From dev-return-9925-apmail-ws-dev-archive=ws.apache.org@ws.apache.org Mon Nov 01 22:32:23 2010 Return-Path: Delivered-To: apmail-ws-dev-archive@www.apache.org Received: (qmail 94490 invoked from network); 1 Nov 2010 22:32:15 -0000 Received: from unknown (HELO mail.apache.org) (140.211.11.3) by 140.211.11.9 with SMTP; 1 Nov 2010 22:32:15 -0000 Received: (qmail 72575 invoked by uid 500); 1 Nov 2010 22:32:45 -0000 Delivered-To: apmail-ws-dev-archive@ws.apache.org Received: (qmail 72373 invoked by uid 500); 1 Nov 2010 22:32:45 -0000 Mailing-List: contact dev-help@ws.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@ws.apache.org Delivered-To: mailing list dev@ws.apache.org Received: (qmail 72365 invoked by uid 99); 1 Nov 2010 22:32:45 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 22:32:45 +0000 X-ASF-Spam-Status: No, hits=-2000.0 required=10.0 tests=ALL_TRUSTED X-Spam-Check-By: apache.org Received: from [140.211.11.22] (HELO thor.apache.org) (140.211.11.22) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Nov 2010 22:32:44 +0000 Received: from thor (localhost [127.0.0.1]) by thor.apache.org (8.13.8+Sun/8.13.8) with ESMTP id oA1MWOi0018716 for ; Mon, 1 Nov 2010 22:32:24 GMT Message-ID: <28914261.183531288650744033.JavaMail.jira@thor> Date: Mon, 1 Nov 2010 18:32:24 -0400 (EDT) From: "Colm O hEigeartaigh (JIRA)" To: dev@ws.apache.org Subject: [jira] Commented: (WSS-239) Need ability to handle password "equivalent" between WSPasswordCallback and UsernameToken when it's binary data MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/WSS-239?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12927189#action_12927189 ] Colm O hEigeartaigh commented on WSS-239: ----------------------------------------- Hi Patrick, The intent of the patch you submitted is different from the original patch as supplied by Jim. The original patch is to handle this kind of computation: base64(sha-1(nonce+created+sha-1(password))) whereas your patch handles this scenario: base64(sha-1(nonce+created+base64(sha-1(password)))) According to the link Jim provided (http://lists.oasis-open.org/archives/wss-dev/201006/msg00003.html) it is incorrect to Base64 the binary data (sha-1(password)). It would probably be better to modify the existing code to accomadate setting the password as binary data. Colm. > Need ability to handle password "equivalent" between WSPasswordCallback and UsernameToken when it's binary data > --------------------------------------------------------------------------------------------------------------- > > Key: WSS-239 > URL: https://issues.apache.org/jira/browse/WSS-239 > Project: WSS4J > Issue Type: Improvement > Components: WSS4J Core > Affects Versions: 1.5.8 > Reporter: Jim Utter > Assignee: Ruchith Udayanga Fernando > Attachments: WSS-239-1_5_x-fixes.patch, wss4j-1.5.9-password-equivalence.patch > > > Per the oasis spec, the UsernamePassword is summarized by the algorithm: > base64(sha-1(nonce+created+password)) > But, in some scenarios you don't store cleartext passwords - only the sha-1 hash > of them. The oasis spec allows this via what they claim as "..password > equivalent". The problem I'm running into is that the password equivalent > is sha-1(password) or ultimately this equivalent: > base64(sha-1(nonce+created+sha-1(password))) > When the applicability of this approach was questioned to the oasis list, > they confirmed it: > http://lists.oasis-open.org/archives/wss-dev/201006/msg00003.html > But, when using the wss4j WSPasswordCallback mechanism, the call expects the > password to be a string but the binary output of the digest if converted to > a string, then back to the bytes (by UsernameToken.doPasswordDigest()) does > not result in the original byte array - causing any digest calculations to > fail. > This was originally posted in the mailing list below where Colm suggested I provide a patch: > http://mail-archives.apache.org/mod_mbox/ws-wss4j-dev/201006.mbox/%3CAANLkTilnDI8iJOpHC6Lgv3mkP5_I_UtrcFeNdkDK1BA0@mail.gmail.com%3E -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online.