ws-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Colm O hEigeartaigh <cohei...@apache.org>
Subject Re: Validation failing due to empty namespace in tag
Date Mon, 05 Mar 2018 09:53:07 GMT
I'm not sure why you are seeing empty namespaces. Could you create a unit
test or some way of reproducing the problem that I can look at?

Colm.

On Sun, Mar 4, 2018 at 9:46 AM, Al Ramsey <aramsey@vecna.com> wrote:

> We’re currently trying to migrate WSS4J from version 1.6 to 2.0.1 but our
> integration tests to the service provider is now failing.  A highlighted
> overview is given below:
>
> • In the SignedInfo node, two references were hashed - (1) Timestamp, and
> (2) Body.  Validation of (1) the Timestamp SHA1 digest against the expected
> value passes, but it fails for (2) the Body.  WSS4J decrypts the Body
> successfully, but fails in the validation.
> • We made some changes with our WSS4J configuration based on the
> recommendations from the WSS4J Migration Guide (link:
> https://ws.apache.org/wss4j/migration/wss4j20.html).
> • When I manually removed an empty namespace in one of the tags, a manual
> check of the SHA1 digest appears to finally succeed.
> • WSS4J first decrypts the Body, then performs a canonical transformation
> prior to validation.  An empty namespace in one of the tags seem to show up
> in our application when we use WSS4J 2.0.1 but it does not show up when
> using WSS4J 1.6.
>
> An illustrative example: the decoded Body is:
>
> <results xmlns="" xmlns:a="http://ebs.health.ontario.ca/" xmlns:b="
> http://msa.ebs.health.ontario.ca/" xmlns:c="http://hcv.health.ontario.ca/"
> xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsu="
> http://docs.oasis-open.org/wss/2004/01/oasis-
> 200401-wss-wssecurity-utility-1.0.xsd"><auditUID>676345d6-
> 3fc4-434c-96b3-012c73672b6a</auditUID><results><healthNumber>1286844022</
> healthNumber><responseAction>Ask the cardholder to either visit the local
> ServiceOntario office or call 1 800-268-1154.</responseAction><
> responseCode>10</responseCode><responseDescription>The Health Number
> submitted does not exist on the ministry's system</responseDescription><
> responseID>FAILED_MOD10</responseID><versionCode>YX</
> versionCode></results></results>
>
> … and the Body after canonical transformation is:
>
> <soapenv:Body xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
> xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-
> 200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Body-42a8192d-3065-
> 451d-bfeb-1156ae118da4"><c:validateResponse xmlns:c="http://hcv.health.
> ontario.ca/"><results xmlns=""><auditUID>676345d6-
> 3fc4-434c-96b3-012c73672b6a</auditUID><results><healthNumber>1286844022</
> healthNumber><responseAction>Ask the cardholder to either visit the local
> ServiceOntario office or call 1 800-268-1154.</responseAction><
> responseCode>10</responseCode><responseDescription>The Health Number
> submitted does not exist on the ministry's system</responseDescription><
> responseID>FAILED_MOD10</responseID><versionCode>YX</
> versionCode></results></results></c:validateResponse></soapenv:Body>
>
> I had to manually change
>
> <results xmlns="">
>
> to the following:
>
> <results>
>
> A manual check of the SHA1 digest tells me it would now pass validation.
> I am not sure why the empty namespace appears when using WSS4J 2.0.1 and
> not 1.6.  Did I miss a configuration when updated  them?
>
>


-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

Mime
View raw message