What Is WS-Security X.509 Certificate Token Profile?

SOAP Web Service Tutorials - Herong's Tutorial Examples - Version 5.02, by Dr. Herong Yang

SOAP Web Service Tutorials - Herong's Tutorial Examples

∟What Is WS-Security X.509 Certificate Token Profile?

This section describes the WS-Security X.509 Certificate Token Profile specification describing the profile (specific mechanisms and procedures) on how the 'BinarySecurityToken' element defined in WS-Security standard can be used to include X.509 certificate as a means of identifying the sender of a SOAP message.

What Is "WS-Security X.509 Certificate Token Profile"? WS-Security X.509 Certificate Token Profile is an OASIS specification that describes the profile (specific mechanisms and procedures) on how the "BinarySecurityToken" element defined in WS-Security standard can be used to include X.509 certificate as a means of identifying the sender of a SOAP message to the receiver.

What Is "X.509 Certificate"? An X.509 Certificate is a binding of a public key and its owner certified by a Certificate Authority (CA). It can be used to authenticate the certificate owner if the CA can be trusted..

Here is a SOAP request message example that contains a wsse:BinarySecurityToken element containing an X.509 certificate.

<soapenv:Envelope 
 xmlns:ser="http://www.herongyang.com/Service/" 
 xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
 xmlns:wsse="http://docs.oasis-open.org/wss/2004/01
    /oasis-200401-wss-wssecurity-secext-1.0.xsd"
 xmlns:wsu="http://docs.oasis-open.org/wss/2004/01
    /oasis-200401-wss-wssecurity-utility-1.0.xsd"
 >
<soapenv:Header>

 <wsse:Security>
  <wsse:BinarySecurityToken 
   EncodingType="http://docs.oasis-open.org/wss/2004/01
      /oasis-200401-wss-soap-message-security-1.0#Base64Binary"
   ValueType="http://docs.oasis-open.org/wss/2004/01
      /oasis-200401-wss-x509-token-profile-1.0#X509v3">
MIIDIjCCAt6gAwIBAgIEZjRlNTALBgcqhkjOOAQDBQAwYjELMAkGA1UEBhMCVU4x
EDAOBgNVBAgTB015U3RhdGUxDzANBgNVBAcTBk15Q2l0eTEOMAwGA1UEChMFTXlP
...
C4wxFfMc6tuHul2L9dHHAhUAhIEbBrqBKn9A99IXZtHFvE/uPbw=
  </wsse:BinarySecurityToken>
 </wsse:Security>

</soapenv:Header>
<soapenv:Body>
 <ser:HelloRequest>Hello</ser:HelloRequest>
</soapenv:Body>
</soapenv:Envelope>

Notice that how specification identifiers are used to describe the X.509 certificate format:

"#Base64Binary" - Specification identifier defined in "WS-Security SOAP Message Security 1.0" to indicate that the security token is passed in Base64 encoded format.
"#X509v3" - Specification identifier defined in "WS-Security X.509 Certificate Token Profile 1.0" to indicate that the security token is a single X.509 certificate.

The receiver of the above message can follow the "WS-Security X.509 Certificate Token Profile" specification to parse out the X.509 certificate and perform certificate validation to authenticate the sender.

X.509 certificate token also plays an important role in protecting message integrity and confidentiality by applying:

Message Signing - Defined the "XML Signature Syntax and Processing" specification.
Message Encryption - Defined the "XML Encryption Syntax and Processing" specification.

For more information, see the full specification at http://docs.oasis-open.org/wss-m/wss/v1.1.1/os/wss-x509TokenProfile-v1.1.1-os.html.

Last update: 2014.

Table of Contents

About This Book

Introduction to Web Service

Introduction to SOAP (Simple Object Access Protocol)

SOAP Message Structure

SOAP Message Transmission and Processing

SOAP Data Model

SOAP Encoding

SOAP RPC Presentation

SOAP Properties Model