What Is WS-Security Username Token Profile

SOAP Web Service Tutorials - Herong's Tutorial Examples

∟WS-Security - SOAP Message Security Extension

∟What Is WS-Security Username Token Profile

This section describes the WS-Security Username Token Profile standard describing the profile (specific mechanisms and procedures) on username and password can be passed and how to prevent replay attacks.

What Is "WS-Security Username Token Profile"? WS-Security Username Token Profile is an OASIS specification that describes the profile (specific mechanisms and procedures) on how the "UsernameToken" element defined in WS-Security standard can be used as a means of identifying the sender by "username", and optionally using a password (or shared secret, or password equivalent) to authenticate that identity to the SOAP message receiver.

Here are 2 options specified in WS-Security Username Token Profile 1.1.1:

"#PasswordText" Option - This is the default option, in which password is passed as clear text. This is acceptable, if the SOAP message is dent over a secure communication channel like HTTPS. Here is an example:

<soap:Envelope xmlns:soap="..." xmlns:wsse="...">
<soap:Header>
   <wsse:Security>
      <wsse:UsernameToken>
         <wsse:Username>herong</wsse:Username>
         <wsse:Password>IloveDogs</wsse:Password>
      </wsse:UsernameToken>
   </wsse:Security>
</soap:Header>
...
</soap:Envelope>

"#PasswordDigest" Option - This is a more complex option, in which password is passed as hash digest with "Nonce" and "Created" elements to hide the original password and to prevent replay attacks:

<soap:Envelope xmlns:soap="..." xmlns:wsse="..." xmlns:wsu= "...">
<soap:Header>
   <wsse:Security>
      <wsse:UsernameToken>
         <wsse:Username>NNK</wsse:Username>
         <wsse:Password Type="...#PasswordDigest">
            weYI3nXd8LjMNVksCKFV8t3rgHh3Rw==</wsse:Password>
         <wsse:Nonce>WScqanjCEAC4mQoBE07sAQ==</wsse:Nonce>
         <wsu:Created>2003-07-16T01:24:32Z</wsu:Created>
      </wsse:UsernameToken>
   </wsse:Security>
</soap:Header>
</soap:Envelope>

Notes on option 2:

Namespace "wsu" refers to the WSU (WS-Security Utility 1.0) schema located at: "http://docs.oasis-open.org/wss/2004/01 /oasis-200401-wss-wssecurity-utility-1.0.xsd".
'Type="...#PasswordDigest"' stands for Type="http://docs.oasis-open.org/wss/2004/01 /oasis-200401-wss-username-token-profile-1.0#PasswordDigest". It specifies that the "Password" element contains the digest value generated by the "#PasswordDigest" algorithm defined in the WS-Security Username Token Profile standard.
The "Nonce" element contains the Base64 encoded form of a random string acting like a serial number of this SOAP message.
The "Created" element contains the timestamp of when this SOAP message was generated.

The "#PasswordDigest" algorithm is defined by the following formula:

Password_Digest = Base64 ( SHA-1 ( nonce + created + password ) )

The receiver of the SOAP message using a "#PasswordDigest" UsernameToken should performing validations listed below:

Recalculate the password digest value using the same password and the same algorithm. If the digest value does not match the "Password" content, reject this message. This prevents anyone changing the "Nonce" or the "Created" value.
Check the "Created" timestamp against the current time. If the "Created" timestamp is not "fresh" like more than 5 minutes old, reject this message. This prevents replay attacks in which someone resends the same message again to the receiver later in time.
Check the "Nonce" value against old "Nonce" values received recently. If the "Nonce" value matches an old "Nonce" value, reject this message. This prevents replay attacks in which someone resends the same message again immediately.