Modify namespace prefix in soap security header (timestamp)

Question

Dear reader,

I am writing code to consume a soap web service with both transport security and message security. Three certificates will be used for this:

1. a private key certificate for the transport security
2. another private key certificate for the signature
3. a public key certificate for the message encryption

I have written a custom ClientCredentials class to make it possible to add two client certificates to the request, because by default you can only add one. This all seems to work fine. Without a timestamp everything seems to work. The message will be decrypted and the authentication succeeds.
But when I add a timestamp, the receiver of the message is getting an error that there is no signed timestamp present in the request.
That's a strange error because I can see that there really is a signed timestamp in the message.
I am not sure, but it seems that the timestamp is not being recognized by the receiver because of the timestamp namespace prefix.
My message has a namespace prefix u for the timestamp. The receiver of the message did have success with a message that has a wsu namespace prefix for the timestamp. So I am wondering if this could be the reason that my message is being rejected.

Is there a way to modify the namespace prefix of the Timestamp element of a soap message?

This is the element that is being created by default:

     <u:Timestamp u:Id="uuid-f0fe5620-a332-42ea-8520-f045137ee92e-1">  
        <u:Created>2022-12-15T14:24:29.157Z</u:Created>  
        <u:Expires>2022-12-15T14:29:29.157Z</u:Expires>  
     </u:Timestamp>  

I want this to be:

     <wsu:Timestamp wsu:Id="uuid-f0fe5620-a332-42ea-8520-f045137ee92e-1">  
        <wsu:Created>2022-12-15T14:24:29.157Z</wsu:Created>  
        <wsu:Expires>2022-12-15T14:29:29.157Z</wsu:Expires>  
     </wsu:Timestamp>  

I tried to write a MessageFormatter and I can add namespace prefixes with this for the body, but this doesn't seem to work for the security headers.
I think a MessageInspector is too late because the message is already being signed at that stage.
So I really don't have any idea how I can do this.
Any help would be appreciated.

Kind regards,
Erwin Kuiper

Answer 1

Thank you, I have read it and I have tried it out, but you can't modify the security headers in this way. Only elements in de body of the message.

But I know now that my problem doesn't seem to be caused by the namespace prefix. I have been testing something with SoapUI. The receiver enabled the policy that requires a timestamp but disabled the policy that the timestamp must be signed. When I sent a message with SoapUI and I manually added a timestamp (not signed) to the message, I got an OK response back. I tried this both with a u: prefix and with a wsu: prefix in the timestamp and I got an OK response back in both cases. So the namespace prefix doesn't seem to make any difference.

When I send a message with a signed timestamp and a signed body and the receiver enables the require signed timestamp policy, the receiver get's the message "No signed timestamp present in Request". That's strange because when I look in the XML, I see that the timestamp is present and I see that there are two references in the Signature element: one for the timestamp and one for the body. When I validate the signature of this message with SignedXml, I get a valid result back. So the signature seems to be valid. When I modify one character in the timestamp or when I modify one character in the body, then the validation of the signature fails. So the signature really seems to be based on the body and the timestamp.

I actually have no idea what could be wrong. We use transport security and message security, all based on three certificates: one for the transport security, one for the message security encryption and one for the message security signature. The transport security is working fine. The encryption and decryption is also working fine. There is only a problem with the signature of the timestamp, but as I said, when I validate the signature with SignedXml, I get a valid result back.

Answer 2

Hi @Erwin Paul Kuiper

I think this can help you.

Example

Answer 3

How can I modify the namespace prefix of the Timestamp element from u: to wsu: with this attribute?

In the soap message that I am sending to the receiver, I want the change the <u: Timestamp> element to <wsu:Timestamp>.