DOC

Web Services Security SOAP Message Security 1.1 WS-Security 2004

By Patricia Simmons,2014-03-26 18:58
7 views 0
a framework for XML-based tokens, and how to include opaque encrypted keys. EMC. Dana S. Kaufman. Forum Systems. Toshihiro. Nishimura. Fujitsu

1 2

    3 Web Services Security:

    4 SOAP Message Security 1.1

    5 (WS-Security 2004)

    6 OASIS Errata Committee Draft, 25 August 2006

    7 OASIS identifier: 8 wss-v1.1-errata-SOAPMessageSecurity

    9 Location:

    10 http://docs.oasis-open.org/wss/v1.1/

    11 Technical Committee:

    12 Web Service Security (WSS)

    13 Chairs:

    14 Kelvin Lawrence, IBM

    15 Chris Kaler, Microsoft

    16 Editors:

    17 Anthony Nadalin, IBM

    18 Abstract:

    19 This specification describes enhancements to SOAP messaging to provide message 20 integrity and confidentiality. The specified mechanisms can be used to accommodate a 21 wide variety of security models and encryption technologies. 22

    23 This specification also provides a general-purpose mechanism for associating security 24 tokens with message content. No specific type of security token is required, the 25 specification is designed to be extensible (i.e.. support multiple security token formats). 26 For example, a client might provide one format for proof of identity and provide another 27 format for proof that they have a particular business certification. 28

    29 Additionally, this specification describes how to encode binary security tokens, a 30 framework for XML-based tokens, and how to include opaque encrypted keys. It also 31 includes extensibility mechanisms that can be used to further describe the characteristics 32 of the tokens that are included with a message. 33 Status:

    34 This is an OASIS Draft listing errata for the OASIS Standard produced by the Web

    35 Services Security Technical Committee. The standard was approved by the OASIS 36 membership on 1 February 2006.

    wss-v1.1-errata-SOAPMessageSecurity 25 August 2006

    Copyright ? OASIS Open 2002-2006. All Rights Reserved. Page 1 of 13

37

    38 Technical Committee members should send comments on this specification to the 39 technical Committee’s email list. Others should send comments to the Technical 40 Committee by using the “Send A Comment” button on the Technical Committee’s web 41 page at www.oasisopen.org/committees/wss.

    42

    43 For patent disclosure information that may be essential to the implementation of this 44 specification, and any offers of licensing terms, refer to the Intellectual Property Rights 45 section of the OASIS Web Services Security Technical Committee (WSS TC) web page 46 at http://www.oasis-open.org/committees/wss/ipr.php. General OASIS IPR information 47 can be found at http://www.oasis-open.org/who/intellectualproperty.shtml. 48

    wss-v1.1-errata-SOAPMessageSecurity 25 August 2006

    Copyright ? OASIS Open 2002-2006. All Rights Reserved. Page 2 of 13

    49 50 Notices

    51 OASIS takes no position regarding the validity or scope of any intellectual property or other rights 52 that might be claimed to pertain to the implementation or use of the technology described in this 53 document or the extent to which any license under such rights might or might not be vailable; 54 neither does it represent that it has made any effort to identify any such rights. Information on 55 OASIS's procedures with respect to rights in OASIS specifications can be found at the OASIS 56 website. Copies of claims of rights made available for publication and any assurances of licenses 57 to be made available, or the result of an attempt made to obtain a general license or permission 58 for the use of such proprietary rights by implementors or users of this specification, can be 59 obtained from the OASIS Executive Director. OASIS invites any interested party to bring to its 60 attention any copyrights, patents or patent applications, or other proprietary rights which may 61 cover technology that may be required to implement this specification. Please address the 62 information to the OASIS Executive Director.

    63

    64 Copyright (C) OASIS Open 2002-2006. All Rights Reserved.

    65

    66 This document and translations of it may be copied and furnished to others, and derivative works 67 that comment on or otherwise explain it or assist in its implementation may be prepared, copied, 68 published and distributed, in whole or in part, without restriction of any kind, provided that the 69 above copyright notice and this paragraph are included on all such copies and derivative works. 70 However, this document itself may not be modified in any way, such as by removing the copyright 71 notice or references to OASIS, except as needed for the purpose of developing OASIS 72 specifications, in which case the procedures for copyrights defined in the OASIS Intellectual 73 Property Rights document must be followed, or as required to translate it into languages other 74 than English.

    75

    76 The limited permissions granted above are perpetual and will not be revoked by OASIS or its 77 successors or assigns.

    78

    79 This document and the information contained herein is provided on an "AS IS" basis and OASIS 80 DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO 81 ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE 82 ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A 83 PARTICULAR PURPOSE.

    84

    85 OASIS has been notified of intellectual property rights claimed in regard to some or all of the 86 contents of this specification. For more information consult the online list of claimed rights. 87

    88 This section is non-normative.

    89

    wss-v1.1-errata-SOAPMessageSecurity 25 August 2006

    Copyright ? OASIS Open 2002-2006. All Rights Reserved. Page 3 of 13

    90 Table of Contents

    191 Issues Addressed ............................................................................................................... 5 292 Typographical/Editorial Errors ............................................................................................. 6 2.1 Section 7.2 Direct References .......................................................................................... 693 2.2 Section 7.3 Key Identifiers ................................................................................................. 694 2.3 Section 8.6 Example ......................................................................................................... 695 2.4 Section 9.4.4 ..................................................................................................................... 696 2.5 Section 11 Extended Example ........................................................................................... 697 398 Normative Errors ................................................................................................................. 7 3.1 Section 8.3 Signing Tokens ............................................................................................... 799 3.2 Section 7.3 Key Identifiers ................................................................................................. 7100 4101 References ......................................................................................................................... 8 Appendix A: Acknowledgements................................................................................................ 10102 Appendix B: Revision History..................................................................................................... 13103

    104

    wss-v1.1-errata-SOAPMessageSecurity 25 August 2006

    Copyright ? OASIS Open 2002-2006. All Rights Reserved. Page 4 of 13

105 1 Issues Addressed

    106 The following issues related to the Web Web Services Security: SOAP Message Security 1.1

    107 (WS-Security 2004) listed in the Web Services Committee Issues List [WSS-Issues] have been

    108 addressed in this document:

    109

    Issue Description

    455 Remove the #x509v3 table entry

    459 Fix Typographical Errors

    463 Fix Typographical Errors 110

    wss-v1.1-errata-SOAPMessageSecurity 25 August 2006

    Copyright ? OASIS Open 2002-2006. All Rights Reserved. Page 5 of 13

111 2 Typographical/Editorial Errors

    112 2.1 Section 7.2 Direct References

    113 Added brackets to element names wsse:SecurityTokenReference, wsse:Embedded

    114 <wsse:Reference and wsse:KeyIdentifier on lines 938 and 939

    115 2.2 Section 7.3 Key Identifiers

    116 Line 980 changed:

    117 The <wsse:KeyIdentifier> element SHALL is placed in the 118 to

    119 The <wsse:KeyIdentifier> element SHALL be placed in the 120 2.3 Section 8.6 Example

    121 Changed line 1514 from:

    122 …#X509v3

    123 to

    124 http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3

    125 2.4 Section 9.4.4

    126 Changed line 1776 from:

    127 <wsse11:EncryptedHeader> then process as per section 9.5.2 Decryption and stop 128 to

    129 <wsse11:EncryptedHeader> then process as per section 9.4.2 Decryption and stop 130

    131 Changed line 1770 from:

    132 Decrypt the contents of the <xenc:EncryptedData> element as per section 9.5.2

    133 to

    134 Decrypt the contents of the <xenc:EncryptedData> element as per section 9.4.2

    135 2.5 Section 11 Extended Example

    136 Changed line 1916 from:

    137 …#X509v3

    138 to

    139 http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3

    140

    141 Changed line 1929 from:

    142 …#X509v3

    143 to

    144 http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3

    wss-v1.1-errata-SOAPMessageSecurity 25 August 2006

    Copyright ? OASIS Open 2002-2006. All Rights Reserved. Page 6 of 13

145 3 Normative Errors

    146 3.1 Section 8.3 Signing Tokens

    147 Removed the #x509v3 table entry at line 1399 and then change the example in same document

    148 at lines 1514, 1915 and 1927 to http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-

    149 token-profile-1.0#X509v3.

    150 3.2 Section 7.3 Key Identifiers

    151 Changed table entry on line 1014 from

    http://docs.oasis-If the security token type that the Security Token

    open.org/wss/oasis-Reference refers to already contains a representation

    wss-soap-message-for the thumbprint, the value obtained from the token

    security-MAY be used. If the token does not contain a

    1.1#ThumbPrintSHA1 representation of a thumbprint, then the value of the

    KeyIdentifier MUST be the SHA1 of the raw

    octets which would be encoded within the security

    token element were it to be included. A thumbprint

    reference MUST occur in combination with a required

    to be supported (by the applicable profile) reference

    form unless a thumbprint reference is among the

    reference forms required to be supported by the

    applicable profile, or the parties to the communication

    have agreed to accept thumbprint only references.

    152 to

    http://docs.oasis-If the security token type that the Security Token

    open.org/wss/oasis-Reference refers to already contains a representation

    wss-soap-message-for the thumbprint, the value obtained from the token

    security-MAY be used. If the token does not contain a

    1.1#ThumbprintSHA1 representation of a thumbprint, then the value of the

    KeyIdentifier MUST be the SHA1 of the raw

    octets which would be encoded within the security

    token element were it to be included. A thumbprint

    reference MUST occur in combination with a required

    to be supported (by the applicable profile) reference

    form unless a thumbprint reference is among the

    reference forms required to be supported by the

    applicable profile, or the parties to the communication

    have agreed to accept thumbprint only references.

    153

    wss-v1.1-errata-SOAPMessageSecurity 25 August 2006

    Copyright ? OASIS Open 2002-2006. All Rights Reserved. Page 7 of 13

154 4 References

    155 [GLOSS] Informational RFC 2828, "Internet Security Glossary," May 2000. 156 [KERBEROS] J. Kohl and C. Neuman, "The Kerberos Network Authentication Service 157 (V5)," RFC 1510, September 1993, http://www.ietf.org/rfc/rfc1510.txt . 158 [KEYWORDS] S. Bradner, "Key words for use in RFCs to Indicate Requirement Levels," 159 RFC 2119, Harvard University, March 1997. 160 [SHA-1] FIPS PUB 180-1. Secure Hash Standard. U.S. Department of 161 Commerce / National Institute of Standards and Technology. 162 http://csrc.nist.gov/publications/fips/fips180-1/fip180-1.txt 163 [SOAP11] W3C Note, "SOAP: Simple Object Access Protocol 1.1," 08 May 2000. 164 [SOAP12] W3C Recommendation, "SOAP Version 1.2 Part 1: Messaging 165 Framework", 23 June 2003. 166 [SOAPSEC] W3C Note, "SOAP Security Extensions: Digital Signature," 06 February 167 2001. 168 [URI] T. Berners-Lee, R. Fielding, L. Masinter, "Uniform Resource Identifiers 169 (URI): Generic Syntax," RFC 3986, MIT/LCS, Day Software, Adobe 170 Systems, January 2005. 171 [XPATH] W3C Recommendation, "XML Path Language", 16 November 1999 172

    173 The following are non-normative references included for background and related material:

    174 [WS-SECURITY] "Web Services Security Language", IBM, Microsoft, VeriSign, April 2002. 175 "WS-Security Addendum", IBM, Microsoft, VeriSign, August 2002. 176 "WS-Security XML Tokens", IBM, Microsoft, VeriSign, August 2002. 177 [XMLC14N] W3C Recommendation, "Canonical XML Version 1.0," 15 March 2001. 178 [EXCC14N] W3C Recommendation, "Exclusive XML Canonicalization Version 1.0," 8 179 July 2002. 180 [XMLENC] W3C Working Draft, "XML Encryption Syntax and Processing," 04 March 181 2002. 182 W3C Recommendation, “Decryption Transform for XML Signature”, 10 December 2002.

    183 [XML-ns] W3C Recommendation, "Namespaces in XML," 14 January 1999. 184 [XMLSCHEMA] W3C Recommendation, "XML Schema Part 1: Structures,"2 May 2001. 185 W3C Recommendation, "XML Schema Part 2: Datatypes," 2 May 2001. 186 [XMLSIG] D. Eastlake, J. R., D. Solo, M. Bartel, J. Boyer , B. Fox , E. Simon. XML-

    187 Signature Syntax and Processing, W3C Recommendation, 12 February

    188 2002. 189 [X509] S. Santesson, et al,"Internet X.509 Public Key Infrastructure Qualified 190 Certificates Profile," 191 http://www.itu.int/rec/recommendation.asp?type=items&lang=e&parent=192 T-REC-X.509-200003-I 193 [WSS-SAML] OASIS Working Draft 06, "Web Services Security SAML Token Profile", 194 21 February 2003

    wss-v1.1-errata-SOAPMessageSecurity 25 August 2006

    Copyright ? OASIS Open 2002-2006. All Rights Reserved. Page 8 of 13

195 [WSS-XrML] OASIS Working Draft 03, "Web Services Security XrML Token Profile",

    196 30 January 2003

    197 [WSS-X509] OASIS, “Web Services Security X.509 Certificate Token Profile”, 19

    198 January 2004, http://www.docs.oasis-open.org/wss/2004/01/oasis-

    199 200401-wss-x509-token-profile-1.0

    200 [WSSKERBEROS] OASIS Working Draft 03, "Web Services Security Kerberos Profile", 30

    201 January 2003

    202 [WSSUSERNAME] OASIS,”Web Services Security UsernameToken Profile” 19 January

    203 2004, http://www.docs.oasis-open.org/wss/2004/01/oasis-200401-wss-

    204 username-token-profile-1.0

    205 [WSS-XCBF] OASIS Working Draft 1.1, "Web Services Security XCBF Token Profile",

    206 30 March 2003

    207 [XMLID] W3C Recommmendation, “xml:id Version 1.0”, 9 September 2005.

    208 [XPOINTER] "XML Pointer Language (XPointer) Version 1.0, Candidate

    209 Recommendation", DeRose, Maler, Daniel, 11 September 2001.

    wss-v1.1-errata-SOAPMessageSecurity 25 August 2006

    Copyright ? OASIS Open 2002-2006. All Rights Reserved. Page 9 of 13

    210 Appendix A: Acknowledgements

    211 Current Contributors:

    Michael Hu Actional Maneesh Sahu Actional Duane Nickull Adobe Systems Gene Thurston AmberPoint Frank Siebenlist Argonne National Laboratory

    Hal Lockhart BEA Systems Denis Pilipchuk BEA Systems Corinna Witt BEA Systems Steve Anderson BMC Software Rich Levinson Computer Associates Thomas DeMartini ContentGuard Merlin Hughes Cybertrust Dale Moberg Cyclone Commerce Rich Salz Datapower Sam Wei EMC Dana S. Kaufman Forum Systems Toshihiro Nishimura Fujitsu Kefeng Chen GeoTrust Irving Reid Hewlett-Packard Kojiro Nakayama Hitachi Paula Austel IBM Derek Fu IBM Maryann Hondo IBM Kelvin Lawrence IBM Michael McIntosh IBM Anthony Nadalin IBM Nataraj Nagaratnam IBM Bruce Rich IBM Ron Williams IBM Don Flinn Individual Kate Cherry Lockheed Martin Paul Cotton Microsoft Vijay Gajjala Microsoft Martin Gudgin Microsoft Chris Kaler Microsoft Frederick Hirsch Nokia Abbie Barbir Nortel Prateek Mishra Oracle Vamsi Motukuru Oracle Ramana Turlapi Oracle Ben Hammond RSA Security Rob Philpott RSA Security Blake Dournaee Sarvega Sundeep Peechu Sarvega Coumara Radja Sarvega Pete Wenzel SeeBeyond Manveen Kaur Sun Microsystems Ronald Monzillo Sun Microsystems

    wss-v1.1-errata-SOAPMessageSecurity 25 August 2006

    Copyright ? OASIS Open 2002-2006. All Rights Reserved. Page 10 of

    13

Report this document

For any questions or suggestions please email
cust-service@docsford.com