Uploaded image for project: 'WSS4J'
  1. WSS4J
  2. WSS-242

Signing EncryptedData or EncryptedKey elements creates extraneous Id attributes

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Fixed
    • 1.5.9
    • 1.5.9, 1.6
    • WSS4J Core
    • None

    Description

      If the action order on the outbound side is encrypt then sign and the signature parts include the XML Encryption elements by name and namespace, the signature action introduces a namespaced (wsu) Id attribute on the signed XML Encryption elements.

      <xenc:EncryptedData xmlns:xenc="..." Id="EncDataId-659" Type="http://www.w3.org/2001/04/xmlenc#Element">
      becomes
      <xenc:EncryptedData xmlns:wsu="..." xmlns:xenc="..." Id="EncDataId-659" Type="http://www.w3.org/2001/04/xmlenc#Element" wsu:Id="id-663">

      The signature is created with the reference to the wsu:Id attribute. The second attribute is not schema valid per the XML Encryption spec data structure [1]. As the XML Encryption spec already defines an Id attribute on the appropriate data structures, WSS4J should leverage this preexisting attribute when creating signatures that reference the primary structures from XML Encryption.

      As the XPointer definition requires that the attribute referenced is a schema defined ID [2], the preexisting Id attribute meets this requirement. While it could be considered a slippery slope to alter the signature code to accommodate the specific structure of arbitrary elements to be signed, the XML Encryption elements are well know structures and are deeply ingrained in WSS4J. Therefore, I feel that this change has a place in WSS4J. A more complete solution would include a pluggable strategy for allowing users to inject/reuse IDs on a per element basis; however, this issue and its patches are meant to resolve the immediate need related only to XML Encryption elements.

      [1] http://www.w3.org/TR/xmlenc-core/#sec-EncryptedType
      [2] http://www.w3.org/TR/2003/REC-xptr-framework-20030325/#shorthand

      Attachments

        1. WSS-242-trunk.patch
          9 kB
          David Valeri
        2. WSS-242-1_5_x.patch
          7 kB
          David Valeri

        Issue Links

          Activity

            People

              coheigea Colm O hEigeartaigh
              davaleri David Valeri
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: