Mtom enable + signiture = problem
Hi , I have an mtom web service (data plus attachment). WhenI sign the request ( with Mtom NOT enabled) with sha1 certificate certificate works (ws fails later due to attachment not being mtom)....
Forum Discussion
Yes this helps a Great Deal ! Thanks, this solution works, I find I have to attach the file using the original WSDL format
example first in order to set the Attachment Part to the generated partnumber (in example below) 147612301643 here:
<payload>cid:147612301643</payload>
Then once the file is attached, change this line in the request message to the following format (your example correct as is :)
<payload><inc:Include href="cid:147612301643" xmlns:inc="http://www.w3.org/2004/08/xop/include"/></payload>
DataPower then does then successfully verify the signed message/attachment - Presumably the problem we're fixing is a minor bug in SOAPUI signing-MTOM-attachments, which needs to be addressed in a future release.
Many thanks for your speedy reply...
Regards Gavin Bayfield
Still confused around whether the SOAUP MTOM Client we have 'working' is ACTUALLY Signing the Attachment Or Not ?
On the Server side, we're successfully Verifying the SOAP WSSEC Digital Signature passed in, but suspect the Enclosed Attachment is NOT part of the SOAPUI-Generated Signature- in other words, SOAPUI is/can ONLY in effect sign the Body (so the XML Infoset being processed does not include a Base64Binary component representing the attachment) ??
Can SmartBear pls clarify the Signing Attachment Capabilities for MTOM Support in SOUPUI please ??
Regards Gavin Bayfield
Hi all,
from what I can see in the code you are correct with the assessment that SoapUI does that signing before it modifies the message for MTOM (i.e. moves the binary content to a separate multipart) - which makes the signature invalid. Perhaps SoapUI should perform the MTOM processing before signing the request - although that would result in the MTOM multipart not being signed itself.
I'm not sure what the actual rules for MTOM/WSS are; could it be that the server should first "inline" the MTOM attachment before validating the signature (which it doesn't seem to be doing)?
I'll dig around a little more online...
/Ole
