[OASIS Issue Tracker] (EBXMLMSG-97) 7.11.2 X.509 tokens in Pull requests targeted to default role

[OASIS Issues Tracker <workgroup_mailer@lists.oasis-open.org>]

    [ https://issues.oasis-open.org/browse/EBXMLMSG-97?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=66306#comment-66306 ] 

Sander Fieten commented on EBXMLMSG-97:
---------------------------------------

Based on section D.2 I would say that the configuration of the security header targeted at the default role/actor for a PullRequest is done in the PMode[1][s].Security.* parameters, i.e. the MSH should have the possibility to configure the PullRequest independently from the User Message. 

> 7.11.2  X.509 tokens in Pull requests targeted to default role
> --------------------------------------------------------------
>
>                 Key: EBXMLMSG-97
>                 URL: https://issues.oasis-open.org/browse/EBXMLMSG-97
>             Project: OASIS ebXML Messaging Services TC
>          Issue Type: Bug
>          Components: Core Spec
>            Reporter: Pim van der Eijk
>
> When sending a UserMessage,  the following parameter configures the use of X.509 or Username tokens on that message:
> PMode[1].Security.X509.*
> PMode[1].Security.UsernameToken.*
> This applies to the user message.   So if the user message is pulled, it applies to the pulled user message, not to the pull request.
> Section 7.10 describes that Pull requests can be authorized using a secondary WS-Security header targeting the "ebms" role.  This is configured using the following parameters:
> PMode.Initiator.Authorization.*
> This option is supported in AS4 (section 2.1.1) ebHandler as Authorization option 1.
> Section 7.11.2 states that PullRequests can also be secured using WS-Security tokens targeting the default "role".  Section 7.10 actually has an example that contains two WS-Security headers, targeting different roles. AS4 ebHandler refers to this as Authorization Option 2.  In the Core Specification it is not clear how this header is configured.
> See the next separate issue on AS4 and securing pull requests.



--
This message was sent by Atlassian JIRA
(v6.2.2#6258)