[ https://issues.apache.org/jira/browse/RAMPART-8?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Hans G Knudsen updated RAMPART-8: --------------------------------- Attachment: fix_signedpart_headers_rampart_svn.diff Hi! Here is a fix which improves policy handling of <SignedPart> headers... Changes for RampartUti.javal fixes 2+3 Suggested changes for PolicyBasedResultsValidator.java implements method described in 1. /hans > RAMPART : Policy handling of <SignedPart> <Header(s).. > ------------------------------------------------------- > > Key: RAMPART-8 > URL: https://issues.apache.org/jira/browse/RAMPART-8 > Project: Rampart > Issue Type: Bug > Reporter: Hans G Knudsen > Assigned To: Ruchith Udayanga Fernando > Attachments: fix_outgoing_signedpart_headers.diff, fix_signedpart_headers_rampart_svn.diff > > > Hi > Interop testing with .Net/WCF we noticed a few problems if we used/tried to specify "Headers" in the SignedParts Policy block > eg > <sp:SignedParts xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"> > <sp:Body/> > <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/> > <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/> > <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/> > <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/> > 1: Incoming handling does not use the list to check that specified headers were signed > Check could be : > - Is header from policy-list present in Soap message ? > - if present - check if header is in 'SignedElements' in WSSecurityEngineResult > 2: Outgoing handling fails if header specified in policy is not present in Soap Message - and message is not sent > Rampart calls WSS4J->WSSecSignature.addReferencesToSign to add headers to be signed - but fails if header is not present - could be a specified addressing header which is not needed in the current message. > Is this a desirable behaviour ? > I suppose you specify the headers in <SignedParts> because you want to enforce that they are signed (when receiving) - so should outgoing handling not be a little less strict ?? > ( - this could of cause also be a bug in WSS4J ) > 3. When used together with policy element <OnlySignEntireHeadersAndBody> - heades are added twice to the signature. > Axis survives this - but .Net/WCF cough a bit (throws exception / Soap fault) > - this is releated to (2) > /hans -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online.