Web Services Security:
SOAP Message Security 1.1
(WS-Security 2004)
OASIS Errata Committee Draft, 25 August 2006
OASIS identifier:
wss-v1.1-errata-SOAPMessageSecurity
Location:
http://docs.oasis-open.org/wss/v1.1/
Technical Committee:
Web Service Security (WSS)
Chairs:
Kelvin Lawrence, IBM
Chris Kaler, Microsoft
Editors:
Anthony Nadalin, IBM
Abstract:
This specification describes enhancements to SOAP messaging to provide message integrity and confidentiality. The specified mechanisms can be used to accommodate a wide variety of security models and encryption technologies.
This specification also provides a general-purpose mechanism for associating security tokens with message content. No specific type of security token is required, the specification is designed to be extensible (i.e.. support multiple security token formats). For example, a client might provide one format for proof of identity and provide another format for proof that they have a particular business certification.
Additionally, this specification describes how to encode binary security tokens, a framework for XML-based tokens, and how to include opaque encrypted keys. It also includes extensibility mechanisms that can be used to further describe the characteristics of the tokens that are included with a message.
Status:
This is an OASIS Draft listing errata for the OASIS Standard produced by the Web Services Security Technical Committee. The standard was approved by the OASIS membership on 1 February 2006.
Technical Committee members should send comments on this specification to the technical Committee’s email list. Others should send comments to the Technical Committee by using the “Send A Comment” button on the Technical Committee’s web page at www.oasisopen.org/committees/wss.
For patent disclosure information that may be essential to the implementation of this specification, and any offers of licensing terms, refer to the Intellectual Property Rights section of the OASIS Web Services Security Technical Committee (WSS TC) web page at http://www.oasis-open.org/committees/wss/ipr.php. General OASIS IPR information can be found at http://www.oasis-open.org/who/intellectualproperty.shtml.
Notices
OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be vailable; neither does it represent that it has made any effort to identify any such rights. Information on
OASIS's procedures with respect to rights in OASIS specifications can be found at the OASIS website. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users of this specification, can be obtained from the OASIS Executive Director. OASIS invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may cover technology that may be required to implement this specification. Please address the information to the OASIS Executive Director.
Copyright (C) OASIS Open 2002-2006. All Rights Reserved.
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to OASIS, except as needed for the purpose of developing OASIS specifications, in which case the procedures for copyrights defined in the OASIS Intellectual Property Rights document must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.
This document and the information contained herein is provided on an "AS IS" basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
OASIS has been notified of intellectual property rights claimed in regard to some or all of the contents of this specification. For more information consult the online list of claimed rights.
This section is non-normative.
Table of Contents
2 Typographical/Editorial Errors
2.1
Section 7.2 Direct References
2.2
Section 7.3 Key Identifiers
2.5
Section 11 Extended Example
3.1
Section 8.3 Signing Tokens
3.2
Section 7.3 Key Identifiers
The following issues related to the Web Web Services Security: SOAP Message Security 1.1 (WS-Security 2004) listed in the Web Services Committee Issues List [WSS-Issues] have been addressed in this document:
|
Description |
|
|
455 |
Remove the #x509v3 table entry |
|
459 |
Fix Typographical Errors |
|
463 |
Fix Typographical Errors |
2.1 Section 7.2 Direct References
Added brackets to element names wsse:SecurityTokenReference, wsse:Embedded <wsse:Reference and wsse:KeyIdentifier on lines 938 and 939
2.2 Section 7.3 Key Identifiers
Line 980 changed:
The <wsse:KeyIdentifier> element SHALL is placed in the
to
The <wsse:KeyIdentifier> element SHALL be placed in the
2.3 Section 8.6 Example
Changed line 1514 from:
…#X509v3
to
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3
2.4 Section 9.4.4
Changed line 1776 from:
<wsse11:EncryptedHeader> then process as per section 9.5.2 Decryption and stop
to
<wsse11:EncryptedHeader> then process as per section 9.4.2 Decryption and stop
Changed line 1770 from:
Decrypt the contents of the <xenc:EncryptedData> element as per section 9.5.2
to
Decrypt the contents of the <xenc:EncryptedData> element as per section 9.4.2
2.5 Section 11 Extended Example
Changed line 1916 from:
…#X509v3
to
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3
Changed line 1929 from:
…#X509v3
to
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3
3.1 Section 8.3 Signing Tokens
Removed the #x509v3 table entry at line 1399 and then change the example in same document at lines 1514, 1915 and 1927 to http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3.
3.2 Section 7.3 Key Identifiers
Changed table entry on line 1014 from
|
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbPrintSHA1 |
If the security token type that the Security Token Reference refers to already contains a representation for the thumbprint, the value obtained from the token MAY be used. If the token does not contain a representation of a thumbprint, then the value of the KeyIdentifier MUST be the SHA1 of the raw octets which would be encoded within the security token element were it to be included. A thumbprint reference MUST occur in combination with a required to be supported (by the applicable profile) reference form unless a thumbprint reference is among the reference forms required to be supported by the applicable profile, or the parties to the communication have agreed to accept thumbprint only references. |
to
|
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1 |
If the security token type that the Security Token Reference refers to already contains a representation for the thumbprint, the value obtained from the token MAY be used. If the token does not contain a representation of a thumbprint, then the value of the KeyIdentifier MUST be the SHA1 of the raw octets which would be encoded within the security token element were it to be included. A thumbprint reference MUST occur in combination with a required to be supported (by the applicable profile) reference form unless a thumbprint reference is among the reference forms required to be supported by the applicable profile, or the parties to the communication have agreed to accept thumbprint only references. |
[GLOSS] Informational RFC 2828, "Internet Security Glossary," May 2000.
[KERBEROS] J. Kohl and C. Neuman, "The Kerberos Network Authentication Service (V5)," RFC 1510, September 1993, http://www.ietf.org/rfc/rfc1510.txt .
[KEYWORDS]
S. Bradner,
"Key words for use in RFCs to Indicate Requirement Levels," RFC
2119,
[SHA-1] FIPS PUB
180-1. Secure Hash Standard.
[SOAP11] W3C Note, "SOAP: Simple Object Access Protocol 1.1," 08 May 2000.
[SOAP12] W3C Recommendation, "SOAP Version 1.2 Part 1: Messaging Framework", 23 June 2003.
[SOAPSEC] W3C Note, "SOAP Security Extensions: Digital Signature," 06 February 2001.
[URI] T. Berners-Lee, R. Fielding, L. Masinter, "Uniform Resource Identifiers (URI): Generic Syntax," RFC 3986, MIT/LCS, Day Software, Adobe Systems, January 2005.
[XPATH] W3C Recommendation, "XML Path Language", 16 November 1999
The following are non-normative references included for background and related material:
[WS-SECURITY] "Web
Services Security Language", IBM, Microsoft, VeriSign, April
2002.
"WS-Security Addendum", IBM, Microsoft,
VeriSign, August 2002.
"WS-Security XML Tokens", IBM,
Microsoft, VeriSign, August 2002.
[XMLC14N] W3C Recommendation, "Canonical XML Version 1.0," 15 March 2001.
[EXCC14N] W3C Recommendation, "Exclusive XML Canonicalization Version 1.0," 8 July 2002.
[XMLENC] W3C Working Draft, "XML Encryption Syntax and Processing," 04 March 2002.
W3C Recommendation, “Decryption Transform for XML Signature”, 10 December 2002.
[XML-ns] W3C Recommendation, "Namespaces in XML," 14 January 1999.
[XMLSCHEMA]
W3C Recommendation,
"XML Schema Part 1: Structures,"2 May
2001.
W3C Recommendation, "XML Schema Part 2: Datatypes," 2 May
2001.
[XMLSIG] D.
[X509] S. Santesson, et al,"Internet X.509 Public Key Infrastructure Qualified Certificates Profile," http://www.itu.int/rec/recommendation.asp?type=items&lang=e&parent=T-REC-X.509-200003-I
[WSS-SAML] OASIS Working Draft 06, "Web Services Security SAML Token Profile", 21 February 2003
[WSS-XrML] OASIS Working Draft 03, "Web Services Security XrML Token Profile", 30 January 2003
[WSS-X509] OASIS, “Web Services Security X.509 Certificate Token Profile”, 19 January 2004, http://www.docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0
[WSSKERBEROS] OASIS Working Draft 03, "Web Services Security Kerberos Profile", 30 January 2003
[WSSUSERNAME] OASIS,”Web Services Security UsernameToken Profile” 19 January 2004, http://www.docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0
[WSS-XCBF] OASIS Working Draft 1.1, "Web Services Security XCBF Token Profile", 30 March 2003
[XMLID] W3C Recommmendation, “xml:id Version 1.0”, 9 September 2005.
[XPOINTER] "XML Pointer Language (XPointer) Version 1.0, Candidate Recommendation", DeRose, Maler, Daniel, 11 September 2001.
Current Contributors:
|
Michael |
Hu |
Actional |
|
Maneesh |
Sahu |
Actional |
|
Duane |
Nickull |
Adobe Systems |
|
Gene |
Thurston |
AmberPoint |
|
Frank |
Siebenlist |
|
|
Hal |
Lockhart |
BEA Systems |
|
Denis |
Pilipchuk |
BEA Systems |
|
Corinna |
Witt |
BEA Systems |
|
Steve |
|
BMC Software |
|
Rich |
Levinson |
Computer Associates |
|
Thomas |
DeMartini |
ContentGuard |
|
Merlin |
Hughes |
Cybertrust |
|
Dale |
Moberg |
Cyclone Commerce |
|
Rich |
Salz |