Issue 145 - WS-Discovery - Editorial: clariy that the securityheader should not be signed

[Ram Jeyaraman <Ram.Jeyaraman@microsoft.com>]

This issue is assigned the number 145. For further discussions on this issue, please refer to this issue number or use this thread.

 

From: Vipul Modi
Sent: Monday, January 12, 2009 12:32 PM
To: Ram Jeyaraman; Geoff Bullen
Subject: New Issue: WS-Discovery: Editorial: clariy that the security header should not be signed

 

This is an editorial clarification issue.

 

Issue: When signing the message the security header should not be signed, however its children can be signed. This is already specified currently in the specification but it is not clear that the security header itself should not be signed. Following is the existing text. Since the security header is a SOAP header the following text could be interpreted as “it is legal to sign the security header”

 

d:Security/d:Sig/@Refs

Parts of the message that have been canonicalized and digested. Each part is referenced by @d:Id (see above). Only immediate children of the security header, top-level SOAP header blocks (/s:Envelope/s:Header/*), and the full SOAP Body (/s:Envelope/s:Body) can be referenced in this list. The value is a space-separated list of IDs to elements within the message.

 

Proposal: Replace the above text with following.

 

d:Security/d:Sig/@Refs

Parts of the message that have been canonicalized and digested. Each part is referenced by @d:Id (see above). Only immediate children of the security header, top-level SOAP header blocks other that the security header (/s:Envelope/s:Header/*), and the full SOAP Body (/s:Envelope/s:Body) can be referenced in this list. The value is a space-separated list of IDs to elements within the message.