Friday, 23 August 2013

Is it impossible to have both transport level security and message level security in rampart? Why?

Is it impossible to have both transport level security and message level
security in rampart? Why?

I'm using rampart to secure communication from a webservice client.
Following the specification i defined an asymmetric binding assertion to
provide message level security, but I also want to have the communication
with webservice over SSL, thus I also defined an appropriate transport
binding assertion.
The effect is that my client is able to connect to the webservice over
SSL, but in the message that's being sent, there are no signatures - it
seems as if the asymmetric binding assertions were ignored.
Is it actually the case? If so - is this a bug in rampart, or is it
somehow forbidden by WS Security Policy spec (I haven't found any such
information)?
Looking into rampart's MessageBuilder class source I've found this:
if(rpd.isTransportBinding()) {
log.debug("Building transport binding");
TransportBindingBuilder building = new TransportBindingBuilder();
building.build(rmd);
} else if(rpd.isSymmetricBinding()) {
log.debug("Building SymmetricBinding");
SymmetricBindingBuilder builder = new SymmetricBindingBuilder();
builder.build(rmd);
} else {
AsymmetricBindingBuilder builder = new AsymmetricBindingBuilder();
builder.build(rmd);
}
(the whole code:
http://grepcode.com/file/repo1.maven.org/maven2/org.apache.rampart/rampart-core/1.6.2/org/apache/rampart/MessageBuilder.java)
It again makes me think, that one can use only one of security binding and
if there are more of them, one is chosen with priority according to above
code.

No comments:

Post a Comment