GT 3.9.5 Development Release Notes for Message-level/Transport-level Security

Component Overview

The Web Services portions of GT 3.9.5 use SOAP over HTTP as their message protocol for communication.

WS Authentication and Authorization Message-Level Security implements the WS-Security standard and the WS-SecureConversation specification to provide message protection for SOAP messages. Features include authentication of the sender, encryption of the message, integrity protection of the message and replay protection.

WS Authenitcation and Authorization Transport-Level Security provides a secure channel by using HTTP over SSL/TLS (HTTPS) for transporting the messages. This security mechanism supports all the security features provided by SSL/TLS with the addition of support for X.509 Proxy Certificates.

Feature Summary

Features new in release 3.9.5

  • Compliance with published IBM/Microsoft WS-Trust and WS-SecureConversation specifications
  • Compliance with the Web Services Security 1.0 standard
  • HTTPS support

Other Supported Features

  • Message encryption, integrity protection and replay attack prevention
  • Establishment of a session key for light-weight message protection

Deprecated Features

  • GT 3.2 SecureConversation protocol

Changes Summary

Support for anonymous authentication

Support for anonymous authentication was added to the transport security (HTTPS) authentication mechanism.

Internationalization

The message and transport level security code has been internationalized.

Bug Fixes

  • Bug 2178: Any SOAP headers used for dispatching need to be secured
  • Bug 2179: Fix up replay attack prevention
  • Bug 2193: No local subject error
  • Bug 2207: Missing security error 'timestampNotOk'
  • Bug 2371: Better error reporting for security descriptor parsing errors
  • Bug 2523: core should cause error/warning for bad containerSecDesc file

Known Problems

 

Technology Dependencies

WS Authentication and Authorization Message-Level Security depends on the following GT components:

  • The C implementation depends on C WS Core.
  • The Java implementation depends on Java WS Core.

WS Authentication and Authorization Message-Level Security depends on the following 3rd party software:

  • Apache WSFX Security Libraries
  • PureTLS Libraries
  • BouncyCastle JCE provider
  • Cryptix Libraries
  • Apache XML Security Libraries

Tested Platforms

WS A&A Message-level and Transport-level Security should work on any platform that supports J2SE 1.3.1 or higher.

Tested Platforms for WS A&A Message-level and Transport-level Security

  • Linux (Red Hat 7.3)
  • Windows 2000
  • Solaris 9

Backward Compatibility Summary

Protocol changes in WS Authentication and Authorization Message-Level Security since GT version 3.2

  • WS-SecureConversation updated to reflect published IBM/Microsoft specification.
  • Web Services Security updated to reflect published OASIS standard (1.0).

API changes since GT version 3.2

  • N/A

Exception changes since GT version 3.2

  • N/A

Schema changes since GT version 3.2

  • N/A

For More Information

Click here for more information about this component.