[RAMPART-357] Timestamp verification handled at two locations in different ways

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Assignee: Unassigned
• Reporter: Hasini Gunasinghe
• Created: 06/Feb/12 07:53
• Updated: 07/Mar/12 05:26
• Resolved: 15/Feb/12 09:27

Description

Currently, when verifying timestamp, 'Expired' is verified in WSS4J level if timestampStrict enabled.
'Created' is verified in PolicyBasedResultsValidator.

timestampMaxSkew is taken into consideration only when verifying 'Created' in timestamp inside PolicyBasedResultsValidator.

IMO, both 'Expired' and 'Created' should be verified in PolicyBasedResultsValidator in a consistent way, taking timestampMaxSkew into consideration in both the occasions.

Hence the proposed solution is like below:
-Disable timestampStrict in WSConfig by default through Rampart.
-Verify both 'Expired' and 'Created' in PolicyBasedResultsValidator.
-Allow to enable verification at WSS4J level through rampart config, if someone needs it.