Re: [ebxml-msg] WSS questions

[Ric Emery <remery@cyclonecommerce.com>]

I am not sure. The Pull security examples came from Jacques if I
remember correctly. Looking at the BinaryToken Option of the
PullRequest, the SecurityTokenReference is child element of the
SignalMessage is not necessary. The identity of the sender can be
achieved looking only at the Security element and the Signature
contained within.
This might lead me to wonder if you are correct in stating that the
SecurityTokenReference shown below is also unnecessary.

Ric

iwasa wrote:
> Here are some questions I got from
> users implementing ebMS3.0 CD.
> I appreciate if someone can answer
> the followings:
>
> 1) 6.2.1.1 Username / Password Option
>    The example is including both <wsse:UsernameToken>
>    and <SecurityTokenReference>.
> --
> <wsse:Security xmlns:wsse="…" xmlns:wsu="…"> 
>   <wsse:UsernameToken wsu:Id="#TokenID"> 
>      <wsse:Username>hamid</wsse:Username> 
>      <wsse:Password>SomePassword</wsse:Password> 
>   </wsse:UsernameToken> 
> </wsse:Security> 
> <eb:Messaging eb:version="3.0" SOAP:mustUnderstand="1" > 
>   <eb:SignalMessage> 
>      <wsse:SecurityTokenReference> 
>         <wsse:Reference URI="#TokenID" /> 
>      </wsse:SecurityTokenReference> 
>      <eb:MessageInfo> …. </eb:MessageInfo> 
>      <eb:PullRequest eb:forMbox="…" /> 
>   </eb: SignalMessage>
> </eb:Messaging>
> --
>
>    Can we omit <SecurityTokenReference> with
>    this example, even if we use ID and Password? 
>    Or is it mandatory to include the element?
>    It seems redundancy.
>    *If both of them should be included, the spec
>    should mention it. If not, it should be mentioned 
>    also.
>
> 2) The above example is for SignalMessage.
>    How about for UserMessage? I assume the
>    answer is the same with the above.
>
> Thanks,
>
> Iwasa   
>
>
> ---------------------------------------------------------------------
> To unsubscribe from this mail list, you must leave the OASIS TC that
> generates this mail.  You may a link to this group and all your TCs in OASIS
> at:
> https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php 
>
>