[WSS-231] There is an issue with the position of the <Timestamp> element in the <Security> header when using WSS4J calling .NET Web Services with WS-Security.

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.5.8
• Fix Version/s: 1.6.8
• Component/s: WSS4J Core
• Labels: timestamp ws-security
• Environment: Windows, Solaris
• Assignee: Colm O hEigeartaigh
• Reporter: Chris Weitner
• Created: 06/May/10 20:11
• Updated: 17/Sep/13 15:50
• Resolved: 05/Sep/12 14:07

Description

There is an issue with the position of the <Timestamp> element in the <Security> header when using WSS4J calling .NET Web Services with WS-Security. When using the "Timestamp Signature" action over https, we are receiving the following error: "Signing without primary signature requires timestamp". When I modified org.apache.ws.security.message.WSSecSignature to position <Timestamp> as the first element in <Security> it worked fine (by default <Timestamp> is the last element and after the <Signature>). Can this be fixed or can you make Timestamp positioned first as a configuration option?

<soapenv:Header>
<wsse:Security>

<wsu:Timestamp>
<wsu:Created>2010-05-06T16:46:31.594Z</wsu:Created>
<wsu:Expires>2010-05-06T16:51:31.594Z</wsu:Expires>
</wsu:Timestamp>

<wsse:BinarySecurityToken</wsse:BinarySecurityToken>

<ds:Signature>
....
</ds:Signature>
</wsse:Security>
</soapenv:Header>

Issue Links

• is related to: WSS-424 Signature Element is not inserted in the correct place in the header in certain circumstances