Details
-
Bug
-
Status: Resolved
-
Minor
-
Resolution: Fixed
-
1.3
-
None
-
any
Description
org.apache.ws.secpolicy.model.HttpsToken will always serialize the RequireClientCertificate as specified in ws-securitypolicy, i.e. as an attribute on the HttpsToken element. However as of ws-securitypolicy 1.2 it should be specified as:
<sp:HttpsToken>
<wsp:Policy>
<sp:RequireClientCertificate/>
</wsp:Policy>
</sp:HttpsToken>
Notably the token builder for the ws-securitypolicy 1.2 works correctly and deserializes the token as specified in version 1.2 of the spec.
Additionally, since rampart claims ws-securitypolicy 1.2 support shouldn't it also consider the other two available elements for the HttpsToken, namely:
<sp:HttpBasicAuthentication />
<sp:HttpDigestAuthentication />
Although these are not handled by rampart, they could be used for policy validation.
Should I supply a diff?