search

javaee / metro-wsit

https://javaee.github.io/metro-wsit/
Other
9 stars 24 forks source link

Use of DisableStreamingSecurity in policy results in invalid ValueType for KeyIdentifier in SecurityTokenReference for STR-Transform in Sender-Vouches SAML case scenario #1593

Open glassfishrobot opened 12 years ago

glassfishrobot commented 12 years ago

Client policy:

<wsp:Policy xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata" xmlns:wsoma="http://schemas.xmlsoap.org/ws/2004/09/policy/optimizedmimeserialization" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702" xmlns:t="http://docs.oasis-open.org/ws-sx/ws-trust/200512" xmlns:wspp="http://java.sun.com/xml/ns/wsit/policy" xmlns="http://schemas.xmlsoap.org/wsdl/" xmlns:scl="http://schemas.sun.com/2006/03/wss/client" wsu:Id="TestPortBindingPolicy">

Server policy snipet: -------------------------------- Resulting invalid SecurityTokenReference using SAML token profile 1.0 with SAMLAssertionID in a ValueType for the KeyIdentifier: uuid-bf24cc6e-ec15-46be-9ae4-197cdd43dd50 While, it should be using SAML token profile 1.1 with SAMLID in ValueType for the KeyIdentifier in SecurityTokenReference as follows: uuid-7fb70658-de16-4b07-b93c-e3ad1704e641 #### Environment Ubuntu, Service - Glassfish 3.1.1 , Client Metro 2.1.1 #### Affected Versions [2.1]
glassfishrobot commented 12 years ago

Reported by bshrom

glassfishrobot commented 12 years ago

snajper said: Reassigning

glassfishrobot commented 12 years ago

@vbkumarjayanti said: Are you a GlassFish customer ?. If so then please file an SR ticket.

glassfishrobot commented 12 years ago

bshrom said: Do i need to be a Glassfish paying customer to submit a bug report?

glassfishrobot commented 11 years ago

symonchang said: In Metro, the default is use Streaming Security. Use of DisableStreamingSecurity in policy is not recommended. In this case, when using of DisableStreamingSecurity in policy does not work, the user should switch to NOT use of DisableStreamingSecurity in policy. Marking to “metro2_3-waiver-request', as the workaround is available.

glassfishrobot commented 11 years ago

snajper said: Is this scenario supported without disabled streaming?

glassfishrobot commented 11 years ago

symonchang said: Yes. This scenario is supported without disabled streaming.

glassfishrobot commented 12 years ago

Was assigned to symonchang

glassfishrobot commented 7 years ago

This issue was imported from java.net JIRA WSIT-1593