Return-Path: 
 <dev-return-13694-apmail-ws-dev-archive=ws.apache.org@ws.apache.org>
X-Original-To: apmail-ws-dev-archive@www.apache.org
Delivered-To: apmail-ws-dev-archive@www.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id C6C59DE93
	for <apmail-ws-dev-archive@www.apache.org>;
 Wed,  5 Sep 2012 14:49:08 +0000 (UTC)
Received: (qmail 46366 invoked by uid 500); 5 Sep 2012 14:49:08 -0000
Delivered-To: apmail-ws-dev-archive@ws.apache.org
Received: (qmail 46050 invoked by uid 500); 5 Sep 2012 14:49:07 -0000
Mailing-List: contact dev-help@ws.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:dev-help@ws.apache.org>
List-Unsubscribe: <mailto:dev-unsubscribe@ws.apache.org>
List-Post: <mailto:dev@ws.apache.org>
List-Id: <dev.ws.apache.org>
Reply-To: dev@ws.apache.org
Delivered-To: mailing list dev@ws.apache.org
Received: (qmail 46042 invoked by uid 99); 5 Sep 2012 14:49:07 -0000
Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 05 Sep 2012 14:49:07 +0000
Date: Thu, 6 Sep 2012 01:49:07 +1100 (NCT)
From: "Colm O hEigeartaigh (JIRA)" <jira@apache.org>
To: dev@ws.apache.org
Message-ID: <1899924383.39205.1346856547877.JavaMail.jiratomcat@arcas>
Subject: [jira] [Commented] (WSS-231) There is an issue with the position of
 the <Timestamp> element in the <Security> header when using  WSS4J calling
 .NET Web Services with WS-Security.
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394


    [ https://issues.apache.org/jira/browse/WSS-231?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13448795#comment-13448795 ] 

Colm O hEigeartaigh commented on WSS-231:
-----------------------------------------


There are huge changes in 1.6.x compared to 1.5.x. No, of course it is not safe to use a SNAPSHOT jar in a production environment.

Colm.
                
> There is an issue with the position of the <Timestamp> element in the <Security> header when using  WSS4J calling .NET Web Services with WS-Security.  
> -------------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: WSS-231
>                 URL: https://issues.apache.org/jira/browse/WSS-231
>             Project: WSS4J
>          Issue Type: Bug
>          Components: WSS4J Core
>    Affects Versions: 1.5.8
>         Environment: Windows, Solaris
>            Reporter: Chris Weitner
>            Assignee: Colm O hEigeartaigh
>              Labels: timestamp, ws-security
>             Fix For: 1.6.8
>
>         Attachments: patch.txt
>
>
> There is an issue with the position of the <Timestamp> element in the <Security> header when using  WSS4J calling .NET Web Services with WS-Security.  When using the "Timestamp Signature" action over https, we are receiving the following error: "Signing without primary signature requires timestamp".   When I modified org.apache.ws.security.message.WSSecSignature to position <Timestamp> as the first element in <Security> it worked fine (by default <Timestamp> is the last element and after the <Signature>).  Can this be fixed or can you make Timestamp positioned first as a configuration option?
> <soapenv:Header>
>   <wsse:Security>
>  
>     <wsu:Timestamp>
>       <wsu:Created>2010-05-06T16:46:31.594Z</wsu:Created>
>       <wsu:Expires>2010-05-06T16:51:31.594Z</wsu:Expires>
>     </wsu:Timestamp>
>  
>     <wsse:BinarySecurityToken</wsse:BinarySecurityToken>
>  
>     <ds:Signature>
>        ....
>     </ds:Signature>
>   </wsse:Security>
> </soapenv:Header>

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org