dotnet web services enhancements: WS-Security 1.0 with WSE 3.0 -- dotnet web services enhancements

WS-Security 1.0 with WSE 3.0

Don Rixtown
9/7/2006 12:22:45 PM

dotnet web services enhancements: I'm trying to call a WSE 2.0 web service from a WSE 3.0 client. The
articles I've read say that this should work if you stick to using
features of ws-Security 1.0.

Every time I call the web service I get this exception:
Microsoft.Web.Services2.Security.SecurityFault: The signature or
decryption was invalid

Does anyone have any suggestions on how to restrict WSE 3.0 to only use
WS-Security 1.0 features?

Here is some sample code from the WSE 3.0 client:

UsernameToken token = new UsernameToken("username", "password");
MessageSignature signature = new MessageSignature(token);

service.RequestSoapContext.Security.Tokens.Add(token);
service.RequestSoapContext.Security.Elements.Add(signature);
service.RequestSoapContext.Security.Timestamp.TtlInSeconds = 60;

(The last 3 lines have obsolete warnings.)

I know the message is being signed. If I send the wrong password I get
an error of "The computed password digest doesn't match that of the
incoming username token."

Any pointers would be appreciated.

Thanks,
Don

--
Don Rixtown

Re: WS-Security 1.0 with WSE 3.0

Pablo Cibraro [MVP]
9/11/2006 10:41:34 AM

Hi Don,

Signing a message with a username token is not a supported scenario in WSE
3.0, because it is not considered secure. You should use one of the
pre-defined turn-key scenarios, that's why you receive the obsolete
warnings. This article describes more in detail that problem and how to only
use the WS-Security 1.0 features,
http://wcf.netfx3.com/content/WindowsCommunicationFoundationWCFInteroperabilityandMigrationwithWSE20.aspx

Regarding the invalid signature, you are currently signing the message with
the user's password (a symmetric key), so the service should receive the
same password to verify the signature. Therefore, you should send the
password as plain-text, otherwise, if the service only receives a hash of
the original password, it will not able to verify the signature. Does it
make sense ?

Regards,
Pablo Cibraro
http://weblogs.asp.net/cibrax

[quoted text, click to view]