Jeff Ortel wrote:
Your suggestion makes sense and I will happily change it but
I'm concerned that it will break existing WSSE users. I'll
post a specific RFC for this change on the list.
Thanks, Jeff. I quite agree about existing users - let's see what they say.
To save you looking up the spec, here are a couple of relevant extracts.
1. 'A nonce is a random value that the sender creates to include in each
UsernameToken that it sends.'
The current method in suds of contructing a nonce is a bit involved.
According to the spec, it can be any random string.
2. The Password element should have a Type attribute, which is one of the
following -
#PasswordText (default)
The actual password for the username, the
password hash, or derived password or S/KEY.
This type should be used when hashed password
equivalents that do not rely on a nonce or creation
time are used, or when a digest algorithm other
than SHA1 is used.
#PasswordDigest
The digest of the password (and optionally nonce
and/or creation timestame) for the username
using the algorithm described above.
I am no expert, so I am not sure of the significance of the '#' symbol.
In an example, it shows the following -
<wsse:Password Type="...#PasswordDigest">
weYI3nXd8LjMNVksCKFV8t3rgHh3Rw==
</wsse:Password>
Elsewhere in the document, it refers to 'wsse:PasswordText' and
'wsse:PasswordDigest'.
So personally I am not sure what it is supposed to look like, but hopefully
you can make more sense of this.
Thanks
Frank