[CXF-2655] WS-SP token protection security binding property not correctly applied to X509 token in outbound interceptors

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.3
• Fix Version/s: 2.2.7
• Component/s: WS-* Components
• Estimated Complexity: Moderate
• Assignee: Daniel Kulp
• Reporter: David Valeri
• Created: 05/Feb/10 14:17
• Updated: 23/Mar/10 02:59
• Resolved: 09/Mar/10 02:32

Description

When a ProtectTokens assertion is used in an asymetric binding with X509 token, CXF does not sign the BST included in the message. It is likely that CXF also does not sign the proper parts if an issuer serial or key identifier is used instead.

The direct reference case is triggered by an issue in AsymetricBindingHandler lines 386-392. One cannot prepend the BST and then get its ID because WSS4J removes this info after the BST is prepended.

Changing the order of operations is one approach while working with the WSS4J signature builder's capabilities to sign the "Token" based on the mechanism by which the token is referenced may be a better approach.

Test case is pending.

Issue Links

• is related to: CXF-2656 WS-SP signed elements assertion cannot be applied to portions of the signature in outbound processing