Mailing-List: contact issues-help@cxf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cxf.apache.org
Date: Thu, 13 Oct 2016 14:04:20 +0000 (UTC)
From: "Grzegorz Maczuga (JIRA)" <jira@apache.org>
To: issues@cxf.apache.org
Message-ID: <JIRA.13011933.1476349447000.817144.1476367460462@Atlassian.JIRA>
In-Reply-To: <JIRA.13011933.1476349447000@Atlassian.JIRA>
References: <JIRA.13011933.1476349447000@Atlassian.JIRA> <JIRA.13011933.1476349447397@arcas>
Subject: [jira] [Commented] (CXF-7088) SignedEncryptedSupportingTokens in
 WS-Policy and SAML not encrypted being accepted
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Thu, 13 Oct 2016 14:04:22 -0000


    [ https://issues.apache.org/jira/browse/CXF-7088?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15572015#comment-15572015 ] 

Grzegorz Maczuga commented on CXF-7088:
---------------------------------------

That is highly possible! Please close it.
Thanks Colm.

Greg

> SignedEncryptedSupportingTokens in WS-Policy and SAML not encrypted being accepted
> ----------------------------------------------------------------------------------
>
>                 Key: CXF-7088
>                 URL: https://issues.apache.org/jira/browse/CXF-7088
>             Project: CXF
>          Issue Type: Bug
>    Affects Versions: 3.0.6
>            Reporter: Grzegorz Maczuga
>            Assignee: Colm O hEigeartaigh
>         Attachments: message_anonymous.txt, policy.txt
>
>
> In WS-Policy that is used by service we have defined 
> <SignedEncryptedSupportingTokens/>
> Some people say that WS-SecurityPolicy 1.2 imply that also SAML assertion that is inside WS-Security section of the message SOAP Header should be encrypted (not only signed).
> Message with SAML that is NOT encrypted is currently accepted by CXF even while policy defines <SignedEncryptedSupportingTokens/>
> Question is: does SAML assertion fall into "SupportingTokens" category and should be encrypted as well?
> What is your view on that? Is that a bug in Neethi?
> See http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/ws-securitypolicy-1.2-spec-os.html#_Toc161826566
> Signed, encrypted supporting tokens are Signed supporting tokens (See section 8.2) that are also encrypted when they appear in the wsse:SecurityHeader. Element Encryption SHOULD be used for encrypting the supporting tokens.
> The syntax for the sp:SignedEncryptedSupportingTokens differs from the syntax of sp:SignedSupportingTokens only in the name of the assertion itself. All nested policy is as per the sp:SignedSupportingTokens assertion.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)