Re: Authentication: Practical example

Michael Rasmussen wrote:

On Mon, 12 Jun 2006 08:30:12 -0400, Rob Richards wrote:

Am not sure what you mean by the above 2. Have you looked at the __setSoapHeaders() method (as of 5.0.5)? It takes an array of SoapHeader objects to be added to the message.

What I meant was that an automatically generated client from wsdl would not give you the opportunity to add headers as part of calling a method. Or is there something I have missed?

Yes, you can still add headers.

Not necessarily. Can use the encryption to protect credentials and/or digital signatures to prove identity.

But how are you to instruct the clients this information in the WSDL? If you are doing both server and client this is no problem, but if the clients are created solely with the information from the WSDL the I see a problem.

Yea, this has been a problem working with the WS-* stuff. Much of it hasn't been able to be described in a WSDL, so for WS-Security, the client has needed to know ahead of time that the server uses and/or requires it. Now, enter WSDL 2.0 and WS-Policy and it becomes possible to describe these in the WSDL, although I have yet to run into a service that deploys these. WSDL 2.0 was just changed to a recommendation at the end of March.

It is possible. I have been communicating with a .NET service that requires wsa, wsu and wsse. The wsse is actually using xml-dsig with x509. I am planning on writing about how to do all of this (including adding xml-enc) in the near future.

Please do. I would must certainly want to read it:-)

On the server side, it is a bit more complicated and I have been doing some research how to make it a little easier to accomplish these on that end.

Could you reveal some more information? Maybe write something? Maybe an idea for a new interface for the ext/soap plugin? I will be writing it up on my blog (www.cdatazone.org) in the near future. It is a bit complex and will be broken into several parts since in order to leverage WS-Security, you first need to understand how to use XMLENC and XMLDSIG. Then it's possible to move on to WS-Security. Right now everything needs to be performed manually so there are few to no shortcuts that can be used.

One thing I can say is that to perform these, I modify the request directly to add the WS-* pieces within the __doRequest() method. XMLENC and XMLDSIG portions typically require modifications to the body, so simply adding a header wont work. Ideas for a plugin are in the works. An xmlsec extension is being created first (handles XMLENC and XMLDSIG), which should be able to be used to help in the creation of a plugin for WS-Security, though not yet decided if the plugin would be a C ext or a user extension. Rob -- rrichards@ctindustries.net author of Pro PHP XML and Web Services from Apress