You are viewing a plain text version of this content. The canonical link for it is here.
Posted to java-dev@axis.apache.org by "Hudson (JIRA)" <ji...@apache.org> on 2013/01/25 04:23:12 UTC
[jira] [Commented] (RAMPART-384) Invalid serialization for
UsernameToken with WS-SecurityPolicy 1.2
[ https://issues.apache.org/jira/browse/RAMPART-384?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13562327#comment-13562327 ]
Hudson commented on RAMPART-384:
--------------------------------
Integrated in Rampart #1381 (See [https://builds.apache.org/job/Rampart/1381/])
Fixed RAMPART-384 (Revision 1438295)
Result = SUCCESS
ruchithf :
Files :
* /axis/axis2/java/rampart/trunk/modules/rampart-policy/src/main/java/org/apache/ws/secpolicy/model/UsernameToken.java
* /axis/axis2/java/rampart/trunk/modules/rampart-policy/src/main/java/org/apache/ws/secpolicy11/builders/UsernameTokenBuilder.java
> Invalid serialization for UsernameToken with WS-SecurityPolicy 1.2
> ------------------------------------------------------------------
>
> Key: RAMPART-384
> URL: https://issues.apache.org/jira/browse/RAMPART-384
> Project: Rampart
> Issue Type: Bug
> Components: rampart-policy
> Affects Versions: 1.6.2
> Environment: Java SDK 1.6.0_27
> Windows XP Pro SP3
> Axis2 1.6.2
> Neethi 3.0.2
> Rampart 1.6.2
> Reporter: Yoann Guerro
> Assignee: Ruchith Udayanga Fernando
> Priority: Critical
> Labels: patch
> Original Estimate: 1h
> Remaining Estimate: 1h
>
> The following policy is not correctly handled by Rampart policy:
> Input policy
> <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
> <wsp:Policy>
> <sp:HashPassword/>
> <sp:WssUsernameToken11/>
> </wsp:Policy>
> </sp:UsernameToken>
> After serialization:
> <sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
> <wsp:Policy>
> <sp:WssUsernameToken11>
> <sp:HashPassword/>
> </sp:WssUsernameToken11>
> </wsp:Policy>
> </sp:UsernameToken>
> This is due to the following code in the serialize method of the UsernameToken class in package org.apache.ws.secpolicy.model
> if (isUseUTProfile10()) {
> // <sp:WssUsernameToken10 />
> writeStartElement(writer, prefix, SPConstants.USERNAME_TOKEN10 , namespaceURI);
> } else {
> // <sp:WssUsernameToken11 />
> writeStartElement(writer, prefix, SPConstants.USERNAME_TOKEN11 , namespaceURI);
> }
>
> if (version == SPConstants.SP_V12) {
>
> if (isNoPassword()) {
> writeEmptyElement(writer, prefix, SPConstants.NO_PASSWORD, namespaceURI);
> } else if (isHashPassword()){
> writeEmptyElement(writer, prefix, SPConstants.HASH_PASSWORD, namespaceURI);
> }
>
> if (isDerivedKeys()) {
> writeEmptyElement(writer, prefix, SPConstants.REQUIRE_DERIVED_KEYS, namespaceURI);
> } else if (isExplicitDerivedKeys()) {
> writeEmptyElement(writer, prefix, SPConstants.REQUIRE_EXPLICIT_DERIVED_KEYS, namespaceURI);
> } else if (isImpliedDerivedKeys()) {
> writeEmptyElement(writer, prefix, SPConstants.REQUIRE_IMPLIED_DERIVED_KEYS, namespaceURI);
> }
>
> }
> writer.writeEndElement();
> There are several issues:
> - Ordering of elements doesn't respect the WS-SecurityPolicy 1.2 specs [1]
> - WssUsernameToken10 and WssUsernameToken11 aren't parents of other assertions
> - Use of assertions WssUsernameToken10 or WssUsernameToken11 is not mandatory
> The code should be corrected in:
> if (version == SPConstants.SP_V12) {
>
> if (isNoPassword()) {
> writeEmptyElement(writer, prefix, SPConstants.NO_PASSWORD, namespaceURI);
> } else if (isHashPassword()){
> writeEmptyElement(writer, prefix, SPConstants.HASH_PASSWORD, namespaceURI);
> }
>
> if (isDerivedKeys()) {
> writeEmptyElement(writer, prefix, SPConstants.REQUIRE_DERIVED_KEYS, namespaceURI);
> } else if (isExplicitDerivedKeys()) {
> writeEmptyElement(writer, prefix, SPConstants.REQUIRE_EXPLICIT_DERIVED_KEYS, namespaceURI);
> } else if (isImpliedDerivedKeys()) {
> writeEmptyElement(writer, prefix, SPConstants.REQUIRE_IMPLIED_DERIVED_KEYS, namespaceURI);
> }
>
> }
> if (isUseUTProfile10()) {
> // <sp:WssUsernameToken10 />
> writeEmptyElement(writer, prefix, SPConstants.USERNAME_TOKEN10 , namespaceURI);
> } else if (isUseUTProfile11()) {
> // <sp:WssUsernameToken11 />
> writeEmptyElement(writer, prefix, SPConstants.USERNAME_TOKEN11 , namespaceURI);
> }
> [1] http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/ws-securitypolicy-1.2-spec-os.html#_Toc161826535 (Section 5.4.1)
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: java-dev-unsubscribe@axis.apache.org
For additional commands, e-mail: java-dev-help@axis.apache.org