AW: signing with DerivedKey based on UsernameToken - data for alg . test

[Dittmann Werner <we...@siemens.com>]

Brian,

ist it a server based exception, i.e. does the server sends
back some error message? Depending on the problem it could
be usefull if you can provide the text.

For your question 1): well, that's a problem because the way
WSS4J works does not support this (I have to dig in to see if
there may be a way around). WSS4J works stepwise by performing
one task after another: it builds the security header in
the order as specified by the action parameter. Thus to sign
the Timestamp it must be already in the document before the
Signature action takes place. The actions are independent
modules. Its a problem during set up of the request.
Is it an essential requirement to have the a signed timestamp
in front of the Signature? From a semantic point of view it should
not make any difference - only the request may be rendered invalid
after the Signature check.

As for 2): IMO you cannot specify AES128-CBC as Signature algorithm
because this is encryption only. I've checked with
XMLSignature and here only the usual X.509 and the HMACs with
SHA-1 and MD5 are supported (MD5 is deprecated). As for the
tests I've fixed the signature algo to be HMACSHA1, but when all
tests are ok we can easily make it more flexible but with the
noted restrictions on supported algos.


Regards,
Werner

> -----Ursprüngliche Nachricht-----
> Von: brian@sweetxml.org [mailto:brian@sweetxml.org] 
> Gesendet: Dienstag, 2. November 2004 14:48
> An: Werner.Dittmann@t-online.de; fx-dev@ws.apache.org
> Betreff: re: signing with DerivedKey based on UsernameToken - 
> data for alg. test
> 
> 
> Hey Werner,
> 
> Sorry I haven't replied before - It's super good news that you got the
> algorithm for interop with .NET.
> I've tried the service once more, but got a new exception and 
> I had hoped
> for a quick status on what went wrong this time, but the guy 
> running the
> server haven't had time yet.
> 
> I the meantime just a couple of follow up questions, that I've been
> working with to get a identical request to the .NET request
> 
> 1) how do I sign the Timestamp as well, without it being the 
> last part of
> the wsse:security child elements (and the last to process)?
> 
> 2) How do i control the signing algotihm? I've tried
>  <parameter name="signatureAlgorithm" value="aes128-cbc"/>
> and other without luck, what should it be?
> 
> Brgds Brian
> 
>