I ran the first test using the following configuration
1. Trader client application (Metro)
2. Passive STS (Metro)
3. Active STS (Metro)
4. Business Service (.NET)
The trader client application was configured to use either DOTNET_BS (which is
expecting a SAML token) or METRO_BSSTS (Changing the address of the service to
use the .NET implementation). The trader client is always trying to consume the
business service using basic profile 1.0 with no security (getClosedOrders
operation),
<TraceData>
<DataItem>
<MessageLogTraceRecord Time="2009-10-21T11:36:51.1504720-03:00"
Source="TransportReceive" Type="System.ServiceModel.Channels.BufferedMessage"
xmlns="http://schemas.microsoft.com/2004/06/ServiceModel/Management/MessageTrace">
<HttpRequest>
<Method>POST</Method>
<QueryString></QueryString>
<WebHeaders>
<Soapaction>"getClosedOrders"</Soapaction>
<Cache-Control>no-cache</Cache-Control>
<Connection>keep-alive</Connection>
<Pragma>no-cache</Pragma>
<Content-Length>300</Content-Length>
<Content-Type>text/xml;charset="utf-8"</Content-Type>
<Accept>text/xml, multipart/related, text/html, image/gif,
image/jpeg, *; q=.2, */*; q=.2</Accept>
<Host>localhost:9000</Host>
<User-Agent>JAX-WS RI 2.2-hudson-534-rc1</User-Agent>
</WebHeaders>
</HttpRequest>
<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
<s:Header xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<To s:mustUnderstand="1"
xmlns="http://schemas.microsoft.com/ws/2005/05/addressing/none">http://localhost:9000/tradebusinessservice</To>
<Action s:mustUnderstand="1"
xmlns="http://schemas.microsoft.com/ws/2005/05/addressing/none">getClosedOrders</Action>
</s:Header>
<S:Body>
<getClosedOrders xmlns="http://trade.samples.websphere.ibm.com"
xmlns:ns2="http://schemas.microsoft.com/2003/10/Serialization/">
<userID>uid:0</userID>
</getClosedOrders>
</S:Body>
</S:Envelope>
</MessageLogTraceRecord>
</DataItem>
</TraceData>
.NET is expecting a message with the following requirements,
1. WS Security 1.1 (We need to agree on this)
2. A SAML token as client credential signed and encrypted with the
BSL.Com certificate (And the userID profile as a claim in that token)
Am I missing something, do I need to configure something else in the Metro
Trader Client application to secure the messages and use a SAML token ?.
Thanks
Pablo.