dotnet web services enhancements: WSE 3.0 - Embedding X509 Certificate in Client Code -- dotnet web services enhancements

You're in the

dotnet web services enhancements

group:

WSE 3.0 - Embedding X509 Certificate in Client Code

GippySD NO[at]SPAM community.nospam
8/15/2006 6:56:02 PM

dotnet web services enhancements:

Thanks for reading.

I'm trying to authenticate a server with an X509 certificate which is
embedded, as a byte[], within the distributed client code -- all the examples
I've seen assume you're going to load the cert from the local cert store, but
we can't do this.

I'm able to load and create the X509SecurityToken and have written a custom
assertion, extending from SecurityPolicyAssertion, which I have added as the
sole assertion in my policy. However, it appears that WSE, when it reads the
response SOAP, pulls out the <BinarySecurityToken> and tries to find a
certificate in the local store to match it. I need it to call into my custom
InputFilter *ONLY* and not perform any of it's own authentication.

Re: WSE 3.0 - Embedding X509 Certificate in Client Code

Pablo Cibraro [MVP]
8/16/2006 10:23:05 AM

Hi,

You need to create a custom X509TokenManager. When WSE gets the
BinarySecurityToken, it makes a call to the configured token manager to
authenticate that token.
As you said, the default implementation of this token manager tries to find
the token in the certificate store. You need to modify that behavior.

Regards,
Pablo Cibraro
http://weblogs.asp.net/cibrax

"GippySD@community.nospam"
[quoted text, click to view]

Re: WSE 3.0 - Embedding X509 Certificate in Client Code

GippySD NO[at]SPAM community.nospam
8/16/2006 8:05:02 PM

Pablo,

Thanks for pointing me in this direction. I went ahead and created a custom
token manager, extending from X509SecurityTokenManager, and defined the
following methods:

LoadTokenFromXml
AuthenticateToken
VerifyToken
LoadTokenFromKeyInfo

Conceptually, this makes sense as this token manager would conceivably
provide the appropriate X509SecurityToken as embedded in my code.

I added an entry to the app.config under <microsoft.web.services><security>
that looks like:

<binarySecurityTokenManager>
<add type="MyProject.CustomX509SecurityTokenManager,Protocol"
valueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" />
</binarySecurityTokenManager>

where "Protocol" is the name of the dll in which the
"MyProject.CustomX509SecurityTokenManager" exists. However, it appears that
this is not being read (or honored) by WSE as no methods of the the
TokenManager are being called, including the constructor. Also, I am unsure
about what the "valueType" attribute should be set to. Any thoughts?

I know your time is valuable, and I appreciate pointers in whatever form you

Re: WSE 3.0 - Embedding X509 Certificate in Client Code

Pablo Cibraro [MVP]
8/17/2006 10:36:27 AM

Hi,

That is really strange, which security assertion are you using ?
MutualCertifiicate11Security ?.

In order to test the same thing, I developed the following class:

public class MyCustom509TokenManager : X509SecurityTokenManager
{
public MyCustom509TokenManager() : base()
{
}

public MyCustom509TokenManager(System.Xml.XmlNodeList configData)
: base(configData)
{
}

protected override void AuthenticateToken(X509SecurityToken token)
{
base.AuthenticateToken(token);
}
}

Then, I added the following section to the configuration file:

<microsoft.web.services3>
<policy fileName="wse3policyCache.config"/>
<security>
<x509 allowTestRoot="true"/>
<binarySecurityTokenManager>
<add
type="MyCustom509TokenManager"
valueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">
<keyAlgorithm name="RSAOAEP"/>
</add>
</binarySecurityTokenManager>
</security>
</microsoft.web.services3>

WSE is actually calling my token manager when either
MutualCertifiicate11Security or MutualCertifiicate10Security assertions are
used.

Regards,
Pablo Cibraro.

"GippySD@community.nospam"
[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the dotnet web services enhancements group.

home · blog · groups

Questions? Comments? Contact the dn