Questions tagged [ws-security]

WS-Security is an extension to SOAP for applying security to web-services through XML Signature and XML Encryption.

ws-security
Filter by
Sorted by
Tagged with
62 votes
3 answers
95k views

Correct way communicate WSSE Usernametoken for SOAP webservice

I am attempting to consume a web service through its corresponding wsdl. This service is dependent upon authentication conforming to Web Services Security Basic Security Profile 1.0 including that the ...
Chris Marisic's user avatar
47 votes
1 answer
61k views

Prevent XXE Attack with JAXB

Recently, we had a security audit on our code, and one of the problem is that our application is subject to the Xml eXternal Entity (XXE) attack. Basically, the application is a calculator that ...
Romain Linsolas's user avatar
44 votes
1 answer
691 views

In WCF/WIF how to merge up claims from two different client's custom sts's tokens

I'm trying to create something like: Client authenticates and gets token from custom STS1, next client authorizes with machine key and is issued token on custom STS2 and gets another token. With last ...
myrx's user avatar
  • 451
38 votes
10 answers
137k views

JAX-WS - Adding SOAP Headers

I am trying to create a standalone client to consume some web services. I must add my username and password to the SOAP Header. I tried adding the credentials as follows: OTSWebSvcsService service = ...
Jordan Allan's user avatar
  • 4,448
35 votes
4 answers
23k views

User/Pass Authentication using RESTful WCF & Windows Forms

What is the best approach to implementing authorisation/authentication for a Windows Forms app talking to an IIS-hosted RESTful WCF Service? The reason I ask is I am very confused, after sifting ...
GONeale's user avatar
  • 26.4k
34 votes
7 answers
86k views

Connecting to WS-Security protected Web Service with PHP

I am trying to connect to a Web Service which is password protected and the url is https. I can't figure out how to authenticate before the script makes a request. It seems like it makes a request as ...
Anthony's user avatar
  • 36.8k
27 votes
3 answers
96k views

Can not get key from KeyStore

I try to get Key from KeyStore. I created a keystore by Keytool: keytool -genkeypair -dname "cn=Mark Jones, ou=JavaSoft, o=Sun, c=US" -alias business2 -keypass abcdtest -keystore C:\workspace\...
MartinJoo's user avatar
  • 2,864
26 votes
2 answers
30k views

How to make WCF Client conform to specific WS-Security - sign UsernameToken and SecurityTokenReference

I need to create a wcf client to call a service that I have no control over. I have been given a wsdl and a working soapui project. The service uses both a username/password and a x509 certificate. ...
Steve B's user avatar
  • 483
23 votes
5 answers
14k views

Calling .NET Web Service (WSE 2/3, WS-Security) from Java

I need to call a web service written in .NET from Java. The web service implements the WS-Security stack (either WSE 2 or WSE 3, it's not clear from the information I have). The information that I ...
Michael Sharek's user avatar
22 votes
4 answers
162k views

Example of SOAP request authenticated with WS-UsernameToken

I'm trying to authenticate a SOAP request using WS-UsernameToken spec, but the target device is always denying access. My non-working request looks like this. (The password I'm trying to hash is ...
che's user avatar
  • 12.2k
22 votes
1 answer
839 views

Corresponding SOAP UI vs Spring-ws

Soap UI has the following option "Use single certificate for signing" what is the corresponding spring-ws config?
user48545's user avatar
  • 3,341
19 votes
2 answers
5k views

Rampart PostDispatchVerificationHandler: InvalidSecurity - Security policy not found

Edit: I tweaked the Rampart configuration a little and I am now stuck at another point. In Rampart's PostDispatchVerificationHandler an exception is thrown, because the security header hasn't been ...
Jonas's user avatar
  • 191
18 votes
2 answers
3k views

Policy for signing and encrypting

I need to implement a jax-ws client. Here is what the provider docs say about security Currently, we use the SOAP Message Security version 1.0 specification at http://docs.oasis-open.org/wss/...
ymajoros's user avatar
  • 2,552
18 votes
1 answer
6k views

Trying to digitally sign SOAP call with x.509 certificate in PHP

I'm working with a client, trying to send and receive soap calls using PHP. They have ws-security set up, and use an x.509 certificate for authentication. I have been able to get this to work using ...
MattA's user avatar
  • 181
17 votes
1 answer
1k views

Disable InclusiveNamespaces in axis/rampart client

I'm connecting to a webservice with axis/rampart and was told to remove the InclusiveNamespaces as the prefixList was "" which is not allowed. How do I do that? The part looks like <ds:SignedInfo&...
Perre's user avatar
  • 651
15 votes
3 answers
131k views

How to add soap header in java

i have a NO-.net webservice from oracle To access i need to add the soap header. How can i add the soap header in java? Authenticator.setDefault(new ProxyAuthenticator("username", "password")); ...
Luis's user avatar
  • 2,705
14 votes
3 answers
20k views

Error in WCF client consuming Axis 2 web service with WS-Security UsernameToken PasswordDigest authentication scheme

I have a WCF client connecting to a Java based Axis2 web service (outside my control). It is about to have WS-Security applied to it, and I need to fix the .NET client. However, I am struggling to ...
Rebecca's user avatar
  • 14.1k
13 votes
1 answer
20k views

Invoking a web service with WS Security from .NET

I need to consume a web service secured with WS-Security from ASP.NET. I'm testing the service with SoapUI, being the envelop request: <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/...
Diane's user avatar
  • 428
12 votes
2 answers
6k views

How to encrypt SOAP messages manually?

I use JBoss 4.2.3.GA. In previous task I've used base encryption mechanism which JBoss supports (WS-Security). I.e. I used keystore, truststore files for encryption and signing messages. As usually (...
Zaur_M's user avatar
  • 737
11 votes
1 answer
16k views

ONVIF Authentication in .NET 4.0 with Visual Studios 2010

My task is to try to establish a communication with a ONVIF camera in the building to, eventually, upgrade the company's domotic solution to automatically recognize ONVIF cameras and to be able to set ...
user704419's user avatar
11 votes
2 answers
28k views

Creating Headers (wsse) Section of WCF Client Programmatically in C#

how do make a the following section of Service Settings of app.config in C# programmatically: <client> <endpoint address="https://someServiceUrl" binding="basicHttpBinding" ...
user402186's user avatar
11 votes
2 answers
1k views

WCF Client consuming WS-Security webservice

I managed to consume a java based web service (third party) with WS-Security 1.1 protocol. The web service needs only to be signed over a x509 certificate, not encrypted. But I'm getting this error: ...
Gonzalo Lorieto's user avatar
10 votes
4 answers
19k views

Apache CXF - credentials not being sent from WSS4JOutInterceptor?

I am trying to connect to a web service using WS-Security UsernameToken spec 1.0, using apache cxf 2.4.0. I've copied the code below from the CXF docs, but am getting: org.apache.cxf.ws.policy....
bwsmith's user avatar
  • 175
10 votes
2 answers
26k views

Does WCF support WS-Security with SOAP 1.1?

I need to call some 3rd Web services that require WS-Security. I created a WCF endpoint with the following configuration: <system.serviceModel> <bindings> <wsHttpBinding> ...
Stefan Moser's user avatar
  • 6,813
10 votes
1 answer
16k views

how to implement ws-security 1.1 in php5

I'm trying to call a webservice with Soap in PHP5, for this, I need to use WS-Security 1.1. (In java and .NET this is all generated automatically.) Are there any frameworks available to generate ...
Sam Segers's user avatar
  • 1,951
10 votes
4 answers
8k views

WCF Service with WS-Security requires Signed Timestamp only

I need to provide a service to a third-party that will be sending soap messages with a signed Timestamp. How can I configure my service to support this? UPDATE I've managed to get close to the ...
Dog Ears's user avatar
  • 9,805
10 votes
3 answers
42k views

JAX-WS Consuming web service with WS-Security and WS-Addressing

I'm trying to develop a standalone Java web service client with JAX-WS (Metro) that uses WS-Security with Username Token Authentication (Password digest, nonces and timestamp) and timestamp ...
Jared Knipp's user avatar
  • 5,930
10 votes
1 answer
2k views

WSContext.getUserPrincipal() returns null for password digest authentication

In my WebService I need to log the caller's id, but wsContext.getUserPrincipal() returns null even though the user was authenticated using WS-Security with password authentication. According to the ...
Dean Schulze's user avatar
  • 9,881
9 votes
1 answer
7k views

Working algorithm for PasswordDigest in WS-Security

I'm having trouble with WS-Security, and creating a nonce and password digest that is correct. I am successfully using SoapUI to send data to an Oracle system. So I'm able to intercept SoapUI's call (...
Matt Kemp's user avatar
  • 2,840
9 votes
4 answers
28k views

How do you use TLS/SSL Http Authentication with a CXF client to a web service?

I'm trying to access a web service secured by a certificate. The security is setup on IIS and the web service is behind it. I don't think WS-SECURITY will do this type of authentication. Is there any ...
ScArcher2's user avatar
  • 86.6k
9 votes
1 answer
3k views

Securing REST endpoint using spring security

I am trying to provide security to the REST endpoints. I am following instructions from this page. In my case I don't have view hence I haven't created controller to specify the views and haven't ...
Kaizar Laxmidhar's user avatar
9 votes
1 answer
7k views

WCF Client - Specifying the signature algorithm for WS-Security Timestamp signature

I have a WCF client that is sending a message to a non-WCF service and that service is having problems handling the HMAC-SHA1 signature method used to sign the WS-Security Timestamp element. Ideally, ...
BearsEars's user avatar
  • 1,009
8 votes
2 answers
46k views

Adding SOAP:HEADER username and password with WSE 3.0

I have successfully created a WS client that works correctly when NOT using authentication. However, the server (WebSphere) now requires adding a ws-security username token, and I'm having a hard ...
csl's user avatar
  • 11.2k
8 votes
1 answer
8k views

Sign Soap 1.1 body with .Net Core 3.1

I want to connect from .Net Core 3.1 with C# to a web service that requires I sign the Soap 1.1 body according to WS-Security WS-Policy 2004/09. This is a textual description of the policy ...
Ulf Kristiansen's user avatar
8 votes
2 answers
18k views

With C#, WCF SOAP consumer that uses WSSE plain text authentication?

I have a WCF SOAP consumer that is implemented by Visual Studio 2012 from a WSDL. The WSDL was generated by PeopleTools. The base object is of type System.ServiceModel.ClientBase. I need the SOAP ...
Aren Cambre's user avatar
  • 6,570
8 votes
4 answers
11k views

How to create a soap client without WSDL

i need to visit a secure web service, every request in the header need to carry a token. i know the endpoint to the web service, i also know how to create the token. but i cannot see the WSDL for ...
jojo's user avatar
  • 13.7k
8 votes
2 answers
4k views

load balancing WCF with wsHttpBinding and Message Security with client credentials type windows

We have got a normal WCF service which has a binding that looks like this: <wsHttpBinding> <binding name="ServiceBinding" receiveTimeout="00:10:00" sendTimeout="00:10:00" ...
Bravo11's user avatar
  • 908
8 votes
1 answer
12k views

User authentication in SOAP Webservices

I made a question about JAX-WS, Authentication and Authorization - How to?; there was a discussion about security levels, and where to store user credentials. Now after some conclusions, I want to ...
lpinto.eu's user avatar
  • 2,107
8 votes
2 answers
3k views

Using WSSE plugin for Gsoap in C++/Linux

How can we implement WSSE plugin for Gsoap in C++/Linux ? This link doesn't give all the information. The problem is what do I have to include in my header file generated by WSDL , to make it wsse ...
Aditya Arora's user avatar
8 votes
5 answers
8k views

How do I build a secure webservice with .Net?

I need to build a simple webservice to get data in and out of a HR System over the Internet (it's a hosted solution). I am using IIS and ASP.Net with .Net 2.0. Having looked into it, there are ...
flytzen's user avatar
  • 7,408
8 votes
2 answers
2k views

Looking for java Library/API for implementing WS-Security for SOAP messages with Attachment(SwA) [closed]

I am implementing ebXML3.0 in java and looking for a java library/API I can use for Signing and Encryption of SOAP messages with attachment. Earlier I was using "Apache wss4j" but this seems to only ...
user1842997's user avatar
7 votes
1 answer
17k views

WS-Security not working with CXF

I' am trying to develop a WS-security enabled web service with Apache CXF. Tutorial that I am following is here. Unfortunately I am continuously getting the following error much to chagrin. I' am ...
nash's user avatar
  • 715
7 votes
2 answers
11k views

How to add ws-security header in .net core?

I'm trying to make a call to a webservice and want to manually add the ws-security headers into the request because .net core 2.2 currently does not support ws-security. I have created my custom ...
Ricardo Reais's user avatar
7 votes
2 answers
3k views

How to enable debug logging in Apache CXF before encrypting

I already have enabled debug logs for my WS-Client like this Client client = ClientProxy.getClient(port); LoggingInInterceptor loggingInInterceptor = new LoggingInInterceptor(); loggingInInterceptor....
Martin Fernau's user avatar
7 votes
2 answers
16k views

Validating a Signature of a SOAP Message

Everybody, Hello! This is my request message: <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Header> <wsse:Security xmlns:wsse="http://docs.oasis-open....
Dmitry's user avatar
  • 3,028
7 votes
2 answers
5k views

What is the best way to learn security in java A-Z [closed]

I am j2se/jee developer and new to java security side, and planning to learn more on this subject. Can you help me guiding with proper way/recources to learn security from beginner to intermediate ...
user avatar
7 votes
2 answers
5k views

WS-security (usernametoken) for CXF - encrypted passwords possible?

I'm trying to get together with CXF's WS-security implementation(usernametoken). I've done everything as said at http://cxf.apache.org/docs/ws-security.html. My PasswordCallbackHandler seems to be ...
Jan's user avatar
  • 138
7 votes
1 answer
13k views

How to get WS-Security certificate to be accepted by Java application

So I've been struggling with WS-Security for some time now, slowly making progress. First let me briefly describe my setup. I have Java application running in a tomcat, which offers a webservice ...
VHristov's user avatar
  • 1,059
7 votes
1 answer
6k views

Creating Signed SOAP Message as a String with C#

I need to call web service that I have to send such soap request below by using C#. SoapBody and TimeStamp must be signed. <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" ...
jQP's user avatar
  • 99
7 votes
2 answers
13k views

How to make WSS4J load the keystore password from a callback?

I'm using Apache CXF to build a Web Service. It uses Apache WSS4J to provide WS-Security functionality. I need to make a SOAP request and it must be signed. This is the content of the properties file ...
Alex Oliveira's user avatar

1
2 3 4 5
19