Hi Sumaira,
Well I have not found a solution yet. I just gave my presentation and said them 'it is really nice to use UsernameToken, but for now, as you see, it requires SSL for the initiating the conversation. Go now and start using it and by the time you are prepared there will be solution for encrypting the token.' :).
That's it.
HTH,
Martin Kulov
www.codeattest.com
1) You can send the password in hash or encrypted form via the
passwordoption enum
2) You can also send the usernametoken in encrypted form as well.
http://www.softwaremaker.net/blog/PermaLink,guid,43d85031-3e0b-48a7-bdd7-1f49932
db40a.aspx
hth.

Signature
Thank you.
Regards,
Softwaremaker
==================================
> Martin,
>
[quoted text clipped - 9 lines]
> >
> > I had this problem two months ago when I prepared a presentation also. It seems that WSE is unable to encrypt the UsernameToken in this version. As
Hervey pointed out there will be progress in this area in WSE SP2 which we
expect to be available very soon. I hope your demo went smooth though.
> > Best regards,
> >
> > Martin Kulov
> > www.codeattest.com
Henning Krause [MVP] - 21 Nov 2004 10:12 GMT
Hello,
> 2) You can also send the usernametoken in encrypted form as well.
http://www.softwaremaker.net/blog/PermaLink,guid,43d85031-3e0b-48a7-bdd7-1f49932
db40a.aspx
The problem with this approach is that the server must have a certificate.
While the certificate itself is not a problem for me, the circumstance that
the client program must know the public key of that certificate is certainly
one.
And hardcoding the public key into the client is not an option for me.
What I would like to do is the following:
1. Client requests the server public key from a special webservice on the
server.
2. Client encrypts the Usernametoken with the servers public key and signs
it with its own private key.
3. The Server creates a security token and encrypts it with the clients
public key.
4. The client uses this security token to call the webservice.
After step 2, both actors have exchanged each public keys, thus they can
protect the entire comunication. I would create the key-pairs on each
application start.
Ideally this would be implemented with WS-SecureConversation.
A propos WS-SecureConversation. Does WSE implement some sort of
sequence-numbering in WS-SC? I only saw a relative short ticket-lifetime as
replay detection, whereas the WS-SC specification mentions sequence
numbering.
So, is that even possible and what must I do to asymetrically encrypt the
SecurityContextToken with my own public/private keypair?
Greetings,
Henning Krause [MVP]
> > Martin,
> >
[quoted text clipped - 19 lines]
> > > Martin Kulov
> > > www.codeattest.com
Martin Kulov - 21 Nov 2004 17:10 GMT
> encrypted form via the passwordoption enum
What is this enum value?
Martin Kulov
www.codeattest.com
Henning Krause [MVP] - 21 Nov 2004 19:32 GMT
Hello,
this enumeration allows you to specify how the password is sent over the
wire: Either in cleartext or a hashed version or not sent at all.
If you are using the first option (Unencrypted) you shuld secure the
password otherwise, i.e. with SSL/TLS or an X.509 certificate.
Greetings,
Henning Krause [MVP]
==========================
Visit my website: http://www.infinitec.de
Try my free Exchange Explorer: Mistaya
(http://www.infinitec.de/?page=products)
> > encrypted form via the passwordoption enum
>
> What is this enum value?
>
> Martin Kulov
> www.codeattest.com
Martin Kulov - 22 Nov 2004 07:47 GMT
Hi Henning,
I am aware that there is enumeration for setting password in clear text or hashed value. I did not understand what is its value for sending it in encrypted form.
Softwaremaker wrote:
1) You can send the password in hash or encrypted form via the passwordoption enum
So what is the value of the enum for sending the password in encrypted form.
Thanks,
Martin Kulov
www.codeattest.com
Henning Krause [MVP] - 22 Nov 2004 09:44 GMT
Hello,
you can't. That enumeration has the three values I outlined before: None,
Hashed, Plaintext.
If you want to encrypt it, you must encrypt the usertoken with an X.509
Certificate or similar.
Greetings,
Henning Krause [MVP]
==========================
Visit my website: http://www.infinitec.de
Try my free Exchange Explorer: Mistaya
(http://www.infinitec.de/?page=products)
> Hi Henning,
>
> I am aware that there is enumeration for setting password in clear text or hashed value. I did not understand what is its value for sending it in
encrypted form.
> Softwaremaker wrote:
> 1) You can send the password in hash or encrypted form via the passwordoption enum
[quoted text clipped - 4 lines]
> Martin Kulov
> www.codeattest.com
Sumaira Ahmad - 23 Nov 2004 03:07 GMT
The problem with WS secure conversation is this:
When u want to send the password as PlainText( because u are
authenticating against Active Directory or SQL that requires plainText
Password option), there is no way of encrypting the Username token.
In Normal scenario if you want to send the password in Plain Text, you
encrypt the username token as follows:
EncryptedData encrypted = new EncryptedData(encrToken,
usernameToken.Id)
proxy.RequestSoapContext.Elements.Add(encrypted)
But in Secure Conversation there is a bug( according to me).
See code below
// Create a SecurityContextTokenServiceClient that will get the
SecurityContextToken
string secureConvEndpoint =
ConfigurationSettings.AppSettings["tokenIssuer"];
SecurityContextTokenServiceClient client = new
SecurityContextTokenServiceClient(new Uri( secureConvEndpoint ));
Now ideally you should be able to do this:
client.RequestSoapContext.Security.Elements.Add( new EncryptedData(
issuerToken, string.Format("#{0}",usernameToken.Id )) );
But when I do this, it says:
that the RequestSoapContext of client is a protected member and hence
cannot be accessed.
Now the next option would be to encrypt ONLY the password using X.509
certs or whatever and add it to the UsernameToken. and send the
UsernameToken as it is.Then on the server it should decrypt it..
Is that possible???I haven't tried it yet.. Can u suggest a workaround
( other not SSL)..
Please let me know..I have spent God knows how many days trying to
find a solution to it..
Thanks,
Sumaira
> Hello,
>
[quoted text clipped - 27 lines]
> > Martin Kulov
> > www.codeattest.com
Sumaira Ahmad - 23 Nov 2004 03:30 GMT
All examples on WSE Secure Conversation, wherein we have to use a
token issuer shows u can access the RequestSoapContext for a
SecuritTokenServiceClient Proxy, but as per
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wseref/html/P_M
icrosoft_Web_Services2_Security_SecurityTokenServiceClient_RequestSoapContext.as
p
it is a protected member?? Sorry if this is a foolish question , but
is there anyway of changing its property to public from protected??
Thanks,
Sumaira
> Hello,
>
[quoted text clipped - 27 lines]
> > Martin Kulov
> > www.codeattest.com
Softwaremaker - 23 Nov 2004 10:16 GMT
Sorry, my mistake. I meant hash, plain text or no-show password. I wonder
how the word encrypted got in there....hmmm...
Thanks.
=================================================
> 1) You can send the password in hash or encrypted form via the
> passwordoption enum
>
> 2) You can also send the usernametoken in encrypted form as well.
http://www.softwaremaker.net/blog/PermaLink,guid,43d85031-3e0b-48a7-bdd7-1f49932
db40a.aspx
> hth.
> > Martin,
[quoted text clipped - 20 lines]
> > > Martin Kulov
> > > www.codeattest.com