: Including BinarySecurityToken in the SOAP header

[Gina Choi]

Hi Brent,

Thanks for your responses. 

>I don't know what you need to sign.  As Scott noted earlier, this isn't
>a WS-* support list.  You need to consult the specs for the profile(s)
>that you are implementing, or interop guides for the recipient software,
>or another list where people discuss these sorts of specification and
>conceptual issues.  Once you know *what* you need to do, we can help you
>with questions about *how* to do that with OpenSAML.


I try to use X.509 Token Profile
1.1(http://www.oasis-open.org/committees/download.php/16785/wss-v1.1-spec-os-
x509TokenProfile.pdf
) of the ws 1.3 specification to authenticate client. My ADFS has a
corresponding end point which is
https://strts01.ams.dev/adfs/services/trust/13/certificate. Do you have a
test case similar to this to look at?

Thanks.
Gina

------------------------------

Message: 8
Date: Tue, 27 Mar 2012 17:39:08 -0400
From: Brent Putman <putmanb at georgetown.edu>
Subject: Re: Including BinarySecurityToken in the SOAP header
To: dev at shibboleth.net
Message-ID: <4F72337C.7030901 at georgetown.edu>
Content-Type: text/plain; charset=ISO-8859-1



On 3/26/12 6:47 PM, Gina Choi wrote:
> Hi,
> 
> I am planning to add BinarySecurityToken in the SOAP header like
> bellow(http://docs.oasis-open.org/ws-sx/ws-trust/200512/ws-trust-1.3-os.pdf
> Line 1630-1669). Do I need to sign RequestSecurityToken or Sign Soap Body
> with the certificate referenced in BinarySecurityToken? 


I don't know what you need to sign.  As Scott noted earlier, this isn't
a WS-* support list.  You need to consult the specs for the profile(s)
that you are implementing, or interop guides for the recipient software,
or another list where people discuss these sorts of specification and
conceptual issues.  Once you know *what* you need to do, we can help you
with questions about *how* to do that with OpenSAML.


> What is Base64 encode
> value specified inside BinarySecurityToken(MIIEZzCCA9CgAwIBAgIQEmtJZc0...)
is
> about?


IIRC, that element can carry just about any kind of token, as declared
by its ValueType.  In the example below, looks like it illustrates a
encoded X.509 certificate.  The key/token types that are valid for
signing will be determined by the profile/specification that you're
implementing, or at least implicitly by what the receiver software
expects/supports.




> 
> <S11:Envelope xmlns:S11="..." xmlns:wsse="..."
> 		xmlns:wsu="..." xmlns:wst="...">
> 	<S11:Header> 
> 		 ... 
> 		<wsse:Security>
> 			<wsse:BinarySecurityToken wsu:Id="reqToken"
> ValueType="...X509v3">
> 				MIIEZzCCA9CgAwIBAgIQEmtJZc0...
> 			</wsse:BinarySecurityToken>
> 				<ds:Signature xmlns:ds="...">  ...  
> 					<ds:KeyInfo>
> 						<wsse:SecurityTokenReference>
> 							<wsse:Reference
> URI="#reqToken"/>
> 	
> </wsse:SecurityTokenReference>
> 					</ds:KeyInfo>
> 				</ds:Signature>
> 		</wsse:Security>
> 
> Thanks.
> 
> Gina
> --
> To unsubscribe from this list send an email to
dev-unsubscribe at shibboleth.net


------------------------------

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net

End of dev Digest, Vol 9, Issue 25
**********************************