Buscar este blog

martes, 11 de mayo de 2021

WS-Security - UsernameToken - Calculate Password Digest

How to calculate Password Digest WS-Security Soap Header: https://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0.pdf




Soap Header example:

<soapenv:Header>
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
        <wsse:UsernameToken wsu:Id="UsernameToken-C822D870BE48B556D816202993974805">
            <wsse:Username>Bob</wsse:Username>
            <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">K1ZqechO0a0UEVYOi4c5AE0neng=</wsse:Password>
            <wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">Wa/iIgpLm2ndpHgW8Ys46w==</wsse:Nonce>
            <wsu:Created>2021-05-11T19:03:57.479Z</wsu:Created>
        </wsse:UsernameToken>
    </wsse:Security>
</soapenv:Header>


Source code:

import java.io.UnsupportedEncodingException;
import java.nio.ByteBuffer;
import java.security.NoSuchAlgorithmException;

import org.apache.commons.codec.binary.Base64;
import org.apache.commons.codec.digest.DigestUtils;

public class CalclatePaswordText {
	
	public static void main(String[] args) throws NoSuchAlgorithmException, UnsupportedEncodingException {
		System.out.println(calcularPasswordDigest("P606+84STYF8yIsGfey1iw==", "2021-05-11T19:03:57.479Z", "secret"));
	}

	
	private static String calcularPasswordDigest (String nonce, String created, String password) throws UnsupportedEncodingException {
		ByteBuffer buf = ByteBuffer.allocate(1000);
		buf.put(Base64.decodeBase64(nonce));
		buf.put(created.getBytes("UTF-8"));
		buf.put(password.getBytes("UTF-8"));
		byte[] toHash = new byte[buf.position()];
		buf.rewind();
		buf.get(toHash);
		byte[] hash = DigestUtils.sha(toHash);
		return Base64.encodeBase64String(hash);
	}
}


No hay comentarios:

Publicar un comentario