[RAMPART-189] WS-Security rampart uses wrong token in service response

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.4
• Fix Version/s: 1.5
• Component/s: rampart-core, rampart-policy
• Assignee: Nandana Mihindukulasooriya
• Reporter: Gary Snider
• Created: 12/Aug/08 04:50
• Updated: 01/Sep/09 17:06
• Resolved: 01/Sep/09 17:06

Description

In rampart 1.4:

AsymmetricBindingBuilder.doSignBeforeEncrypt line 457:
Token encrToken = rpd.getRecipientToken();
The problem is that if this is recipient mode (i.e. service side) then the encryption token should be the initiator's token.

It looks like it's handled correctly in the signature portion. The same check should be made for encrypting.
AsymmetricBindingBuilder.doSignature lines 566-570: This block of code checks for the direction and uses the policy token assertion correctly
if(rmd.isInitiator()) {
sigToken = rpd.getInitiatorToken();
} else

{ sigToken = rpd.getRecipientToken(); }