclusiveNamespaces PrefixList="wsse soap"
> xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
> </ds:Transform>
> </ds:Transforms>
> <ds:DigestMethod
> Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
>
> <ds:DigestValue>SZ8HTfYh3Yk313LSnRWLJtNid9A=</ds:DigestValue>
> </ds:Reference>
> </ds:SignedInfo>
>
> <ds:SignatureValue>Vt47N03YwHW5MNJUmNc42kbsePRr9+WTL3Y9awMQhxofa/TTy6LK8GZ5vHxl+Jlm+i9MA67/tQPwfgGMLQifDRRwTk/OqCsNVkPrYHSHeNPKrgIdgxWY4hW6rNx+IXMXDsrNta2orKp4Vqnc/TozIpYRNwfT4LG/UmYmmuNnhiw=</ds:SignatureValue>
> <ds:KeyInfo Id="KI-D94D656F6D5F405EE113291420330102">
> <wsse:SecurityTokenReference
> wsu:Id="STR-D94D656F6D5F405EE113291420330263">
> <wsse:Reference
> URI="#X509-D94D656F6D5F405EE113291420330101"
> ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
> </wsse:SecurityTokenReference>
> </ds:KeyInfo>
> </ds:Signature>
> <wsse:UsernameToken wsu:Id="UsernameToken-2">
> <wsse:Username>stanforduser</wsse:Username>
> <wsse:Password
> Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">password</wsse:Password>
> </wsse:UsernameToken>
> <wsu:Timestamp wsu:Id="TS-1">
> <wsu:Created>2012-02-13T14:07:12.932Z</wsu:Created>
> <wsu:Expires>2012-02-13T14:12:12.932Z</wsu:Expires>
> </wsu:Timestamp>
> </wsse:Security>
> </soap:Header>
> <soap:Body>
> <ns2:ping xmlns="http://services.mycomp.com/ping/types/"
> xmlns:ns2="http://services.mycomp.com/ping">
> <str>System.getProperty user.name</str>
> </ns2:ping>
> </soap:Body>
> </soap:Envelope>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Signing-Message-parts-tp5475654p5479413.html
> Sent from the cxf-user mailing list archive at Nabble.com.
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: Signing Message parts
Posted by sram <sr...@hotmail.com>.
"If you want to sign the SOAP Body, you'll have to add it to the
SignatureParts list..."
Agreed. But even without signing it works though server policy indicates
signing is required. I was thinking body part signing will be expected from
server using X.509 under <EndorsedSupportingToken> section.
"you are using TLS and this fulfills the message signing requirements.."
Not following here. I removed <sp:OnlySignEntireHeadersAndBody />
section under TLS security binding, retained
<DoubleItBinding_DoubleIt_Input_Policy> body part singing in my policy; but
did not sign the body part (only signs timestamp). I expect server to
complain since I did not sign body using clients X.509, and it does not.
>>>>>>>>>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
<wsse:Security soap:mustUnderstand="1"
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:BinarySecurityToken
EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
wsu:Id="X509-D94D656F6D5F405EE113291420330101">MIICCTCCAXKgAwIBAgIETzJ+rTANBgkqhkiG9w0BAQQFADBJMQswCQYDVQQGEwJVUzEQMA4GA1UEChMHSGFydmFyZDEoMCYGA1UEAxMfTDE1MUFUUzAzMzA0MC5hbXMuYm55bWVsbG9uLm5ldDAeFw0xMjAyMDgxMzU0NTNaFw0xMzAyMDcxMzU0NTNaMEkxCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdIYXJ2YXJkMSgwJgYDVQQDEx9MMTUxQVRTMDMzMDQwLmFtcy5ibnltZWxsb24ubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCr0lLoMJDRGrrXT/wU2JrzS3tmsHNw16dN0c8pGNBDgBzUZGsNYU4F/9MOhw4G7t/XEtsYo8FkHT3i4Z3sDYJLtBeLF4NS9oKRX308EshLFCG5QyIB5ChZsbjWMbhuOAvkTZqAs1W5Oo/6Knewdd5lJgBVLQjDtvqgWqNbUwzZ6QIDAQABMA0GCSqGSIb3DQEBBAUAA4GBACdXxjE+fUW35Pt/0pqtlptY3yUek+EaFrY7m8DAaU2Q5BqRfOj8Zv7appyM4NW4QGjWKS/4hfkuvDDNtN1tr0mGpieznaXu3G3PW3yn6oYBSYnTeZ7yrnKxrFzKeJUTnyChSo/OrLRIDk+nDKh5cBnImGlTzP8WMGAGeGzWIVfb</wsse:BinarySecurityToken>
<ds:Signature Id="SIG-3"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces PrefixList="soap"
xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:CanonicalizationMethod>
<ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#TS-1">
<ds:Transforms>
<ds:Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces PrefixList="wsse soap"
xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>SZ8HTfYh3Yk313LSnRWLJtNid9A=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>Vt47N03YwHW5MNJUmNc42kbsePRr9+WTL3Y9awMQhxofa/TTy6LK8GZ5vHxl+Jlm+i9MA67/tQPwfgGMLQifDRRwTk/OqCsNVkPrYHSHeNPKrgIdgxWY4hW6rNx+IXMXDsrNta2orKp4Vqnc/TozIpYRNwfT4LG/UmYmmuNnhiw=</ds:SignatureValue>
<ds:KeyInfo Id="KI-D94D656F6D5F405EE113291420330102">
<wsse:SecurityTokenReference
wsu:Id="STR-D94D656F6D5F405EE113291420330263">
<wsse:Reference
URI="#X509-D94D656F6D5F405EE113291420330101"
ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
</wsse:SecurityTokenReference>
</ds:KeyInfo>
</ds:Signature>
<wsse:UsernameToken wsu:Id="UsernameToken-2">
<wsse:Username>stanforduser</wsse:Username>
<wsse:Password
Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">password</wsse:Password>
</wsse:UsernameToken>
<wsu:Timestamp wsu:Id="TS-1">
<wsu:Created>2012-02-13T14:07:12.932Z</wsu:Created>
<wsu:Expires>2012-02-13T14:12:12.932Z</wsu:Expires>
</wsu:Timestamp>
</wsse:Security>
</soap:Header>
<soap:Body>
<ns2:ping xmlns="http://services.mycomp.com/ping/types/"
xmlns:ns2="http://services.mycomp.com/ping">
<str>System.getProperty user.name</str>
</ns2:ping>
</soap:Body>
</soap:Envelope>
--
View this message in context: http://cxf.547215.n5.nabble.com/Signing-Message-parts-tp5475654p5479413.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: Signing Message parts
Posted by Colm O hEigeartaigh <co...@apache.org>.
If you want to sign the SOAP Body, you'll have to add it to the
SignatureParts list:
> wss4jOut.setProperty(WSHandlerConstants.SIGNATURE_PARTS,
>
> "{Element}{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Timestamp;");
The server is not throwing an error as you are using TLS and this
fulfills the message signing requirements.
Colm.
On Sat, Feb 11, 2012 at 8:59 PM, sram <sr...@hotmail.com> wrote:
> I'm testing out a usecase combining DoubleIT_TransportEndorsingPolicy and
> #DoubleItBinding_DoubleIt_Input_Policy.
>
> <sp:TransportBinding>
> <wsp:Policy>
> <sp:TransportToken>
> <wsp:Policy>
> <sp:HttpsToken RequireClientCertificate="false" />
> </wsp:Policy>
> </sp:TransportToken>
> <sp:Layout>
> <wsp:Policy>
> <sp:Lax />
> </wsp:Policy>
> </sp:Layout>
> *<sp:IncludeTimestamp />
> <sp:OnlySignEntireHeadersAndBody /> *
> <sp:AlgorithmSuite>
> <wsp:Policy>
> <sp:Basic128 />
> </wsp:Policy>
> </sp:AlgorithmSuite>
> </wsp:Policy>
> </sp:TransportBinding>
>
>
>
> <wsp:Policy wsu:Id="DoubleItBinding_DoubleIt_Input_Policy">
> <wsp:ExactlyOne>
> <wsp:All>
> <sp:SignedParts>
> *<sp:Body />*
> </sp:SignedParts>
> </wsp:All>
> </wsp:ExactlyOne>
> </wsp:Policy>
>
> On the client I generate signatures using WSS4j,
>
> wss4jOut.setProperty(WSHandlerConstants.ACTION,
> WSHandlerConstants.TIMESTAMP + " "
> + WSHandlerConstants.USERNAME_TOKEN + " " +
> WSHandlerConstants.SIGNATURE);
>
> wss4jOut.setProperty(WSHandlerConstants.SIGNATURE_PARTS,
>
> "{Element}{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Timestamp;");
>
>
> All works fine, even if client signs only the timestamp part and not any
> message body part. Even though I add DoubleItBinding_DoubleIt_Input_Policy
> reference to my SOAP message input part, I suspect the server is only
> checking for timestamp.
>
>>>>>>>> WSDL
> <binding name="pingBinding" type="p0:pingPortType">
> <wsp:PolicyReference URI="#DoubleIT_TransportEndorsingPolicy" />
> <soap:binding transport="http://schemas.xmlsoap.org/soap/http"
> style="document" />
> <operation name="ping">
> <soap:operation soapAction="" />
> <input>
> <soap:body use="literal" />
> <wsp:PolicyReference URI="#DoubleItBinding_DoubleIt_Input_Policy" />
> </input>
> <output>
> <soap:body use="literal" />
> ...
>
>
> I wanted client to sign message parts which can be authenticated on the
> server side using clients X.509 token, flowing in as part of TLS binding as
> an endorsing supporting token.
>
>>>>>>>>>> Logs
> [2/11/12 15:44:04:747 EST] 0000004e SignatureProc 1
> org.apache.ws.security.processor.SignatureProcessor handleToken Found
> signature element
> [2/11/12 15:44:04:747 EST] 0000004e SignatureTrus 1
> org.apache.ws.security.validate.SignatureTrustValidator verifyTrustInCert
> Transmitted certificate has subject
> CN=L151ATS033040.ams.mycomp.net,O=Harvard,C=US
> [2/11/12 15:44:04:747 EST] 0000004e SignatureTrus 1
> org.apache.ws.security.validate.SignatureTrustValidator verifyTrustInCert
> Transmitted certificate has issuer
> CN=L151ATS033040.ams.mycomp.net,O=Harvard,C=US (serial 1328709293)
> [2/11/12 15:44:04:747 EST] 0000004e SignatureTrus 1
> org.apache.ws.security.validate.SignatureTrustValidator
> isCertificateInKeyStore Direct trust for certificate with
> CN=L151ATS033040.ams.mycomp.net,O=Harvard,C=US
> [2/11/12 15:44:04:747 EST] 0000004e SignatureProc 1
> org.apache.ws.security.processor.SignatureProcessor verifyXMLSignature
> Verify XML Signature
> [2/11/12 15:44:04:747 EST] 0000004e UsernameToken 1
> org.apache.ws.security.processor.UsernameTokenProcessor handleToken Found
> UsernameToken list element
> [2/11/12 15:44:04:747 EST] 0000004e UsernameToken 1
> org.apache.ws.security.validate.UsernameTokenValidator validate
> UsernameToken user stanforduser
> [2/11/12 15:44:04:747 EST] 0000004e UsernameToken 1
> org.apache.ws.security.validate.UsernameTokenValidator validate
> UsernameToken password type
> http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText
> [2/11/12 15:44:04:747 EST] 0000004e SystemOut O stanforduser :
> workbench
> [2/11/12 15:44:04:747 EST] 0000004e TimestampProc 1
> org.apache.ws.security.processor.TimestampProcessor handleToken Found
> Timestamp list element
> [2/11/12 15:44:04:747 EST] 0000004e Timestamp 1
> org.apache.ws.security.message.token.Timestamp <init> Current time:
> 2012-02-11T20:44:04.747Z
> [2/11/12 15:44:04:747 EST] 0000004e Timestamp 1
> org.apache.ws.security.message.token.Timestamp <init> Timestamp created:
> 2012-02-11T20:44:04.310Z
> [2/11/12 15:44:04:747 EST] 0000004e Timestamp 1
> org.apache.ws.security.message.token.Timestamp <init> Timestamp expires:
> 2012-02-11T20:49:04.310Z
> [2/11/12 15:44:04:747 EST] 0000004e Timestamp 1
> org.apache.ws.security.message.token.Timestamp verifyCreated Validation of
> Timestamp: Everything is ok
> [2/11/12 15:44:04:747 EST] 0000004e PingPortTypeI I Executing operation
> ping
> [2/11/12 15:44:04:747 EST] 0000004e SystemOut O System.getProperty
> user.name
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.com/Signing-Message-parts-tp5475654p5475654.html
> Sent from the cxf-user mailing list archive at Nabble.com.
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com