Adding WS-Addressing headers and signing them

Question

Let me begin by stating that I'm a .NET developer using WSE 3.0 to expose a variety of Web services to an external client. We are attempting to leverage WS-Security 1.0. Furthermore, while I know the Java language, I don't have a lot of background with the various frameworks and I have very little experience with Oracle.
The client is using:
Oracle iAS 10.1.3, j2ee 1.4, OC4J
Essentially this is an interop issue. We are trying to get the client's app to communicate with our WSE 3 enabled Web service. At this point we are stumped on two things:
1. The WSE framework recommends that a SOAP request message contain the WS-Addressing wsa:Action header and that this header is signed. I can disable this requirement but that can expose a minor security vulnerability. So I would prefer to have a wsa:Action header present and included in the signature.
2. The client has configured their proxy XML file to only sign the Body of the SOAP message. When examining the SOAP message on the wire, it appears that, in addition to the SOAP Body, the signing certificate is referenced in the Signature block. This means the Body and signing BinarySecurityToken are included in the signature. WSE 3.0 doesn't have a built-in policy assertion for this, which means we'll need to create a custom security assertion.
So my questions are:
1a. Is there a way to add a WS-Addressing header to the SOAP message using the webservice proxy configuration file? If not, what is the standard procedure?
1b. Once we add this WS-Addressing header, how do we include it in the signature for the SOAP message?
2. Is there a way to disable the inclusion of the signing certificate during signature generation so that:
<tbs-elements>
<tbs-element local-part="Body" name-space="http://schemas.xmlsoap.org/soap/envelope/" />
</tbs-elements>
really just means "sign the Body".
3. Lastly, where can I find a schema/configuration reference for the Web proxy configuration files? I've searched but must not be using the correct terms.
Thank you very much in advance. Any help provided is truly appreciated.
Joel

Answer 1

Hello
So my questions are:
>
1a. Is there a way to add a WS-Addressing header to
the SOAP message using the webservice proxy
configuration file? If not, what is the standard
procedure?So to add the header the best way will be to use a JAX-RPC handler. You can take a look to The specified item was not found.
1b. Once we add this WS-Addressing header, how do we
include it in the signature for the SOAP message?For the signature you should be able to use the Oracle WS-Security implementation to sign the header. See Client configuration
>
2. Is there a way to disable the inclusion of the
signing certificate during signature generation so
that:
<tbs-elements>
<tbs-element local-part="Body"
name-space="http://schemas.xmlsoap.org/soap/envelope/
/>
/tbs-elements>
really just means "sign the Body".I think you should also be able to do that with the/a handler, but I am not sure to follow in detail the process.
3. Lastly, where can I find a schema/configuration
reference for the Web proxy configuration files?
I've searched but must not be using the correct
terms.See documentation on the client configuration.
Also I will be pleased to help you more directly since I am very interested with any advanced interoperability development, can you contact me directly: tugdual.grall[at]oracle.com
regards
Tugdual Grall