Hi, Would like to discuss two topics regarding WS-Policy security implementation.
Signature and encryption of request are controlled by SignedParts, EncryptedParts policy assertions. But, as far as I can see, these assertions can be active only together with AssymetricBinding, SymmetricBinding or TransportBinding assertions. Asymmetric/Symmetric BindingHandler get signing/encryption element lists from AbstractBindingHandler and call appropriate WSS4J function to sign or encrypt message parts. Asymmetric/Symmetric BindingHandler is called from PolicyBasedWSS4JOutInterceptorInternal interceptor associated with AssymetricBinding, SymmetricBinding or TransportBinding assertions. That means, if client has a policy ONLY with SignedParts, EncryptedParts assertions, WITHOUT AssymetricBinding, SymmetricBinding or TransportBinding it does nothing with message. Two questions: 1) Basically I can see some use cases where signing/encryption can be done without authentication, for example encryption request only. In this case client just get public key of service and encrypt request message. Actually, client haven't authenticate itself for this scenario. Are there special reasons always to bind SignedParts, EncryptedParts with AssymetricBinding, SymmetricBinding or TransportBinding? 2) Actually if client defines policy containing only SignedParts, EncryptedParts assertions CXF does nothing and send unsigned/unencrypted message. Exception is thrown only on service side (Assertion is not satisfied). I find it a little bit dangerous, because client can assume that message is encrypted. IMHO exception should be thrown already on client side. Regards, Andrei.
