questions about ExtractUsernamePasswordFromWssToken

[Tom Zeller]

(Scott had asked me about his AuthN work and this is the somewhat
related reply.)

I was looking at ExtractUsernamePasswordFromWssToken and an iterator
caught my attention, mostly because I try not to use iterators. Lines
117 -125.

My question was : does the WS-Security UsernameToken Profile 1.1 allow
more than one <Password/> element to be present ? Probably not, based
on the, err, spec, so I went looking for a schema, but did not find
one. So the next question is : how do I find out for sure ? And then,
should I really care ?

I looked for the V2 analogy but did not find it, and wondered where
should I look in V2 ?

I also wondered if the cast on line 120 is safe, I think so, but have
a note to verify.

This kind of thing happens to me alot.