This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 2_4_x-fixes
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
The following commit(s) were added to refs/heads/2_4_x-fixes by this push:
new 136e34379 Adding docs about trust credentials for BST (#706)
136e34379 is described below
commit 136e34379783c6eaf22c56c67607b68f38c6cb66
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Fri Sep 18 10:52:59 2026 +0100
Adding docs about trust credentials for BST (#706)
---
.../src/main/java/org/apache/wss4j/dom/engine/WSSConfig.java | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git
a/ws-security-dom/src/main/java/org/apache/wss4j/dom/engine/WSSConfig.java
b/ws-security-dom/src/main/java/org/apache/wss4j/dom/engine/WSSConfig.java
index 9257ae739..733c99eff 100644
--- a/ws-security-dom/src/main/java/org/apache/wss4j/dom/engine/WSSConfig.java
+++ b/ws-security-dom/src/main/java/org/apache/wss4j/dom/engine/WSSConfig.java
@@ -476,6 +476,15 @@ public final class WSSConfig {
*
* Please note that the Validator object does NOT get class-loaded per
invocation, and so
* it is up to the implementing class to ensure that it is thread-safe.
+ *
+ * Note for WSConstants.BINARY_TOKEN: registering any Validator for this
QName - including
+ * one registered only to inspect or transform the token, or a
NoOpValidator - marks the
+ * token as validated, and a Signature referencing that token is then
treated as a trusted
+ * credential, so the Signature Validator (SignatureTrustValidator by
default) does not
+ * run for it. This is how Kerberos and other opaque BinarySecurityTokens
obtain direct
+ * trust, but it applies equally to a Validator that verifies nothing.
Register a Validator
+ * here only if it verifies the token itself, or accept that signatures
referencing that
+ * token are not trust-checked.
*/
public Class<?> setValidator(QName el, Validator validator) {
Object result = validatorMap.put(el, validator);
