ws-fx-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
Subject RE: signature verification sample programs
Date Thu, 06 May 2004 12:29:09 GMT
Thank you very much for your investigation!!!
Actually I want to carry out webservices message level security only. My axis client or .NET
client will send a signed soap request to my webservice. My webservice contains an axis handler,
which acts as an interceptor and carries out signature verification using XML security APIs.
The whole set up is working fine as long as my soap client uses axis and XML signature APIs
for sigining the request. The signature verification fails when .NET client sends the signed
request. So I have decided to use WSS4J thinking that the interoperability issue will be solved.
But to startwith, I am trying to develop a standalone program, that verifies the integrity
of XML message. [I can avert application server start, shut down/ service deploy, time being].
Do you think WSS4J will solve my problem? [I think NOT because WSS4J does any how use XML
security only for signature verification]
Thanks & regards,

-----Original Message-----
From: Christof Soehngen [mailto:Christof.Soehngen@SYRACOM.DE]
Sent: Thursday, May 06, 2004 5:40 PM
Subject: RE: signature verification sample programs

Hello Ayyappan,
after looking at your test program, I wasn't quite sure what you want to do. I then read again
your first post:

> Since I have had .NET client interoperablity issue
> with Apache XML security, I am trying to use
> WSS4J for signature verification. WSS4J home page says

and I think I understand now: You want to verify a signed XML document (i.e. file)?

If this is the case, then WSS4J won't help you. WSS4J is a framework for Apache Axis that
implements the WS-Security specification (Security for Web Services). It USES the Apache XML
Security project to handle the XML documents transmitted.
If you have had interoperability issues with Apache XML Security, then chances are that WSS4J
won't work either. Besides, WSS4J is a huge overhead, if you are not interested in Web Services
at all.
Please correct me if I didn't understand the situation ...

View raw message