-----Original Message----- From: Vishal Mahajan [mailto:Vish...@Sun.COM] Sent: Thursday, January 27, 2005 6:55 AM To: use...@jwsdp.dev.java.net Subject: Re: Encrypting and Signing SOAP Messages With UsernameToken

Hi Mark,

The code below indicates that your requirement is to be able to sign and encrypt the username token being sent along with the soap request. You can do this very easily using xws-security by associating the following security configuration file with the requester:

<xwss:SecurityConfiguration xmlns:xwss= <http://java.sun.com/xml/ns/xwss/config> "http://java.sun.com/xml/ns/xwss/config">

<xwss:UsernameToken name="m_userid" password="m_password" id="token"/>

<xwss:Sign> <Target type="uri">#token</Target> </xwss:Sign>

<xwss:Encrypt> <X509Token certificateAlias="receiver_cert_alias"/> <Target type="uri">#token</Target> </xwss:Encrypt>

</xwss:SecurityConfiguration>

For more details on the usage of security configuration files, please consult the JWSDP tutorial.

Vishal

Mark Mesich wrote:

Hey Vishal,

Thanks for getting back to me. In .Net you can use a UsernameToken to sign and encrypt messages as well. The following code demonstrates what I would like to do in Java. (I have changed the names of the service and methods for readability.)

// Get a reference to the service. Service service = new Service();

// Create a username token and add it to the service. UsernameToken token = new UsernameToken( m_userID, m_password, PasswordOption.SendHashed ); service.RequestSoapContext.Security.Tokens.Add(token); service.RequestSoapContext.Security.Timestamp.TtlInSeconds = 60;

// Encrypt and sign the message with the UsernameToken. service.RequestSoapContext.Security.Elements.Add( new EncryptedData(token) ); service.RequestSoapContext.Security.Elements.Add( new MessageSignature(token) );

// Make the method call. bool result = service.MethodName( <parameters> );