You are viewing a plain text version of this content. The canonical link for it is here.
Posted to java-user@axis.apache.org by shams jawaid <sh...@hotmail.com> on 2008/03/29 03:54:15 UTC
Message Level Security
hi there, i am currently confused about the difference between message level and transport level security. I want to know whether i have setup message layer security on my pc or not. I have a setup with axis2 and rampart on my pc, which fully signs and encrypts the SOAP messages. what type of security am i implementing, transport or message level? does a message always need to be partially encrypted for an intended recipient for it to be declared message level security? what if the message is fully encrypted, but is also only intended for a specific recipient? for example, if A is sending a message to C, and it is passing through B, but is fully encrypted for C, and B cannot read it, is that message level security?
if i have a completely wrong idea of message level security, please can someone explain exactly what it is.
lastly, if i am not doing message level security in my setup, is it possible to do message level security with rampart?
Thanks!
_________________________________________________________________
Get Hotmail on your mobile. Text MSN to 63463 now!
http://mobile.uk.msn.com/pc/mail.aspx
RE: Message Level Security
Posted by shams jawaid <sh...@hotmail.com>.
Hi Nandana & Arlindo,
Thankyou very much for clearing that up! Much appreciated!> Date: Sat, 29 Mar 2008 17:56:02 +0530> From: nandana.cse@gmail.com> To: axis-user@ws.apache.org> Subject: Re: Message Level Security> > Hi Shams,> > > surely rampart is message level security... end to end security...> > transport level security is like TLS/SSL,,, point to point security...> > Adding some points ...> > Rampart can be used with Transport level security ( where the messages> are actually protected by the transport ) and Rampart validates> whether the message arrived through a secure a transport. For example> take Username token over HTTPS scenario. Here the message protection> is transport level security and Rampart provides the authentication.> Rampart also validates incoming transport to check whether it is> "https".> > When Rampart signs and encrypts messages or parts of the messages as> in your scenario, it is message level security. You will find this [1]> comparison useful.> > thanks,> /nandana> > [1] - http://xyzws.com/kbdatabase/TLevel_vs_MLevel_Security.html> > ---------------------------------------------------------------------> To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org> For additional commands, e-mail: axis-user-help@ws.apache.org>
_________________________________________________________________
The next generation of Windows Live is here
http://www.windowslive.co.uk/get-live
Re: Message Level Security
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
Hi Shams,
> surely rampart is message level security... end to end security...
> transport level security is like TLS/SSL,,, point to point security...
Adding some points ...
Rampart can be used with Transport level security ( where the messages
are actually protected by the transport ) and Rampart validates
whether the message arrived through a secure a transport. For example
take Username token over HTTPS scenario. Here the message protection
is transport level security and Rampart provides the authentication.
Rampart also validates incoming transport to check whether it is
"https".
When Rampart signs and encrypts messages or parts of the messages as
in your scenario, it is message level security. You will find this [1]
comparison useful.
thanks,
/nandana
[1] - http://xyzws.com/kbdatabase/TLevel_vs_MLevel_Security.html
---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org
Re: Using rampart policy for basic authentication
Posted by Martin Gainty <mg...@hotmail.com>.
you can define a BasicPolicy in your services.xml an example is:
<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
<sp:SymmetricBinding
xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<sp:AlgorithmSuite>
<wsp:Policy>
<sp:Basic128Rsa15/>
</wsp:Policy>
</sp:AlgorithmSuite>
</wsp:Policy>
</sp:SymmetricBinding>
Is this what you're looking for?
Martin-
----- Original Message -----
From: "jason zhang" <ja...@gmail.com>
To: <ax...@ws.apache.org>
Sent: Saturday, March 29, 2008 6:07 AM
Subject: Using rampart policy for basic authentication
> Hi, All
> Is it possible to implement the rampart sample/basic/sample02 with
> policy? What I want to do just basic username/password authentication
> with policy. All the examples in policy directory involve encryption or
> signature.
>
> If it is possible, how can I find out in my business method who the
> authenticated user is? For example, the Servlet API has a method
> HttpServletRequest.getRemoteUser(). Is such a similar API in rampart?
>
> Thanks
>
> -jason
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
> For additional commands, e-mail: axis-user-help@ws.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org
Re: Using rampart policy for basic authentication
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
Hi Jason,
> Is it possible to implement the rampart sample/basic/sample02 with
> policy?
Even though this is not recommended ( sending the UT in plain text
over HTTP), this is possible with Rampart. Policy for your scenario is
<wsp:Policy wsu:Id="UToverHTTP"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:ExactlyOne>
<wsp:All>
<sp:SupportingTokens>
<wsp:Policy>
<sp:UsernameToken/>
</wsp:Policy>
</sp:SupportingTokens>
<ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy">
<ramp:user>username</ramp:user>
<ramp:passwordCallbackClass>PWCallback</ramp:passwordCallbackClass>
</ramp:RampartConfig>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
> If it is possible, how can I find out in my business method who the
> authenticated user is? For example, the Servlet API has a method
> HttpServletRequest.getRemoteUser(). Is such a similar API in rampart?
This tutorial describes how you can do this [1].
thanks,
/nandana
[1] - http://wso2.org/library/169
---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org
Using rampart policy for basic authentication
Posted by jason zhang <ja...@gmail.com>.
Hi, All
Is it possible to implement the rampart sample/basic/sample02 with
policy? What I want to do just basic username/password authentication
with policy. All the examples in policy directory involve encryption or
signature.
If it is possible, how can I find out in my business method who the
authenticated user is? For example, the Servlet API has a method
HttpServletRequest.getRemoteUser(). Is such a similar API in rampart?
Thanks
-jason
---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org
Re: Message Level Security
Posted by Arlindo Luis Marcon Junior <ar...@gmail.com>.
what I know is:
surely rampart is message level security... end to end security...
transport level security is like TLS/SSL,,, point to point security...
about your sample,,, yes... that is message level security...
only A and C should be able to read the message... in theory...
hope it help...
if someone had a more knowledge,,, please,,, give-me more samples...
shams jawaid escreveu:
> hi there, i am currently confused about the difference between message
> level and transport level security.
>
> I want to know whether i have setup message layer security on my pc or
> not.
>
> I have a setup with axis2 and rampart on my pc, which fully signs and
> encrypts the SOAP messages. what type of security am i implementing,
> transport or message level?
>
> does a message always need to be partially encrypted for an intended
> recipient for it to be declared message level security? what if the
> message is fully encrypted, but is also only intended for a specific
> recipient?
>
> for example, if A is sending a message to C, and it is passing through
> B, but is fully encrypted for C, and B cannot read it, is that message
> level security?
>
> if i have a completely wrong idea of message level security, please
> can someone explain exactly what it is.
>
> lastly, if i am not doing message level security in my setup, is it
> possible to do message level security with rampart?
>
> Thanks!
>
>
>
> ------------------------------------------------------------------------
> A prize an hour, 24 hours a day. Try Big Snap now!
> <http://www.bigsnapsearch.com%0A%20>
--
Arlindo Luis Marcon Junior
E-mail: arlindomarconjr@gmail.com
Internet Web Page: http://lattes.cnpq.br/6483462042489662
ICQ: 138864173
Curitiba - Paraná - Brasil
---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org
RE: Message Level Security
Posted by "Johnson, David E" <da...@intel.com>.
Yes. If you are using SSL to create a secure pipe from one box to
another, then you are implementing point-point transport layer security.
If the content is encrypted/signed to reach a particular recipient, then
you are implementing message level security to ensure your data
maintains its confidentiality and integrity end-end. Both tools are
useful. Some architectures can create a TLS work around that
approximates end-end security. There several methods to implement
message level security depending upon your goals and architecture.
Rampart is one of them. Another can be found at
www.intel.com/software/xml .
Dave
David E.A. Johnson
Director, Digital Security Products
Intel Corporation
SSG-MMD
________________________________
From: shams jawaid [mailto:shams4d@hotmail.com]
Sent: Friday, March 28, 2008 10:54 PM
To: axis mailing list
Subject: Message Level Security
hi there, i am currently confused about the difference between message
level and transport level security.
I want to know whether i have setup message layer security on my pc or
not.
I have a setup with axis2 and rampart on my pc, which fully signs and
encrypts the SOAP messages. what type of security am i implementing,
transport or message level?
does a message always need to be partially encrypted for an intended
recipient for it to be declared message level security? what if the
message is fully encrypted, but is also only intended for a specific
recipient?
for example, if A is sending a message to C, and it is passing through
B, but is fully encrypted for C, and B cannot read it, is that message
level security?
if i have a completely wrong idea of message level security, please can
someone explain exactly what it is.
lastly, if i am not doing message level security in my setup, is it
possible to do message level security with rampart?
Thanks!
________________________________
A prize an hour, 24 hours a day. Try Big Snap now!
<http://www.bigsnapsearch.com%0d%0a%20%0d%0a>