[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: RE: [ws-sx] Issue i148: Syntax of XPath for Signed, Encrypted and Required Elements
|
Attribute
extensibility is required, not only for defining namespaces, but also for additional
attribute required for that sp:XPath assertion. For example, given the
following XPath Filter 2.0 <Sp:SignedEelements> assertion for the
signature transformation: <sp:SignedElements XPathVersion="http://www.w3.org/2002/06/xmldsig-filter2" xmlns:sp="..." > <sp:XPath Filter="intersect" xmlns:m="http://example"> //m:credit/num[@len>11] </sp:XPath> </sp:SignedElements> The attribute of Filter=”intersect”
is just that <sp:XPath> assertion, and it cannot be moved onto its parent,
i.e. the <sp:SignedElements> assertion. The namespace attributes also required for
some SOAP messages. For example, in a large SOAP document, there may have some
elements with different namespace but use the same namespace prefix. For
example, in the following SOAP message, the namespace prefix m and n1 in <m:getProductsAndPricingResponse> and <m:CreditInfo> elements have different definitions: <env:Envelope xmlns:env=". . ." …> <env:Header> . . . </env:Header> <env:Body . . .> <m:getProductsAndPricingResponse xmlns:m="http://NCEN-WS3222:7001/ede/EDEService"> <result xmlns:n1="java:com.newcentury.response" soapenc:arrayType="n1:ProductGradePricingResponse[1]"> <ProductGradePricingResponse xsi:type="n1:ProductGradePricingResponse"> ... </ProductGradePricingResponse> </result> </m:getProductsAndPricingResponse> <m:CreditInfo xmlns:m="http://myBank.com/creditInfo" n1="com.mybank.response"> <candidateProductProgramGrades soapenc:arrayType="n1:CandidateProductProgramGrade"> . . . </m:CreditInfo> </env:Body> </env:Envelope> If we want to specify policy for signature
and/or encryption for both <m:getProductsAndPricingResponse> and <m:CreditInfo> elements, putting namespace attributes in the
<sp:SignedElements> or <sp:EncryptedElements> assertions will not
work. It has to define namespace attribute of m and n1 separately for each <sp:Xpath>
assertion. Therefore, the syntax changes for <sp:XPath> assertion from <sp:XPath> to <sp:XPath ...> is required for more flexible of policy specifying. Best regards, Symon ChangBEA Systems Inc. From: Marc Goodner
[mailto:mgoodner@microsoft.com] Attribute
extensibility is not required in order to define a namespace. Also, sp:XPath is
not an assertion, it is a parameter that qualifies the policy assertion in
which it appears. This means that wsp:Optional is not valid for use on
sp:XPath. The use of wsp:Optional is permitted for each of the policy
assertions that has an sp:XPath parameter, i.e. the sp:EncryptedElements
assertion. From: Greg Carpenter Issue i148 From: Symon Chang
[mailto:sychang@bea.com] PLEASE DO NOT REPLY TO THIS EMAIL OR START A DISCUSSISON THREAD UNTIL THE ISSUE IS ASSIGNED A NUMBER. The issues coordinators will notify the list when that has occurred.Protocol: ws-sp http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/ws-securitypolicy-1.2-spec-os.pdf Artifact: spec Type: design Title: Syntax of XPath for Signed, Encrypted and Required Elements Description: The syntax of XPath Assertion should be changed from <sp:XPath> to <sp:XPath ...>This is related to the following four assertions: · SignedElements Assertion – Section 4.1.2 · EncryptedElements Assertion – Section 4.2.2 · ContentEncryptedElements Assertion – Section 4.2.3 · RequiredElements Assertion – Section 4.3.1 Syntax from the current spec like this for the EncryptedElement:
However, the policy for specify an Xpath element to be encrypted will not work. For example, if we use this for encryption of the ProductGradePricingResponse element, the following policy is broken. This is due to the namespace of env and m is not defined. <wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200512"
> <sp:EncryptedElements
XPathVersion="http://www.w3.org/TR/1999/REC-xpath-19991116"> <sp:XPath>/env:Envelope/env:Body/m:getProductsAndPricingResponse/result/ProductGradePricingResponse </sp:XPath> </sp:EncryptedElements> </wsp:Policy> The following policy will be better:<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"
> <sp:EncryptedElements
XPathVersion="http://www.w3.org/TR/1999/REC-xpath-19991116"
xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"> <sp:XPath
xmlns:m="http://www.soapbuyer.org/soapexample/message">
/env:Envelope/env:Body/m:getProductsAndPricingResponse/result/ProductGradePricingResponse</sp:XPath> </sp:EncryptedElements> </wsp:Policy> The namespace of the xpath string should be placed as attributes in either the element of <sp:EncryptedElements>, or <sp:XPath > elements.In addition, if we want this encrypted element to be optional, then the policy example will look like this: <wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"
> <sp:EncryptedElements
XPathVersion="http://www.w3.org/TR/1999/REC-xpath-19991116"
xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"> <sp:XPath
xmlns:m=”http://www.soapbuyer.org/soapexample/message"
wsp:Optional="true">
/env:Envelope/env:Body/m:getProductsAndPricingResponse/result/ProductGradePricingResponse</sp:XPath> </sp:EncryptedElements> </wsp:Policy> Base on above policy examples, the syntax of the XPath assertion should be <sp:XPath ...> instead of <sp:XPath>. Related issues: None.Proposed Resolution: The syntax on the following sessions should be changed: Section 4.1.2 SignedElements Assertion Before:
Change to:
Section 4.2.2 EncryptedElements Assertion Before:
Change to:
Section 4.2.3 ContentEncryptedElementsAssertion Before:
Change to:
Section 4.3.1 RequiredElementsAssertionBefore:
Change to:
Symon Chang BEA Systems
Notice: This email message, together with any attachments, may contain information of BEA Systems, Inc., its subsidiaries and affiliated entities, that may be confidential, proprietary, copyrighted and/or legally privileged, and is intended solely for the use of the individual or entity named in this message. If you are not the intended recipient, and have received this message in error, please immediately return this by email and then delete it. |
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]