Forum Discussion

evilSteve's avatar
evilSteve
New Contributor
11 years ago

Encrypt the sign and the body

Hi, i've a problem with the encryption of both sign and body of a soap message. What i want to do is: Includes a timestamp All headers are signed along with the timestamp Signature encry...
evilSteve's avatar
evilSteve
New Contributor
11 years ago
I almost forgot to post the services.xml


 <parameter name="useOriginalwsdl">false</parameter>
 <parameter name="modifyUserWSDLPortAddress">true</parameter>
 <operation name="getDeviceTEST">
 <module ref="rampart" />
 <module ref="rahas" />
 <module ref="addressing" />

 <wsp:Policy
    wsu:Id="SecConvPolicy"
    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
    xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
    <wsp:ExactlyOne>
   <wsp:All>

     <sp:SymmetricBinding xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
    <wsp:Policy>

      <sp:ProtectionToken>
     <wsp:Policy>
       <sp:SecureConversationToken
      sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
      <wsp:Policy>
        <sp:RequireDerivedKeys />
        <sp:BootstrapPolicy>
       <wsp:Policy>

         <sp:EncryptedParts>
        <sp:Body />
         </sp:EncryptedParts>

         <sp:SymmetricBinding>
        <wsp:Policy>
          <sp:ProtectionToken>
         <wsp:Policy>
           <sp:X509Token
          sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Never">
          <wsp:Policy>
            <sp:RequireDerivedKeys />
            <sp:RequireThumbprintReference />
            <sp:WssX509V3Token10 />
          </wsp:Policy>
           </sp:X509Token>
         </wsp:Policy>
          </sp:ProtectionToken>
          <sp:AlgorithmSuite>
         <wsp:Policy>
           <sp:Basic128Rsa15 />
         </wsp:Policy>
          </sp:AlgorithmSuite>
          <sp:Layout>
         <wsp:Policy>
           <sp:Strict />
         </wsp:Policy>
          </sp:Layout>
          <sp:IncludeTimestamp />
          <sp:EncryptSignature />
          <sp:OnlySignEntireHeadersAndBody />
        </wsp:Policy>
         </sp:SymmetricBinding>

         <sp:EndorsingSupportingTokens>
        <wsp:Policy>
          <sp:X509Token
         sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
         <wsp:Policy>
           <sp:RequireThumbprintReference />
           <sp:WssX509V3Token10 />
         </wsp:Policy>
          </sp:X509Token>
        </wsp:Policy>
         </sp:EndorsingSupportingTokens>

         <sp:Wss11>
        <wsp:Policy>
          <sp:MustSupportRefKeyIdentifier />
          <sp:MustSupportRefIssuerSerial />
          <sp:MustSupportRefThumbprint />
          <sp:MustSupportRefEncryptedKey />
          <sp:RequireSignatureConfirmation />
        </wsp:Policy>
         </sp:Wss11>

         <sp:Trust10>
        <wsp:Policy>
          <sp:MustSupportIssuedTokens />
          <sp:RequireClientEntropy />
          <sp:RequireServerEntropy />
        </wsp:Policy>
         </sp:Trust10>

       </wsp:Policy>
        </sp:BootstrapPolicy>
      </wsp:Policy>
       </sp:SecureConversationToken>
     </wsp:Policy>
      </sp:ProtectionToken>

      <sp:AlgorithmSuite>
     <wsp:Policy>
       <sp:Basic128Rsa15 />
     </wsp:Policy>
      </sp:AlgorithmSuite>

      <sp:Layout>
     <wsp:Policy>
       <sp:Strict />
     </wsp:Policy>
      </sp:Layout>

      <sp:IncludeTimestamp />
      <sp:EncryptSignature />
      <sp:OnlySignEntireHeadersAndBody />

    </wsp:Policy>
     </sp:SymmetricBinding>

     <sp:Wss11 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
    <wsp:Policy>
      <sp:MustSupportRefKeyIdentifier />
      <sp:MustSupportRefIssuerSerial />
      <sp:MustSupportRefThumbprint />
      <sp:MustSupportRefEncryptedKey />
    </wsp:Policy>
     </sp:Wss11>

     <sp:Trust10 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
    <wsp:Policy>
      <sp:MustSupportIssuedTokens />
      <sp:RequireClientEntropy />
      <sp:RequireServerEntropy />
    </wsp:Policy>
     </sp:Trust10>

     <sp:EncryptedParts xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
    <sp:Body />
     </sp:EncryptedParts>
     
     <ramp:RampartConfig xmlns:ramp="http://ws.apache.org/rampart/policy">
      <ramp:user>tomcat-sv</ramp:user>
      <ramp:encryptionUser>tomcat-cl</ramp:encryptionUser>
      <ramp:passwordCallbackClass>it.evil.wam.PWCallback</ramp:passwordCallbackClass>

      <ramp:signatureCrypto>
       <ramp:crypto provider="org.apache.ws.security.components.crypto.Merlin">
        <ramp:property name="org.apache.ws.security.crypto.merlin.keystore.type">JKS</ramp:property>
        <ramp:property name="org.apache.ws.security.crypto.merlin.file">/home/evil/server.keystore</ramp:property>
        <ramp:property name="org.apache.ws.security.crypto.merlin.keystore.password">*_KeyPass_*</ramp:property>
       </ramp:crypto>
      </ramp:signatureCrypto>

      <ramp:encryptionCypto>
       <ramp:crypto provider="org.apache.ws.security.components.crypto.Merlin">
        <ramp:property name="org.apache.ws.security.crypto.merlin.keystore.type">JKS</ramp:property>
        <ramp:property name="org.apache.ws.security.crypto.merlin.file">/home/evil/server.keystore</ramp:property>   
        <ramp:property name="org.apache.ws.security.crypto.merlin.keystore.password">*_KeyPass_*</ramp:property>
       </ramp:crypto>
      </ramp:encryptionCypto>
     </ramp:RampartConfig>

   </wsp:All>
    </wsp:ExactlyOne>
  </wsp:Policy>

  <parameter name="sct-issuer-config">
    <sct-issuer-config>
   <cryptoProperties>
     <crypto provider="org.apache.ws.security.components.crypto.Merlin">
    <property name="org.apache.ws.security.crypto.merlin.keystore.type">JKS</property>
    <property name="org.apache.ws.security.crypto.merlin.file">/home/evil/server.keystore</property>
    <property name="org.apache.ws.security.crypto.merlin.keystore.password">*_KeyPass_*</property>
     </crypto>
   </cryptoProperties>
   <addRequestedAttachedRef />
   <addRequestedUnattachedRef />

   <!--
     Key computation mechanism
     1 - Use Request Entropy
     2 - Provide Entropy
     3 - Use Own Key
   -->
   <keyComputation>3</keyComputation>

   <!--
     proofKeyType element is valid only if the keyComputation is set to 3
     i.e. Use Own Key

     Valid values are: EncryptedKey & BinarySecret
   -->
   <proofKeyType>BinarySecret</proofKeyType>
    </sct-issuer-config>
  </parameter>

  <parameter name="token-canceler-config">
    <token-canceler-config>

    </token-canceler-config>
  </parameter>
 </operation>


maybe i'm using the wrong namespace for the signature?