WSE 2.0 Signing messages

[RBisch]

In order to sign a message, you can use a UserName token from the client
(endpoint) , however must you use a X509 certificate to sign the response
message from the service (endpoint) ?

I am trying to figure out if I have to use X509 certs., service side, in
terms of signing messages, if not what alternatives could I use ?

Thanks in advance.

[Kevin Yu [MSFT]]

Hi,

First of all, I would like to confirm my understanding of your issue. From
your description, I understand that you need to know if it is necessary to
sign the response message from the service when the request is signed. If
there is any misunderstanding, please feel free to let me know.

As far as I know, we can sign the response message but it is not required.
You can find more information with the following article: WS-Security
Drilldown in Web Services Enhancements 2.0.

http://msdn.microsoft.com/library/de...us/dnwse/html/
wssecdrill.asp

HTH.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[RBisch]

Actually the question was a bit more specific, I am aware that signing is
optional. Thanks for the link, however, I only found an example of signing
with the KerberosToken.

My question is as follows:
Can you sign a token on the service (i.e. server) endpoint with
UserNameToken, that would then be sent to the client endpoint ? If so, do you
know where I can find an example (code or reference) ?

Thanks.

"Kevin Yu [MSFT]" wrote:

Hi,

First of all, I would like to confirm my understanding of your issue. From
your description, I understand that you need to know if it is necessary to
sign the response message from the service when the request is signed. If
there is any misunderstanding, please feel free to let me know.

As far as I know, we can sign the response message but it is not required.
You can find more information with the following article: WS-Security
Drilldown in Web Services Enhancements 2.0.

http://msdn.microsoft.com/library/de...us/dnwse/html/
wssecdrill.asp

HTH.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

[Kevin Yu [MSFT]]

Yes, you can. You can sign a SOAP request by using a UsernameToken with
policy or code. A Web service can also sign the SOAP response by using
similar steps. Here is an article about this:

http://msdn.microsoft.com/library/de...us/wse/html/gx
consigningsoapmessageusingusernamepassword.asp

Another article with more information:
http://msdn.microsoft.com/msdnmag/is...n/default.aspx

HTH. Does this answer your question? If anything is unclear, please feel
free to let me know.

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."