Re: Ordering of Signatures and Encryption
From: Govind Ramanathan (govindr_at_microsoft.com)
Date: 06/02/04
- Next message: Govind Ramanathan: "Re: SOAP header Security was not understood."
- Previous message: jarmo: "UsernameTokenManager error"
- In reply to: Softwaremaker: "Re: Ordering of Signatures and Encryption"
- Next in thread: Sidd: "Re: Ordering of Signatures and Encryption"
- Reply: Sidd: "Re: Ordering of Signatures and Encryption"
- Messages sorted by: [ date ] [ thread ]
Date: Wed, 2 Jun 2004 06:47:26 -0700
I think you are getting yourself into a tight loop here. If you don't want
the service to send back the Username token you might want to do it using a
custom filter or implementing your own TokenManager.
"Softwaremaker" <msdn@removethis.softwaremaker.net> wrote in message
news:uEpb$JFSEHA.1644@TK2MSFTNGP09.phx.gbl...
> Just in case I have lost everyone here reading this :-
>
> What I am trying to say is that :
>
> With WS-Policy, if we sent a PasswordOption.SendPlainText to the Service
and
> we modifed the Policy Assertions to Encrypt the UsernameToken with X509
> (Server's Public Key), it is of relatively little use because (as in Task
4
> of Exercise C in HOL-WSE02)
>
> 1) The Service have to assume that not all clients have their X509 Certs
and
> the Service also will NOT have all the Clients' Public Keys with them.
> 2) In the Response Policy Assertion from the Service to the Client, the
> Service will attempt to Encrypt the SOAP Body with the UsernameToken.
> 3) The UsernameToken will then be sent back from the Service to the client
> in CLEAR TEXT for Referencing Purpose
> 4) The Service CANNOT encrypt the UsernameToken with the UsernameToken as
> this will generate an Exception
>
> The only way to do this is to SendHashed over and have the Policy encrypt
> the Request for us BUT Ultimately, the Service will still send back the
> decrypted version of the UsernameToken back to the client (albeit the
> Password is still hashed).
>
> How can I get the Service to NOT send the UsernameToken back or to send an
> Ecrypted version of the UsernameToken back ? Which I think is quite
> difficult as the client needs the UsernameToken to decrypt the SOAP Body.
>
> Any advice, ppl ?
>
> Thank you very much.
>
> ====================================
>
>
> "Softwaremaker" <msdn@removethis.softwaremaker.net> wrote in message
> news:3D1D318F-344F-4069-85F9-8E9BFB2B6BCB@microsoft.com...
> > Hiya Fellows,
> >
> > I may be running into a brick wall with this design BUT I will try out
the
> limits of WSE anyways
> >
> > I have both a service and a client policy that dictates a Request Policy
> of "Sign-Username-Encrypt-X.509-10". The username token is not signed in
> this aspect but the SOAP Body and the UsernameToken are. That went on
well.
> >
> > I also have a service and a client policy that dictates a Response
Policy
> of "Sign-X.509-Encrypt-Username". This went on well UNTIL I modified the
> policy and forced the UsernameToken to be encrypted as well. This threw an
> error that says vaguely about "Ordering" during the Server to Client
> Response message.
> >
> > From my own deductions,
> > This is how it happens:
> > 1) WSE signs with Private Key of Server Cert
> > 2) Server encrypts UsernameToken and SOAPBody with UsernameToken Key -
> Does an exception even happen here in the first place ?
> > 3) Client receives the message
> > 4) Client cannot encrypt the UsernameToken as the UsernameToken Key is
all
> Encrypted - Am I right ?
> >
> > So, in the same scenario, how would the server respond to encrypt the
SOAP
> Body then without the need for a Usertoken, bearing in mind that the
client
> probably doesnt have their own X509 Cert. If the UsernameToken is employed
> for encryption, the server sends the UsernameToken in clear back to the
> client. How do we encrypt that ?
> >
> > I hope I at least make some sense here ;)
> >
> > Thank you.
>
>
- Next message: Govind Ramanathan: "Re: SOAP header Security was not understood."
- Previous message: jarmo: "UsernameTokenManager error"
- In reply to: Softwaremaker: "Re: Ordering of Signatures and Encryption"
- Next in thread: Sidd: "Re: Ordering of Signatures and Encryption"
- Reply: Sidd: "Re: Ordering of Signatures and Encryption"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
