You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ws.apache.org by dk...@apache.org on 2019/10/31 14:35:55 UTC
[ws-wss4j] annotated tag 1_5_3 created (now 1ab8e0c)
This is an automated email from the ASF dual-hosted git repository.
dkulp pushed a change to annotated tag 1_5_3
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git.
at 1ab8e0c (tag)
tagging 5d23557749b92db183437682fd4516481a755969 (commit)
by Ruchith Udayanga Fernando
on Thu Sep 6 03:01:37 2007 +0000
- Log -----------------------------------------------------------------
Created the 1.5.3 tag
-----------------------------------------------------------------------
This annotated tag includes the following new commits:
new 5d23557 Created the 1.5.3 tag
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
[ws-wss4j] 01/01: Created the 1.5.3 tag
Posted by dk...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
dkulp pushed a commit to annotated tag 1_5_3
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
commit 5d23557749b92db183437682fd4516481a755969
Author: Ruchith Udayanga Fernando <ru...@apache.org>
AuthorDate: Thu Sep 6 03:01:37 2007 +0000
Created the 1.5.3 tag
---
build.xml | 6 +-
.../org/apache/ws/axis/oasis/Client_deploy.wsdd | 15 +++
interop/org/apache/ws/axis/oasis/Scenario2b.java | 101 +++++++++++++++++++++
interop/org/apache/ws/axis/oasis/ping/deploy.wsdd | 28 ++++++
interop/ping.wsdl | 3 +
pom.xml | 2 +-
.../security/action/UsernameTokenSignedAction.java | 68 ++++++++++++--
.../apache/ws/security/message/WSSecSignature.java | 2 -
.../ws/security/message/token/UsernameToken.java | 24 ++++-
.../ws/security/processor/SignatureProcessor.java | 9 +-
.../security/processor/UsernameTokenProcessor.java | 19 +++-
test/interop/TestScenario2b.java | 65 +++++++++++++
test/wssec/TestWSSecurityNew13.java | 41 ++++++++-
wss4j-readme.html | 4 +-
xdocs/index.xml | 2 +-
15 files changed, 362 insertions(+), 27 deletions(-)
diff --git a/build.xml b/build.xml
index 91d30a7..d6d4cf8 100644
--- a/build.xml
+++ b/build.xml
@@ -27,9 +27,9 @@ Build Instructions:
<property name='product.version.major' value='1'/>
<property name='product.version.minor' value='5'/>
- <property name='product.version.level' value='2'/>
- <!--<property name='product.version' value='${product.version.major}.${product.version.minor}.${product.version.level}'/>-->
- <property name='product.version' value='SNAPSHOT'/>
+ <property name='product.version.level' value='3'/>
+ <property name='product.version' value='${product.version.major}.${product.version.minor}.${product.version.level}'/>
+ <!--<property name='product.version' value='SNAPSHOT'/>-->
<property name="year" value="2005"/>
<property name="copyright" value="Copyright © ${year} Apache WSS4J Project. All Rights Reserved."/>
diff --git a/interop/org/apache/ws/axis/oasis/Client_deploy.wsdd b/interop/org/apache/ws/axis/oasis/Client_deploy.wsdd
index b7f443a..a6f6fae 100644
--- a/interop/org/apache/ws/axis/oasis/Client_deploy.wsdd
+++ b/interop/org/apache/ws/axis/oasis/Client_deploy.wsdd
@@ -68,6 +68,21 @@
</requestFlow>
</service>
+ <service name="Ping2b">
+ <requestFlow>
+ <handler type="java:org.apache.ws.axis.security.WSDoAllSender" >
+ <parameter name="action" value="UsernameTokenSignature Timestamp"/>
+ <parameter name="user" value="Chris"/>
+ <parameter name="passwordCallbackClass"
+ value="org.apache.ws.axis.oasis.PWCallback1"/>
+ <parameter name="passwordType" value="PasswordDigest" />
+ <parameter name="signatureParts"
+ value="Body;{}{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameToken" />
+
+ </handler>
+ </requestFlow>
+ </service>
+
<service name="Ping3">
<requestFlow>
<handler type="java:org.apache.ws.axis.security.WSDoAllSender" >
diff --git a/interop/org/apache/ws/axis/oasis/Scenario2b.java b/interop/org/apache/ws/axis/oasis/Scenario2b.java
new file mode 100644
index 0000000..ab9e492
--- /dev/null
+++ b/interop/org/apache/ws/axis/oasis/Scenario2b.java
@@ -0,0 +1,101 @@
+/*
+ * Copyright 2003-2004 The Apache Software Foundation.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package org.apache.ws.axis.oasis;
+
+import org.apache.axis.utils.Options;
+import org.apache.ws.axis.oasis.ping.PingPort;
+import org.apache.ws.axis.oasis.ping.PingServiceLocator;
+
+import javax.xml.rpc.holders.StringHolder;
+
+/**
+ * Class Scenario2b
+ */
+public class Scenario2b {
+
+ /** Field address */
+ private static final java.lang.String address =
+ "http://localhost:9080/axis/services/Ping2b";
+
+ /**
+ * Method main
+ *
+ * @param args
+ * @throws Exception
+ */
+ public static void main(String[] args) throws Exception {
+
+ Options opts = new Options(args);
+ opts.setDefaultURL(address);
+
+ /*
+ * Start to prepare service call. Once this is done, several
+ * calls can be made on the port (see below)
+ *
+ * Fist: get the service locator. This implements the functionality
+ * to get a client stub (aka port).
+ */
+ PingServiceLocator service = new PingServiceLocator();
+
+ /*
+ * this is a JAX-RPC compliant call. It uses a preconfigured
+ * endpoint address (usually contained in the WSDL). Note the
+ * cast.
+ *
+ * SecPort port = (SwaPort)service.getPort(SwaPortType.class);
+ */
+
+ /*
+ * Here we use an Axis specific call that allows to override the
+ * port address (service endpoint address) with an own URL. Comes
+ * in handy for testing.
+ */
+ java.net.URL endpoint;
+
+ try {
+ endpoint = new java.net.URL(opts.getURL());
+ } catch (java.net.MalformedURLException e) {
+ throw new javax.xml.rpc.ServiceException(e);
+ }
+
+ PingPort port = (PingPort) service.getPing2b(endpoint);
+
+ /*
+ * At this point all preparations are done. Using the port we can
+ * now perform as many calls as necessary.
+ */
+
+ // perform call
+ StringHolder text =
+ new StringHolder("WSS4J - Scenario 2b text");
+ port.ping(new org.apache.ws.axis.oasis.ping.TicketType("WSS4J"), text);
+ System.out.println(text.value);
+
+ if (opts.isFlagSet('t') > 0) {
+ long startTime = System.currentTimeMillis();
+
+ for (int i = 0; i < 20; i++) {
+ port.ping(new org.apache.ws.axis.oasis.ping.TicketType("WSS4J"), text);
+ }
+
+ long endTime = System.currentTimeMillis();
+
+ System.out.println("Time used: " + (endTime - startTime) + "ms");
+ }
+ }
+}
diff --git a/interop/org/apache/ws/axis/oasis/ping/deploy.wsdd b/interop/org/apache/ws/axis/oasis/ping/deploy.wsdd
index 0771acc..6976047 100644
--- a/interop/org/apache/ws/axis/oasis/ping/deploy.wsdd
+++ b/interop/org/apache/ws/axis/oasis/ping/deploy.wsdd
@@ -103,6 +103,34 @@
</requestFlow>
</service>
+ <service name="Ping2b" provider="java:RPC" style="wrapped" use="literal">
+ <parameter name="wsdlTargetNamespace" value="http://xmlsoap.org/Ping"/>
+ <parameter name="wsdlServiceElement" value="PingService"/>
+ <parameter name="wsdlServicePort" value="Ping2"/>
+ <parameter name="className" value="org.apache.ws.axis.oasis.ping.PingBindingImpl"/>
+ <parameter name="wsdlPortType" value="PingPort"/>
+ <operation name="ping" qname="operNS:Ping" xmlns:operNS="http://xmlsoap.org/Ping" >
+ <parameter qname="pns:ticket" xmlns:pns="http://xmlsoap.org/Ping" type="tns:ticketType" xmlns:tns="http://xmlsoap.org/Ping"/>
+ <parameter qname="pns:text" xmlns:pns="http://xmlsoap.org/Ping" type="tns:string" xmlns:tns="http://www.w3.org/2001/XMLSchema" mode="INOUT"/>
+ </operation>
+ <parameter name="allowedMethods" value="ping"/>
+
+ <typeMapping
+ xmlns:ns="http://xmlsoap.org/Ping"
+ qname="ns:ticketType"
+ type="java:org.apache.ws.axis.oasis.ping.TicketType"
+ serializer="org.apache.axis.encoding.ser.SimpleSerializerFactory"
+ deserializer="org.apache.axis.encoding.ser.SimpleDeserializerFactory"
+ encodingStyle=""
+ />
+ <requestFlow>
+ <handler type="java:org.apache.ws.axis.security.WSDoAllReceiver">
+ <parameter name="passwordCallbackClass" value="org.apache.ws.axis.oasis.PWCallback1"/>
+ <parameter name="action" value="UsernameTokenSignature UsernameToken Timestamp"/>
+ </handler>
+ </requestFlow>
+ </service>
+
<service name="Ping3" provider="java:RPC" style="wrapped" use="literal">
<parameter name="wsdlTargetNamespace" value="http://xmlsoap.org/Ping"/>
<parameter name="wsdlServiceElement" value="PingService"/>
diff --git a/interop/ping.wsdl b/interop/ping.wsdl
index c470868..ca687b8 100644
--- a/interop/ping.wsdl
+++ b/interop/ping.wsdl
@@ -70,6 +70,9 @@
<port name="Ping2a" binding="tns:PingBinding">
<soap:address location="http://localhost:9080/pingservice/Ping2a"/>
</port>
+ <port name="Ping2b" binding="tns:PingBinding">
+ <soap:address location="http://localhost:9080/pingservice/Ping2b"/>
+ </port>
<port name="Ping3" binding="tns:PingBinding">
<soap:address location="http://localhost:9080/pingservice/Ping3"/>
</port>
diff --git a/pom.xml b/pom.xml
index 33c2e4b..4517663 100644
--- a/pom.xml
+++ b/pom.xml
@@ -7,7 +7,7 @@
<groupId>org.apache.ws.security</groupId>
<artifactId>wss4j</artifactId>
<name>WSS4J</name>
- <version>SNAPSHOT</version>
+ <version>1.5.3</version>
<description>
Apache WSS4J is an implementation of the Web Services Security (WS-Security) being developed at
OASIS Web Services Security TC. WSS4J is a primarily a Java library that can be used to sign and
diff --git a/src/org/apache/ws/security/action/UsernameTokenSignedAction.java b/src/org/apache/ws/security/action/UsernameTokenSignedAction.java
index ecac48c..4041066 100644
--- a/src/org/apache/ws/security/action/UsernameTokenSignedAction.java
+++ b/src/org/apache/ws/security/action/UsernameTokenSignedAction.java
@@ -1,5 +1,5 @@
/*
- * Copyright 2003-2004 The Apache Software Foundation.
+ * Copyright 2003-2007 The Apache Software Foundation.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,15 +17,31 @@
package org.apache.ws.security.action;
+import java.util.Vector;
+
+import org.apache.ws.security.SOAPConstants;
import org.apache.ws.security.WSConstants;
+import org.apache.ws.security.WSEncryptionPart;
import org.apache.ws.security.WSSecurityException;
import org.apache.ws.security.handler.RequestData;
import org.apache.ws.security.handler.WSHandler;
import org.apache.ws.security.handler.WSHandlerConstants;
import org.apache.ws.security.message.WSSecUsernameToken;
import org.apache.ws.security.message.WSSecSignature;
+import org.apache.ws.security.message.WSSecHeader;
+import org.apache.ws.security.util.WSSecurityUtil;
import org.apache.xml.security.signature.XMLSignature;
import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+
+/**
+ * Sign a request using a secret key derived from UsernameToken data.
+ *
+ * Enhanced by Alberto Coletti to support digest password type for
+ * username token signature
+ *
+ * @author Werner Dittmann (Werner.Dittmann@t-online.de)
+ */
public class UsernameTokenSignedAction implements Action {
public void execute(WSHandler handler, int actionToDo, Document doc, RequestData reqData)
@@ -37,28 +53,66 @@ public class UsernameTokenSignedAction implements Action {
WSSecUsernameToken builder = new WSSecUsernameToken();
builder.setWsConfig(reqData.getWssConfig());
- builder.setPasswordType(WSConstants.PASSWORD_TEXT);
+ builder.setPasswordType(reqData.getPwType()); // enhancement by Alberto Coletti
+
builder.setUserInfo(reqData.getUsername(), password);
builder.addCreated();
builder.addNonce();
builder.prepare(doc);
+
+ // Now prepare to sign.
+ // First step: Get a WS Signature object and set config parameters
+ // second step: set user data and algorithm parameters. This
+ // _must_ be done before we "prepare"
+ // third step: Call "prepare". This creates the internal WS Signature
+ // data structures, XML element, fills in the algorithms
+ // and other data.
+ // fourth step: Get the references. These references identify the parts
+ // of the document that will be included into the
+ // signature. If no references are given sign the message
+ // body by default.
+ // fifth step: compute the signature
+ //
+ // after "prepare" the Signature XML element is ready and may prepend
+ // this to the security header.
WSSecSignature sign = new WSSecSignature();
sign.setWsConfig(reqData.getWssConfig());
- if (reqData.getSignatureParts().size() > 0) {
- sign.setParts(reqData.getSignatureParts());
- }
sign.setUsernameToken(builder);
sign.setKeyIdentifierType(WSConstants.UT_SIGNING);
sign.setSignatureAlgorithm(XMLSignature.ALGO_ID_MAC_HMAC_SHA1);
+
+ sign.prepare(doc, null, reqData.getSecHeader());
+
+ // prepend in this order: first the Signature Element and then the
+ // UsernameToken Element. This way the server gets the UsernameToken
+ // first, can check it and are prepared to compute the Signature key.
+ sign.prependToHeader(reqData.getSecHeader());
+ builder.prependToHeader(reqData.getSecHeader());
+
+ Vector parts = null;
+ if (reqData.getSignatureParts().size() > 0) {
+ parts = reqData.getSignatureParts();
+ }
+ else {
+ SOAPConstants soapConstants = WSSecurityUtil.getSOAPConstants(doc
+ .getDocumentElement());
+
+ parts = new Vector();
+ WSEncryptionPart encP = new WSEncryptionPart(soapConstants
+ .getBodyQName().getLocalPart(), soapConstants
+ .getEnvelopeURI(), "Content");
+ parts.add(encP);
+ }
+ sign.addReferencesToSign(parts, reqData.getSecHeader());
+
try {
- sign.build(doc, null, reqData.getSecHeader());
+ sign.computeSignature();
reqData.getSignatureValues().add(sign.getSignatureValue());
} catch (WSSecurityException e) {
throw new WSSecurityException("WSHandler: Error during Signature with UsernameToken secret"
+ e);
}
- builder.prependToHeader(reqData.getSecHeader());
}
}
diff --git a/src/org/apache/ws/security/message/WSSecSignature.java b/src/org/apache/ws/security/message/WSSecSignature.java
index 8a94760..f31c6eb 100644
--- a/src/org/apache/ws/security/message/WSSecSignature.java
+++ b/src/org/apache/ws/security/message/WSSecSignature.java
@@ -710,8 +710,6 @@ public class WSSecSignature extends WSSecBase {
log.debug("Beginning signing...");
}
- Element securityHeader = secHeader.getSecurityHeader();
-
prepare(doc, cr, secHeader);
SOAPConstants soapConstants = WSSecurityUtil.getSOAPConstants(doc
diff --git a/src/org/apache/ws/security/message/token/UsernameToken.java b/src/org/apache/ws/security/message/token/UsernameToken.java
index fce63f2..c7206cf 100644
--- a/src/org/apache/ws/security/message/token/UsernameToken.java
+++ b/src/org/apache/ws/security/message/token/UsernameToken.java
@@ -1,5 +1,5 @@
/*
- * Copyright 2003-2004 The Apache Software Foundation.
+ * Copyright 2003-2007 The Apache Software Foundation.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -44,13 +44,17 @@ import java.util.TimeZone;
/**
* UsernameToken according to WS Security specifications, UsernameToken profile.
*
+ * Enhanced to support digest password type for username token signature
+ *
* @author Davanum Srinivas (dims@yahoo.com)
- * @author Werner Dittmann (Werner.Dittmann@siemens.com)
+ * @author Werner Dittmann (Werner.Dittmann@t-online.de)
*/
public class UsernameToken {
private static Log log = LogFactory.getLog(UsernameToken.class.getName());
public static final String PASSWORD_TYPE = "passwordType";
+
+ private String raw_password; // enhancment by Alberto Coletti
protected Element element = null;
@@ -325,7 +329,7 @@ public class UsernameToken {
/**
* Gets the password string. This is the password as it is in the password
- * element of a username, token. Thus it can be either plain text or the
+ * element of a username token. Thus it can be either plain text or the
* password digest value.
*
* @return the password string or <code>null</code> if no such node
@@ -397,6 +401,7 @@ public class UsernameToken {
if (pwd == null) {
throw new IllegalArgumentException("pwd == null");
}
+ raw_password = pwd; // enhancement by Alberto coletti
Text node = getFirstNode(this.elementPassword);
try {
if (!hashed) {
@@ -413,6 +418,15 @@ public class UsernameToken {
}
}
+ /**
+ * Set the raw (plain text) password used to compute secret key.
+ *
+ * @param raw_password the raw_password to set
+ */
+ public void setRawPassword(String raw_password) {
+ this.raw_password = raw_password;
+ }
+
public static String doPasswordDigest(String nonce, String created,
String password) {
String passwdDigest = null;
@@ -541,7 +555,7 @@ public class UsernameToken {
byte[] key = null;
try {
Mac mac = Mac.getInstance("HMACSHA1");
- byte[] password = getPassword().getBytes("UTF-8");
+ byte[] password = raw_password.getBytes("UTF-8"); // enhancement by Alberto Coletti
byte[] label = labelString.getBytes("UTF-8");
byte[] nonce = Base64.decode(getNonce());
byte[] created = getCreated().getBytes("UTF-8");
@@ -571,6 +585,8 @@ public class UsernameToken {
}
return key;
}
+
+
/**
* This static method generates a derived key as defined in WSS Username
diff --git a/src/org/apache/ws/security/processor/SignatureProcessor.java b/src/org/apache/ws/security/processor/SignatureProcessor.java
index 4ce95e4..967efb3 100644
--- a/src/org/apache/ws/security/processor/SignatureProcessor.java
+++ b/src/org/apache/ws/security/processor/SignatureProcessor.java
@@ -203,14 +203,17 @@ public class SignatureProcessor implements Processor {
QName el = new QName(token.getNamespaceURI(), token
.getLocalName());
if (el.equals(WSSecurityEngine.usernameToken)) {
- ut = new UsernameToken(token);
+ String id = token.getAttributeNS(WSConstants.WSU_NS, "Id");
+ UsernameTokenProcessor utProcessor =
+ (UsernameTokenProcessor) wsDocInfo.getProcessor(id);
+ ut = utProcessor.getUt();
secretKey = ut.getSecretKey();
} else if(el.equals(WSSecurityEngine.DERIVED_KEY_TOKEN_05_02) ||
el.equals(WSSecurityEngine.DERIVED_KEY_TOKEN_05_12)) {
dkt = new DerivedKeyToken(token);
String id = dkt.getID();
- DerivedKeyTokenProcessor dktProcessor = (DerivedKeyTokenProcessor) wsDocInfo
- .getProcessor(id);
+ DerivedKeyTokenProcessor dktProcessor =
+ (DerivedKeyTokenProcessor) wsDocInfo.getProcessor(id);
String signatureMethodURI = sig.getSignedInfo().getSignatureMethodURI();
int keyLength = (dkt.getLength() > 0) ? dkt.getLength() :
WSSecurityUtil.getKeyLength(signatureMethodURI);
diff --git a/src/org/apache/ws/security/processor/UsernameTokenProcessor.java b/src/org/apache/ws/security/processor/UsernameTokenProcessor.java
index 1be619b..9dcfaa8 100644
--- a/src/org/apache/ws/security/processor/UsernameTokenProcessor.java
+++ b/src/org/apache/ws/security/processor/UsernameTokenProcessor.java
@@ -41,6 +41,7 @@ public class UsernameTokenProcessor implements Processor {
private static Log log = LogFactory.getLog(UsernameTokenProcessor.class.getName());
private String utId;
+ private UsernameToken ut;
public void handleToken(Element elem, Crypto crypto, Crypto decCrypto, CallbackHandler cb, WSDocInfo wsDocInfo, Vector returnResults, WSSConfig wsc) throws WSSecurityException {
if (log.isDebugEnabled()) {
@@ -75,7 +76,7 @@ public class UsernameTokenProcessor implements Processor {
* @throws WSSecurityException
*/
public WSUsernameTokenPrincipal handleUsernameToken(Element token, CallbackHandler cb) throws WSSecurityException {
- UsernameToken ut = new UsernameToken(token);
+ ut = new UsernameToken(token);
String user = ut.getName();
String password = ut.getPassword();
String nonce = ut.getNonce();
@@ -87,6 +88,8 @@ public class UsernameTokenProcessor implements Processor {
}
Callback[] callbacks = new Callback[1];
+ String origPassword = null;
+
if (ut.isHashed()) {
if (cb == null) {
throw new WSSecurityException(WSSecurityException.FAILURE,
@@ -106,7 +109,7 @@ public class UsernameTokenProcessor implements Processor {
"noPassword",
new Object[]{user}, e);
}
- String origPassword = pwCb.getPassword();
+ origPassword = pwCb.getPassword();
if (log.isDebugEnabled()) {
log.debug("UsernameToken callback password " + origPassword);
}
@@ -120,6 +123,7 @@ public class UsernameTokenProcessor implements Processor {
throw new WSSecurityException(WSSecurityException.FAILED_AUTHENTICATION);
}
}
+ ut.setRawPassword(origPassword);
} else if (cb != null) {
WSPasswordCallback pwCb = new WSPasswordCallback(user, password,
pwType, WSPasswordCallback.USERNAME_TOKEN_UNKNOWN);
@@ -133,8 +137,8 @@ public class UsernameTokenProcessor implements Processor {
throw new WSSecurityException(WSSecurityException.FAILURE,
"noPassword", new Object[]{user});
}
+ ut.setRawPassword(password);
}
-
WSUsernameTokenPrincipal principal = new WSUsernameTokenPrincipal(user, ut.isHashed());
principal.setNonce(nonce);
principal.setPassword(password);
@@ -149,5 +153,14 @@ public class UsernameTokenProcessor implements Processor {
*/
public String getId() {
return utId;
+ }
+
+ /**
+ * Get the processed USernameToken.
+ *
+ * @return the ut
+ */
+ public UsernameToken getUt() {
+ return ut;
}
}
diff --git a/test/interop/TestScenario2b.java b/test/interop/TestScenario2b.java
new file mode 100644
index 0000000..a98a43c
--- /dev/null
+++ b/test/interop/TestScenario2b.java
@@ -0,0 +1,65 @@
+/*
+ * Copyright 2003-2004 The Apache Software Foundation.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package interop;
+
+import junit.framework.Test;
+import junit.framework.TestCase;
+import junit.framework.TestSuite;
+import org.apache.ws.axis.oasis.Scenario2b;
+
+/**
+ * WS-Security Test Case
+ * <p/>
+ *
+ * @author Davanum Srinivas (dims@yahoo.com)
+ */
+public class TestScenario2b extends TestCase {
+ /**
+ * TestScenario1 constructor
+ * <p/>
+ *
+ * @param name name of the test
+ */
+ public TestScenario2b(String name) {
+ super(name);
+ }
+
+ /**
+ * JUnit suite
+ * <p/>
+ *
+ * @return a junit test suite
+ */
+ public static Test suite() {
+ return new TestSuite(TestScenario2b.class);
+ }
+
+ /**
+ * Main method
+ * <p/>
+ *
+ * @param args command line args
+ */
+ public static void main(String[] args) throws Exception {
+ Scenario2b.main(args);
+ }
+
+ public void testScenario2b() throws Exception {
+ Scenario2b.main(new String[]{"-lhttp://localhost:8080/axis/services/Ping2b"});
+ }
+}
diff --git a/test/wssec/TestWSSecurityNew13.java b/test/wssec/TestWSSecurityNew13.java
index bb96f72..65571ae 100644
--- a/test/wssec/TestWSSecurityNew13.java
+++ b/test/wssec/TestWSSecurityNew13.java
@@ -142,7 +142,7 @@ public class TestWSSecurityNew13 extends TestCase implements CallbackHandler {
sign.setUsernameToken(builder);
sign.setKeyIdentifierType(WSConstants.UT_SIGNING);
sign.setSignatureAlgorithm(XMLSignature.ALGO_ID_MAC_HMAC_SHA1);
- log.info("Before signing....");
+ log.info("Before signing with UT text....");
sign.build(doc, null, secHeader);
log.info("Before adding UsernameToken PW Text....");
builder.prependToHeader(secHeader);
@@ -156,6 +156,45 @@ public class TestWSSecurityNew13 extends TestCase implements CallbackHandler {
log.info("After adding UsernameToken PW Text....");
verify(signedDoc);
}
+
+ /**
+ * Test the specific signing mehtod that use UsernameToken values
+ * <p/>
+ *
+ * @throws java.lang.Exception Thrown when there is any problem in signing or verification
+ */
+ public void testUsernameTokenSigningDigest() throws Exception {
+ Document doc = unsignedEnvelope.getAsDocument();
+
+ WSSecHeader secHeader = new WSSecHeader();
+ secHeader.insertSecurityHeader(doc);
+
+ WSSecUsernameToken builder = new WSSecUsernameToken();
+ builder.setPasswordType(WSConstants.PASSWORD_DIGEST);
+ builder.setUserInfo("wernerd", "verySecret");
+ builder.addCreated();
+ builder.addNonce();
+ builder.prepare(doc);
+
+ WSSecSignature sign = new WSSecSignature();
+ sign.setUsernameToken(builder);
+ sign.setKeyIdentifierType(WSConstants.UT_SIGNING);
+ sign.setSignatureAlgorithm(XMLSignature.ALGO_ID_MAC_HMAC_SHA1);
+ log.info("Before signing with UT digest....");
+ sign.build(doc, null, secHeader);
+ log.info("Before adding UsernameToken PW Digest....");
+ builder.prependToHeader(secHeader);
+ Document signedDoc = doc;
+ Message signedMsg = SOAPUtil.toAxisMessage(signedDoc);
+ if (log.isDebugEnabled()) {
+ log.debug("Message with UserNameToken PW Digest:");
+ XMLUtils.PrettyElementToWriter(signedMsg.getSOAPEnvelope().getAsDOM(), new PrintWriter(System.out));
+ }
+ signedDoc = signedMsg.getSOAPEnvelope().getAsDocument();
+ log.info("After adding UsernameToken PW Digest....");
+ verify(signedDoc);
+ }
+
/**
* Verifies the soap envelope
* <p/>
diff --git a/wss4j-readme.html b/wss4j-readme.html
index 82c2f88..95df4ea 100644
--- a/wss4j-readme.html
+++ b/wss4j-readme.html
@@ -2,7 +2,7 @@
<HTML>
<HEAD>
<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=utf-8">
- <TITLE>Apache WSS4J-1.5.2</TITLE>
+ <TITLE>Apache WSS4J-1.5.3</TITLE>
<META NAME="GENERATOR" CONTENT="OpenOffice.org 1.9.79 (Linux)">
<META NAME="AUTHOR" CONTENT="Werner Dittmann">
<META NAME="CREATED" CONTENT="20050904;11070500">
@@ -106,7 +106,7 @@ either as resources via classpath or, if that fails, as files using
the relative path of the application
</P>
<P STYLE="margin-bottom: 0cm">Thus no specific installation is
-required. The wss4j-1.5.2.jar file should be included into ear or war files
+required. The wss4j-1.5.3.jar file should be included into ear or war files
of enterprise or web application servers.</P>
<P STYLE="margin-bottom: 0cm">Please refer to the JAVADOC files of
the distribution for further information how to use WSS4J, the
diff --git a/xdocs/index.xml b/xdocs/index.xml
index 9d756ce..d26dbc3 100644
--- a/xdocs/index.xml
+++ b/xdocs/index.xml
@@ -58,7 +58,7 @@ Token Profile V1.0</a>
</ul>
</subsection>
<subsection name="Where can I download WSS4J">
- <p style="margin-left: 40px;">Latest version of WSS4J is 1.5.2:<br/>
+ <p style="margin-left: 40px;">Latest version of WSS4J is 1.5.3:<br/>
<a href="http://www.apache.org/dyn/closer.cgi/ws/wss4j/">http://www.apache.org/dyn/closer.cgi/ws/wss4j/</a>
</p>
</subsection>