Werner, Please see my inline comments:
Thanks, Ruchith On 10/24/05, Dittmann, Werner <[EMAIL PROTECTED]> wrote: > Ruchith, > > well, during the tests and other stuff I've seen quite > a lot of "wrapping styles". IMHO we cannot assume just > one style, or a specific line length where to wrap. > > The RFC that specifies MIME says it should be wrapped > at 72 (i believe), but base64 encoding in no way mandates > that (minimum line length is 4 chars, maximum unlimited > AFAIK). > > But because we uses several JARs that can produce base64 > encoded strings (XML-SEC, bouncycastle, other security > providers, etc) we cannot really predict how the setup is. > Also assuming a "standard" setting would not be save. > > Thus I would propose to go the following way: > - switch off optimization by default This is already there. The user will have to enable it in the configuration _only_ if it is required using the following config param in the out flow configuration. <optimizeParts>XPath expression pointing selecting one or more elements containing base64 text</optimizeParts> E.g.: <optimizeParts>//xenc:EncryptedData/xenc:CipherData/xenc:CipherValue</optimizeParts> > - in the documentation have a small chapter describing > that if one uses the action order "Signature Encryption" > then one can savely use optimization, if the order is the > other way around then it should not be used because of > possible Signature verification problems. Will add a comment in documentation. But I'll have a chat with the Axis2 guys as well and see whether we can change the default behavior in OM (Axis2) where it will enable us to handle both "Signature Encryption" and "Encryption Signature" with optimizing because IMHO its a probable use case and it will be useful for handling large content. That way we'll only loose out on other specific scenarios where we deal with base64 content generated by WSS4J. Once again thank you very much for your comments. > > Regards, > Werner > > > -----Ursprüngliche Nachricht----- > > Von: Ruchith Fernando [mailto:[EMAIL PROTECTED] > > Gesendet: Montag, 24. Oktober 2005 16:44 > > An: Dittmann, Werner > > Cc: [email protected] > > Betreff: Re: Picking up resources with a custom classloader > > > > > > Werner, > > > > Thanks for the tip... > > > > But that just made things a bit more complicated.... > > > > Now the Axis2 security handlers can MTOM optimize any base64 content. > > If that base64 text or the an element containing that base64 test is > > to be signed and then optimized we will not be able to preserve the > > fact whether the content was 'line wrapped' base64 or not :-(. Then > > when we rebuild the XML from the MIME message we will be having _only_ > > line wrapped base64 or a continuous line. Which will definitely cause > > signature to fail when there's a mismatch in base64 handling. > > > > Simply if we support base64 line wrapping in OM (Axis2), then we will > > not be able to support MTOM optimizing, signed base64 content which is > > generated by WSS4J. And other way around (no line wrapping in Axis2) > > we will not be able to support situations such as optimizing > > CipherValue content of a signed EncryptedData element since line > > wrapping is used in XMLSec. > > > > Is it possible for us to stick to one consistent method? Where we > > either do line wrapping in all base64 content or none at all? > > > > Thanks, > > Ruchith > > > > On 10/24/05, Dittmann, Werner <[EMAIL PROTECTED]> wrote: > > > Great. > > > > > > base64 is always a problem. XML-SEC uses an implementation > > > that performs line wrapping (after 76 chars), WSS4J itself > > > uses an encoder that does not perform line wrapping at all, > > > just spitting out one long line. > > > > > > Pls keep that in mind when reconstructing the base64 data, > > > line wrapping it is not always used. > > > > > > Regards, > > > Werner > > > > > > > -----Ursprüngliche Nachricht----- > > > > Von: Ruchith Fernando [mailto:[EMAIL PROTECTED] > > > > Gesendet: Montag, 24. Oktober 2005 16:04 > > > > An: Dittmann, Werner > > > > Cc: [email protected] > > > > Betreff: Re: Picking up resources with a custom classloader > > > > > > > > > > > > Hi, > > > > Please see my comments below: > > > > > > > > On 10/24/05, Ruchith Fernando <[EMAIL PROTECTED]> wrote: > > > > > Hi Werner, > > > > > > > > > > Axis2 DOES reconstruct the document before handing over to > > > > security processing. > > > > > > > > > > See: > > > > > org.apache.axis2.security.WSDoAllReceiver: Line 121: > > > > > org.apache.axis2.security.WSDoAllSender: Line 165: > > > > > Axis2Util.getDocumentFromSOAPEnvelope(msgContext.getEnvelope()); > > > > > > > > > > The default behaviour of the Axis2 security module does > > > > _not_ optimize > > > > > the base64 values all the time. the user will have to > > _specificaly_ > > > > > configure the sender handler to do so. Therefore right now > > > > Scenario #6 > > > > > runs fine with sending normal XML over the wire. > > > > > > > > > > BUT I just tried Scenario #6 with optimizing the > > > > CipherValue. and sig > > > > > verification failed :-). I guess there's a problem in MTOM > > > > processing > > > > > and it must be fixed. Will dig into it now and check. > > > > > > > > Found the problem with this :-). This is because the base64 text > > > > generated by WSS4J/XMLSec inserts "\n"s after every 76th base64 > > > > encoded character and in Axis2 when recreating the OM > > from the binary > > > > parts, OM doesn't include these new line characters. I > > tried a small > > > > hack to fix this problem and things worked just fine. > > Will fix the OM > > > > stuff soon. Therefore I can safely say that the > > optimization of the > > > > base64 content will work even with scenarios such as Scenario6. > > > > > > > > > > > > > > > > > > Thanks, > > > > > Ruchith > > > > > > > > > > On 10/24/05, Dittmann, Werner > > <[EMAIL PROTECTED]> wrote: > > > > > > Ruchith, > > > > > > > > > > > > if Axis2 behaves that way then interop scenario #6 will fail > > > > > > if Axis2 does not reconstruct the document before it is > > > > > > handed over the signature verification. What Axis2 does in > > > > > > this case, it modifes a signed document. > > > > > > > > > > > > Regards, > > > > > > Werner > > > > > > > > > > > > > -----Ursprüngliche Nachricht----- > > > > > > > Von: Ruchith Fernando [mailto:[EMAIL PROTECTED] > > > > > > > Gesendet: Montag, 24. Oktober 2005 09:19 > > > > > > > An: Dittmann, Werner > > > > > > > Betreff: Re: Picking up resources with a custom classloader > > > > > > > > > > > > > > > > > > > > > Oops missed the attachments again :-( > > > > > > > > > > > > > > --Ruchith > > > > > > > > > > > > > > On 10/24/05, Ruchith Fernando > > > > <[EMAIL PROTECTED]> wrote: > > > > > > > > Hi Werner, > > > > > > > > > > > > > > > > MTOM [1] optimizing changes the message to a MIME > > message with > > > > > > > > multiple MIME parts. Usually we optimize the > > base64 encoded > > > > > > > content of > > > > > > > > elements. > > > > > > > > > > > > > > > > Please have a look at the two attached messages. > > > > (encrypted_msg.txt > > > > > > > > and MTOM_optimized_encrypted_msg.txt). > > > > > > > > > > > > > > > > For example we can optimize the _contents_ of CipherValue > > > > > > > of a single > > > > > > > > CipherData element, where we will get a MIME message > > > > with two MIME > > > > > > > > parts. The first part contains the SOAPEnvelope with > > > > the contents of > > > > > > > > the CipherValue element replaced by <xop:Include ...> > > > > > > > element which as > > > > > > > > an 'href' attribute referring to the content id of > > > > the second MIME > > > > > > > > part which contains the binary form of the contents of the > > > > > > > CipherValue > > > > > > > > element.Even though the XML is modified, this MIME > > > > message is read > > > > > > > > into OM and the OM structure is built precisely at the > > > > > > > receiving end. > > > > > > > > And from this OM structure when we try to get the > > > > text value of the > > > > > > > > optimized element we will get the base 64 encoded > > > > value just as what > > > > > > > > is expected. > > > > > > > > > > > > > > > > This works well with encryption and it even interoped with > > > > > > > MSFT !!! :-) [2] > > > > > > > > I think signature should work, will try it out. > > > > > > > > > > > > > > > > Thanks, > > > > > > > > Ruchith > > > > > > > > > > > > > > > > [1] http://www.w3.org/TR/2005/REC-soap12-mtom-20050125/ > > > > > > > > [2] http://blogs.cocoondev.org/dims/archives/003408.html > > > > > > > > > > > > > > > > On 10/24/05, Dittmann, Werner > > > > <[EMAIL PROTECTED]> wrote: > > > > > > > > > Ruchith, > > > > > > > > > > > > > > > > > > looks good for me. I'll checkout from SVN soon to > > > > have a look > > > > > > > > > into the handlers. > > > > > > > > > > > > > > > > > > BTW, what does "MTOM optimizing" really mean? Does this > > > > > > > > > optimization modify elements, namespaces, or otherwise > > > > > > > > > modifies the XML data? If so we should be very careful > > > > > > > > > because this could result in a failure of SIgnature > > > > > > > > > verification. > > > > > > > > > > > > > > > > > > Regards, > > > > > > > > > Werner > > > > > > > > > > > > > > > > > > > -----Ursprüngliche Nachricht----- > > > > > > > > > > Von: Ruchith Fernando > > [mailto:[EMAIL PROTECTED] > > > > > > > > > > Gesendet: Sonntag, 23. Oktober 2005 22:41 > > > > > > > > > > An: [email protected] > > > > > > > > > > Cc: Dittmann, Werner; [EMAIL PROTECTED] > > > > > > > > > > Betreff: Re: Picking up resources with a custom > > > > classloader > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Hi All, > > > > > > > > > > > > > > > > > > > > I just cleaned up the use of 'repetition' element in > > > > > > > the out flow > > > > > > > > > > cofiguration and now Axis2 security module > > > > configuration look as > > > > > > > > > > described in this : > > > > > > > > > > > > > > http://marc.theaimsgroup.com/?l=axis-dev&m=112983906808070&w=2 > > > > > > > > > > > > > > > > > > > > This is how the interop scenario 5 configuration looks > > > > > > > like in Axis2 > > > > > > > > > > now: (See <parameter name="OutflowSecurity"> element) > > > > > > > > > > > > > > http://svn.apache.org/viewcvs.cgi/*checkout*/webservices/axis2 > > > > > > > > > > > > > > /trunk/java/modules/integration/test-resources/security/s5.cli > > > > > > > > > > ent.axis2.xml > > > > > > > > > > > > > > > > > > > > msgContext.getEnvelope().build() will build the > > > > OM (aka AXIOM) > > > > > > > > > > structure of the envelope element IF it is > > not built at > > > > > > > that point, > > > > > > > > > > due to the deferred built nature of OM. It does not > > > > > > > serialize the > > > > > > > > > > envelope but simply completes the XML object model. > > > > > > > > > > > > > > > > > > > > In the case when the handler is chained (repeated) (in > > > > > > > fact whenever > > > > > > > > > > the handler is called) the OM is completely built > > > > just before > > > > > > > > > > converting OM to DOM. See : > > > > > > > > > > > > > > org.apache.axis2.security.util.Axis2Util.getDocumentFromSOAPEn > > > > > > > > > > velope(SOAPEnvelope > > > > > > > > > > env) [1]. In this I had to perform env.build(), since > > > > > > > > > > evn.serializeAndConsume() does not serialize the > > > > > > > envelope properly (to > > > > > > > > > > construct DOM) when it is not completely built. BTW > > > > > > > > > > evn.serializeAndConsume() used to be > > > > env.serialize() [2] until > > > > > > > > > > recently. > > > > > > > > > > > > > > > > > > > > Making the OM structure complete was added to > > > > this point in the > > > > > > > > > > handler code when we introduced MTOM > > optimizing certain > > > > > > > portions of > > > > > > > > > > the message. For example base64 encoded text in the > > > > > > > CipherData element > > > > > > > > > > can be MTOM optimized. This was done to make sure > > > > that the OM > > > > > > > > > > structure that is complete before its querried using > > > > > > > XPath. But, now I > > > > > > > > > > see that, this shouldn't make a diffrence, since > > > > during XPath > > > > > > > > > > processing the OM structure is built anyway :-). > > > > > > > Therefore we can > > > > > > > > > > actually get rid of that line and things should > > > > work without a > > > > > > > > > > problem. > > > > > > > > > > > > > > > > > > > > Thanks, > > > > > > > > > > Ruchith > > > > > > > > > > > > > > > > > > > > [1] > > > > > > > > > > > > > > http://svn.apache.org/viewcvs.cgi/webservices/axis2/trunk/java > > > > > > > > > > > > > > /modules/security/src/org/apache/axis2/security/util/Axis2Util > > > > > > > > > > .java?rev=326985&view=markup > > > > > > > > > > [2] > > > > > > > > > > > > > > http://svn.apache.org/viewcvs.cgi/webservices/axis2/trunk/java > > > > > > > > > > > > > > /modules/security/src/org/apache/axis2/security/util/Axis2Util > > > > > > > > > > .java?rev=293501&r1=292217&r2=293501&diff_format=h > > > > > > > > > > > > > > > > > > > > On 10/21/05, Davanum Srinivas > > <[EMAIL PROTECTED]> wrote: > > > > > > > > > > > Yes, we are gonna clean up that repition thing. > > > > Ruchith can > > > > > > > > > > explain it > > > > > > > > > > > better. It has to do with Signing twice for example > > > > > > > > > > > > > > > > > > > > > > thanks, > > > > > > > > > > > dims > > > > > > > > > > > > > > > > > > > > > > On 10/21/05, Dittmann, Werner > > > > > > > <[EMAIL PROTECTED]> wrote: > > > > > > > > > > > > Thanks Dims, Ruchith. > > > > > > > > > > > > > > > > > > > > > > > > I just had a look in Axis2 security handler, > > > > looks very nice > > > > > > > > > > > > indeed. Also the parameter structurce > > looks much nicer > > > > > > > > > > > > than in Axis1 :-). > > > > > > > > > > > > > > > > > > > > > > > > Seems that I need to get maven to get Axis2 > > > > up and running > > > > > > > > > > > > on my system. > > > > > > > > > > > > > > > > > > > > > > > > Just one small question: When doing a "repetition" > > > > > > > > > > > > aka HandlerChaining there is a call to > > > > > > > > > > > > msgContext.getEnvelope().build() even in the > > > > case there > > > > > > > > > > > > is a repetition and the enevelope may not be ready > > > > > > > yet. Isn't > > > > > > > > > > > > that an overhead (I'm not familiar with the way > > > > > > > Axis2 sets up > > > > > > > > > > > > it internal structures)? > > > > > > > > > > > > > > > > > > > > > > > > Regards, > > > > > > > > > > > > Werner > > > > > > > > > > > > > > > > > > > > > > > > > -----Ursprüngliche Nachricht----- > > > > > > > > > > > > > Von: Davanum Srinivas [mailto:[EMAIL PROTECTED] > > > > > > > > > > > > > Gesendet: Freitag, 21. Oktober 2005 16:12 > > > > > > > > > > > > > An: Ruchith Fernando > > > > > > > > > > > > > Cc: Dittmann, Werner; [email protected] > > > > > > > > > > > > > Betreff: Re: Picking up resources with a custom > > > > > > > classloader > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Werner, > > > > > > > > > > > > > > > > > > > > > > > > > > The code is here: > > > > > > > > > > > > > > > > > > > > > > http://svn.apache.org/repos/asf/webservices/axis2/trunk/java/m > > > > > > > > > > > > > odules/security/ > > > > > > > > > > > > > > > > > > > > > > > > > > As you can see it is a VERY THIN layer on > > > > top of wss4j. > > > > > > > > > > just 4 classes > > > > > > > > > > > > > and some supporting classes. > > > > > > > > > > > > > > > > > > > > > > > > > > thanks, > > > > > > > > > > > > > dims > > > > > > > > > > > > > > > > > > > > > > > > > > On 10/21/05, Ruchith Fernando > > > > > > > > > > <[EMAIL PROTECTED]> wrote: > > > > > > > > > > > > > > Hi Werner, > > > > > > > > > > > > > > > > > > > > > > > > > > > > Please see my comments below: > > > > > > > > > > > > > > > > > > > > > > > > > > > > Thanks, > > > > > > > > > > > > > > Ruchith > > > > > > > > > > > > > > > > > > > > > > > > > > > > On 10/21/05, Dittmann, Werner > > > > > > > > > > <[EMAIL PROTECTED]> wrote: > > > > > > > > > > > > > > > All, > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > without having a look into Axis2 I have some > > > > > > > questions: > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > - how many classloader environments does > > > > > > > Axis2 need/uses? > > > > > > > > > > > > > > > - what is the difference between "Axis2 > > > > > > > module classloader" > > > > > > > > > > > > > > > and "Axis2 service classloader" > > > > > > > > > > > > > > > > > > > > > > > > > > > > Axis2 uses two classloaders one for > > > > services and one for > > > > > > > > > > > > > modules. IMHO > > > > > > > > > > > > > > this is mainly because the Axis2 services and > > > > > > > modules are > > > > > > > > > > > > > archived and > > > > > > > > > > > > > > they are expected to work in isolation. > > > > Therefore the > > > > > > > > > > > > > classloader that > > > > > > > > > > > > > > is associated with the module archive is the > > > > > > > 'module class > > > > > > > > > > > > > loader' and > > > > > > > > > > > > > > similarly with the service. The third > > > > party libs and > > > > > > > > > > other resources > > > > > > > > > > > > > > associated with the module or the > > service will be > > > > > > > > > > packaged in that > > > > > > > > > > > > > > respective archive and will only be > > pickedup by > > > > > > > the respective > > > > > > > > > > > > > > classloader. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > - does a handler like the WSS4J > > handler runs as > > > > > > > > > > Axis2 service > > > > > > > > > > > > > > > or as Axis2 module? > > > > > > > > > > > > > > > > > > > > > > > > > > > > We have ports of the WSdoAll* handlers in a > > > > > > > Axis2 module. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Regards, > > > > > > > > > > > > > > > Werner > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -----Ursprüngliche Nachricht----- > > > > > > > > > > > > > > > > Von: Ruchith Fernando > > > > > > > [mailto:[EMAIL PROTECTED] > > > > > > > > > > > > > > > > Gesendet: Freitag, 21. Oktober 2005 14:58 > > > > > > > > > > > > > > > > An: [email protected] > > > > > > > > > > > > > > > > Betreff: Picking up resources > > with a custom > > > > > > > classloader > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Hi All, > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Dims made some changes recently to enable > > > > > > > WSS4J to load > > > > > > > > > > > > > the password > > > > > > > > > > > > > > > > callback class from a given class loader. > > > > > > > This allowed > > > > > > > > > > > > > Axis2 security > > > > > > > > > > > > > > > > module (which is a port of the WSDoAll* > > > > > > > handlers) to be > > > > > > > > > > > > > able to load > > > > > > > > > > > > > > > > the password callback parameters from > > > > the service's > > > > > > > > > > > > > class loader. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Axis2 services have their own classloader > > > > > > > and this is > > > > > > > > > > > > > different from > > > > > > > > > > > > > > > > the classloader available to the > > Axis2 module. > > > > > > > > > > > > > Therefore we need to > > > > > > > > > > > > > > > > supply the service's classloader > > to WSS4J to > > > > > > > > > > pickup the required > > > > > > > > > > > > > > > > resources and classes. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Therefore we should also be able to > > > > load the other > > > > > > > > > > > > > resources such as > > > > > > > > > > > > > > > > crypto.propertes with a custom class > > > > loader (the > > > > > > > > > > > > > service's classloader > > > > > > > > > > > > > > > > in the case of Axis2), and we may > > > > have to load a > > > > > > > > > > > > > different Crypto impl > > > > > > > > > > > > > > > > from the Axis2 service archive. Right now > > > > > > > this is not > > > > > > > > > > > > > possible since > > > > > > > > > > > > > > > > the CryptoFactory and the default Crypto > > > > > > > impl (Merlin) > > > > > > > > > > > > > is not capable > > > > > > > > > > > > > > > > of accessing a custom class loader. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > I made some changes and tried it out with > > > > > > > Axis2 and it > > > > > > > > > > > > > was able to > > > > > > > > > > > > > > > > pickup the resources from the Axis2 > > > > service archive. > > > > > > > > > > > > > Please have a > > > > > > > > > > > > > > > > look at the attached diff. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Can we have this option in WSS4J? Or is > > > > > > > there a better > > > > > > > > > > > > > way to do it? > > > > > > > > > > > > > > > > Thoughts? :-) > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Thanks > > > > > > > > > > > > > > > > -- > > > > > > > > > > > > > > > > Ruchith > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > --------------------------------------------------------------------- > > > > > > > > > > > > > > > > To unsubscribe, e-mail: > > > > > > > > > > [EMAIL PROTECTED] > > > > > > > > > > > > > > > > For additional commands, e-mail: > > > > > > > > > > [EMAIL PROTECTED] > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > > > > > > > > > > > Ruchith > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > --------------------------------------------------------------------- > > > > > > > > > > > > > > To unsubscribe, e-mail: > > > > > > > [EMAIL PROTECTED] > > > > > > > > > > > > > > For additional commands, e-mail: > > > > > > > [EMAIL PROTECTED] > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > > > > > > > > > > Davanum Srinivas : http://wso2.com/blogs/ > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > > > > > > > > Davanum Srinivas : http://wso2.com/blogs/ > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > > > > > > > Ruchith > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > > > > > Ruchith > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > > > > Ruchith > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > > Ruchith > > > > > > > > > > > > > Thanks > > > > -- > > > > Ruchith > > > > > > > > > > > > > -- > > Ruchith > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: [EMAIL PROTECTED] > > For additional commands, e-mail: [EMAIL PROTECTED] > > > > > -- Ruchith --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
