jbossws-issues February 2008

jbossws-issues@lists.jboss.org

1 participants
175 discussions

[JBoss JIRA] Updated: (JBWS-1541) WS-Security 1.1 support

by Alessio Soldano (JIRA)

[ http://jira.jboss.com/jira/browse/JBWS-1541?page=all ] Alessio Soldano updated JBWS-1541: ---------------------------------- Component/s: ws-security (was: jbossws-native) > WS-Security 1.1 support > ----------------------- > > Key: JBWS-1541 > URL: http://jira.jboss.com/jira/browse/JBWS-1541 > Project: JBoss Web Services > Issue Type: Feature Request > Security Level: Public(Everyone can see) > Components: ws-security > Reporter: William DeCoste > Assigned To: Darran Lofthouse > Fix For: jbossws-3.x > > > Intuit requirement. Notes: > In JBossWS 1.2, WS-Security 1.0 is implemented and Username Token Profile 1.0 is partly implemented. WS-Security 1.1 is not implemented at all. > Username Token Profile 1.0 describes how to use WS-Security 1.x to send a username and password over an unprotected link whilst maintaining confidentiality and preventing tampering and replay. Currently JBossWS 1.2 does not fully support Username Token Profile 1.0. This is due to lack of support for nonces. The "<wsse:UsernameToken>" can be signed and verified by using the current digital signature features of the JBossWS 1.2 implementation of WS-Security. > However, transmitting digested passwords is not a suitable solution for Intuit as it requires that passwords be stored in plain text. This violates Intuit's company wide security policy. > As far as I can tell, the main differences between WS-Security 1.0 and WS- Security 1.1 are to do with the signing of headers and with the addition of a new feature for preventing some man-in-the-middle attacks. The WS-Security 1.0 specification stated that you cannot encrypt the soap header, where as the WS-Security 1.1 specification states that you can. Despite this, JBossWS 1.2 allows you to encrypt the header. The WS-Security 1.1 specification prevents some man-in-the-middle attacks by mandating extra acknowledgements. > Backward compatibility, e.g. security handler should recognize and consume WSS 1.0 and 1.1 respectively. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 9 months

1
0
0 / 0

[JBoss JIRA] Created: (JBWS-1988) Complete Username Token Profile 1.0

by Heiko Braun (JIRA)

Complete Username Token Profile 1.0 ----------------------------------- Key: JBWS-1988 URL: http://jira.jboss.com/jira/browse/JBWS-1988 Project: JBoss Web Services Issue Type: Feature Request Security Level: Public (Everyone can see) Affects Versions: jbossws-native-2.0.3 Reporter: Heiko Braun Fix For: jbossws-native-2.0.4 Support for nonces and password digest is missing -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 9 months

3
2
0 / 0

[JBoss JIRA] Created: (JBWS-1983) Create Metro and CXF user forums

by Heiko Braun (JIRA)

Create Metro and CXF user forums -------------------------------- Key: JBWS-1983 URL: http://jira.jboss.com/jira/browse/JBWS-1983 Project: JBoss Web Services Issue Type: Task Security Level: Public (Everyone can see) Reporter: Heiko Braun Fix For: jbossws-3.0.0 -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 10 months

1
1
0 / 0

[JBoss JIRA] Created: (JBWS-1970) wsrunclient doesn't work with args

by Alessio Soldano (JIRA)

wsrunclient doesn't work with args ---------------------------------- Key: JBWS-1970 URL: http://jira.jboss.com/jira/browse/JBWS-1970 Project: JBoss Web Services Issue Type: Bug Security Level: Public (Everyone can see) Components: productization Affects Versions: jbossws-2.0.2 Reporter: Alessio Soldano Assigned To: Alessio Soldano Priority: Minor Fix For: jbossws-native-2.0.4 Running something like this: ./wsrunclient.sh -classpath jaxws-samples-news-step1-agency.jar org.jboss.test.ws.jaxws.samples.news.Agency arg_one arg_two causes this: Exception in thread "main" java.lang.NoClassDefFoundError: arg_two The shell script need to be fixed since it overwrites the $args variable with the last argument specified. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 10 months

2
1
0 / 0

[JBoss JIRA] Created: (JBWS-1894) Define scenarios and describe them

by Alessio Soldano (JIRA)

Define scenarios and describe them ---------------------------------- Key: JBWS-1894 URL: http://jira.jboss.com/jira/browse/JBWS-1894 Project: JBoss Web Services Issue Type: Sub-task Security Level: Public (Everyone can see) Components: productivity Reporter: Alessio Soldano -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

16 years, 10 months

1
1
0 / 0

← Newer
1
...
15
16
17
18
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jbossws-issues February 2008