Mailing-List: contact wss4j-dev-help@ws.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (nike.apache.org: local policy)
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Subject: RE: [jira] Created: (WSS-200) Compliance with X.509 Certificate Token
 Profile
Date: Thu, 18 Jun 2009 12:17:42 +0200
Message-ID: 
 <D1FA621591E24549BA3C339EC9C2BC7201E74969@DEMUEXC014.nsn-intra.net>
In-Reply-To: <2028293959.1245261247437.JavaMail.jira@brutus>
Thread-Topic: [jira] Created: (WSS-200) Compliance with X.509 Certificate
 Token Profile
Thread-Index: AcnvdTmmpM76IIfZQ9mkP1CUR5rwqgAh/EBA
References: <2028293959.1245261247437.JavaMail.jira@brutus>
From: "Dittmann, Werner (NSN - DE/Munich)" <werner.dittmann@nsn.com>
To: =?iso-8859-1?Q?ext_Mattias_Sj=F6l=E9n_=28JIRA=29?= <jira@apache.org>,
        <wss4j-dev@ws.apache.org>

WSS4J support several key identifier types, for example
SKI (Subject Key Identifier), X509v3, thumbprint and
others. It is the task of the software that uses WSS4J
library to select the key identifier type, thus the
"Java based tool om Windows" sould set the correct
parameters. Where do you (or the "tool") specify which
key identifier type (profile) to use?

Regards,
Werner

> -----Original Message-----
> From: ext Mattias Sj=F6l=E9n (JIRA) [mailto:jira@apache.org]=20
> Sent: Wednesday, June 17, 2009 7:54 PM
> To: wss4j-dev@ws.apache.org
> Subject: [jira] Created: (WSS-200) Compliance with X.509=20
> Certificate Token Profile
>=20
> Compliance with X.509 Certificate Token Profile
> -----------------------------------------------
>=20
>                  Key: WSS-200
>                  URL: https://issues.apache.org/jira/browse/WSS-200
>              Project: WSS4J
>           Issue Type: Bug
>           Components: WSS4J Core
>     Affects Versions: 1.5.7
>          Environment: I have been running a Java based tool=20
> om Windows that have wss4j-1.5.7.jar in it's lib folder so I=20
> quess that WSS4J is used internaly by the tool.
>             Reporter: Mattias Sj=F6l=E9n
>             Assignee: Ruchith Udayanga Fernando
>=20
>=20
> Chapter "3.2.1 Reference to an X.509 Subject Key Identifier"=20
> in the "Certificate Token Profile 1.1" specification states=20
> the following - "The <wsse:KeyIdentifier> element MUST have a=20
> ValueType attribute with the value #X509SubjectKeyIdentifier=20
> and its contents MUST be the value of the certificate's=20
> X.509v3 SubjectKeyIdentifier extension, encoded as per the=20
> <wsse:KeyIdentifier> element's EncodingType attribute."
>=20
> The tool I use signs an outgoing xml according to the=20
> specified policy and it will then contain the following tags:
> <wsse:SecurityTokenReference wsu:Id=3D"STRId-14A576A8..."=20
> xmlns:wsu=3D"http://docs.oasis-open.org/wss/2004/01/oasis-200401
> -wss-wssecurity-utility-1.0.xsd">
>   <wsse:KeyIdentifier=20
> EncodingType=3D"http://docs.oasis-open.org/wss/2004/01/oasis-200
401-wss-soap-message-security-1.0#Base64Binary" > =
ValueType=3D"http://docs.oasis-open.org/wss/2004/01/oasis-200401
> -wss-x509-token-profile-1.0#X509v3">
>     MIIEFzCCAv+gA...
>   </wsse:KeyIdentifier>
> </wsse:SecurityTokenReference>
>=20
> Notice that the ValueType for the KeyIdentifier is #X509v3=20
> instead of #X509SubjectKeyIdentifier
> ValueType=3D"http://docs.oasis-open.org/wss/2004/01/oasis-200401
> -wss-x509-token-profile-1.0#X509v3"
>=20
> If I perform a Base64Decode on the value inside tha tag it=20
> contains a X.509 Certifikate and not a Subject Key Identifier
>=20
> --=20
> This message is automatically generated by JIRA.
> -
> You can reply to this email to add a comment to the issue online.
>=20
>=20
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
> For additional commands, e-mail: wss4j-dev-help@ws.apache.org
>=20
>=20

---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org