[jira] Commented: (RAMPART-225) SupportingToken UsernameToken is always encrypted

["Nandana Mihindukulasooriya (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/RAMPART-225?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12912373#action_12912373 ] 

Nandana Mihindukulasooriya commented on RAMPART-225:
----------------------------------------------------

Hi Amila,
            IIRC, this was done for interoperability with other web services stacks as the 1.1 spec recommended to encrypt user-name tokens when the transport is not secure. In Security Policy 1.1 we didn't have encrypted tokens, but with security policy 1.2 this has to be the corrected as in the patch. Before applying the patch, Would it be possible to check the interoperability with these [1] web services as we have done in [2]. 

Best Regards,
Nandana

[1] - http://131.107.72.15/Security_WsSecurity_Service_Indigo/WsSecurity11.svc
[2] -  https://svn.wso2.org/repos/wso2/trunk/interop/test-suites/security/

> SupportingToken UsernameToken is always encrypted
> -------------------------------------------------
>
>                 Key: RAMPART-225
>                 URL: https://issues.apache.org/jira/browse/RAMPART-225
>             Project: Rampart
>          Issue Type: Bug
>          Components: rampart-core
>    Affects Versions: 1.4
>            Reporter: Diego Tognola
>            Assignee: Ruchith Udayanga Fernando
>         Attachments: policy-pwd-encrypted.xml, policy-working.xml, RAMPART-225.diff
>
>
> If no encryption is specified in the policy file and UsernameToken is used as supporting token, then this token is always encrypted. org.apache.rampart.builder.BindingBuilder.handleSupportingTokens(RampartMessageData, SupportingToken) does not check if UsernameToken is an encrypted token and unconditionally adds it to the encryptedTokensIdList.
> This can be easily fixed by modifying line 383 (as per src release 1.4) from
>                     encryptedTokensIdList.add(utBuilder.getId());
> to
>  
>                    if (suppTokens.isEncryptedToken()) {
>                         encryptedTokensIdList.add(utBuilder.getId());
>                     }

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.