Mailing-List: contact axis-user-help@ws.apache.org; run by ezmlm
Precedence: bulk
Reply-To: axis-user@ws.apache.org
Received-SPF: pass (asf.osuosl.org: domain of akkachotu@gmail.com designates
 66.249.92.171 as permitted sender)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition;
        b=UnKS0Y3fElW3ajSvyrJ4Tou4tyCQz2YYFZAXRq8N3VPb+a0cfCVaTzmWX3gROM2L1JqUk/62VdfEjALLmEhDYzBPyIZh+WhlSkCnj6a0Mz6D7IjsuhZHmiZfnuXOyzaDAZdJ79Na33oa6K9vZOSqv0MOFAFd+U4xj4HcwOUXQOw=
Message-ID: <74cc89dc0608122149h7f812b47udb30f1eef150105@mail.gmail.com>
Date: Sat, 12 Aug 2006 21:49:47 -0700
From: akkachotu <akkachotu@gmail.com>
To: axis-user@ws.apache.org
Subject: intermediary adding soap header element breaking signature
 verification
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Here is the soap message after it is signed using AXIS 1.4, WSS4J 1.5:

<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope
		xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
		xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
		xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
		xmlns:xsd="http://www.w3.org/2001/XMLSchema"
		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
	<soapenv:Header>
		<wsse:Security
					xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
			<wsse:BinarySecurityToken
						ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
						elementEncoding="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
						wsu:Id="binarytoken">
					123MIIB5jCCAU8CBEQyyzkwDQYJKoZIhvcNAQEFBQAwOjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBEFN
			</wsse:BinarySecurityToken>
			<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
				<ds:SignedInfo>
					<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments"/>
					<ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
					<ds:Reference URI="#Body">
						<ds:Transforms>
							<ds:Transform
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
						</ds:Transforms>
						<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
						<ds:DigestValue>EwE9/d/aFPCf7CpqoKdbHSrhNN0=</ds:DigestValue>
					</ds:Reference>
				</ds:SignedInfo>
				<ds:SignatureValue>
    				lCIbgyn1nzA/7Y2tAVQ+WuVTX/WoOKE0Xv1dOTDBJ+BIY1w6ulg17apQ2taLmfDHGEFtLOCO
    				TKdvhev5CMNCvmsbZQVv5Mli+ttFSpumNf8yOkf0BwDCcSyTVbuiotJJXOFVGRTXB5oxIv8q
    				UqY5QO3lZkO790OmUyBlpgWaWAE=
  				</ds:SignatureValue>
				<ds:KeyInfo>
					<wsse:SecurityTokenReference>
						<wsse:Reference
							URI="#binarytoken"
							ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
					</wsse:SecurityTokenReference>
				</ds:KeyInfo>
			</ds:Signature>
		</wsse:Security>
	</soapenv:Header>
	<soapenv:Body Id="Body">
		<getHolidays xmlns="http://transfer.as.com">
			<request>
				<ns3:regionID xmlns:ns3="http://shr.ws.com" xsi:nil="true"/>
				<cardNumber>4444</cardNumber>
			</request>
		</getHolidays>
	</soapenv:Body>
</soapenv:Envelope>


Say if I use AXIS + WSS4J on bother sender side and receiver side and
say if an intermediary adds an element

<intermediary:ProxyID
wsu:Id="6767">0d88d3e0-0e2c-489d-a682-da14b8fec3d7</intermediary:ProxyID>


to the soap header and after adding this element the complete soap
message looks like below:

<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope
		xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
		xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
		xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
		xmlns:xsd="http://www.w3.org/2001/XMLSchema"
		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
		xmlns:intermediary="http://www.intermediary.com/proxy/2424.2424s">
	<soapenv:Header>
		<intermediary:ProxyID
wsu:Id="6767">0d88d3e0-0e2c-489d-a682-da14b8fec3d7</intermediary:ProxyID>
		<wsse:Security
					xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
			<wsse:BinarySecurityToken
						ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
						elementEncoding="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
						wsu:Id="binarytoken">
					123MIIB5jCCAU8CBEQyyzkwDQYJKoZIhvcNAQEFBQAwOjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBEFN
			</wsse:BinarySecurityToken>
			<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
				<ds:SignedInfo>
					<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments"/>
					<ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
					<ds:Reference URI="#Body">
						<ds:Transforms>
							<ds:Transform
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
						</ds:Transforms>
						<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
						<ds:DigestValue>EwE9/d/aFPCf7CpqoKdbHSrhNN0=</ds:DigestValue>
					</ds:Reference>
				</ds:SignedInfo>
				<ds:SignatureValue>
    				lCIbgyn1nzA/7Y2tAVQ+WuVTX/WoOKE0Xv1dOTDBJ+BIY1w6ulg17apQ2taLmfDHGEFtLOCO
    				TKdvhev5CMNCvmsbZQVv5Mli+ttFSpumNf8yOkf0BwDCcSyTVbuiotJJXOFVGRTXB5oxIv8q
    				UqY5QO3lZkO790OmUyBlpgWaWAE=
  				</ds:SignatureValue>
				<ds:KeyInfo>
					<wsse:SecurityTokenReference>
						<wsse:Reference
							URI="#binarytoken"
							ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
					</wsse:SecurityTokenReference>
				</ds:KeyInfo>
			</ds:Signature>
		</wsse:Security>
	</soapenv:Header>
	<soapenv:Body Id="Body">
		<getHolidays xmlns="http://transfer.as.com">
			<request>
				<ns3:regionID xmlns:ns3="http://shr.ws.com" xsi:nil="true"/>
				<cardNumber>4444</cardNumber>
			</request>
		</getHolidays>
	</soapenv:Body>
</soapenv:Envelope>


After the intermediary adds its element hopefully without altering the
signature and when I try to validate the signature on the provider end
I get signature verification failed. Now my question is, is it
expected behaviour that adding elements to the header by
intermediaries (ofcourse without modifying the signature) will break
the signature verification. Does canonicalization here will fail ? If
I dont have this intermediary then signature verification is
successfull. please suggest how to get around this problem.


Thanks in advance for your time and reply.

---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org