www.flickr.com
This is a Flickr badge showing public photos from ashutosh.shahi. Make your own badge here.
Blog::Navigation
Bookmarks::Blogroll
Recent Entries
Blog::Referers
Today's Page Hits: 64
Stat Counter
since 02/20/07
Technorati
Today's Page Hits: 64
Friday November 16, 2007 Sun participated in the latest Web Services Interoperability Plugfest hosted by Microsoft at their Redmond campus from November 6th to 8th. Harold, Jiandong and myself represented Sun at this event. Harold has a put forward a detailed entry with the details on the scenarios we tested and the results. Jiandong explains the WS-SX tests and the versions of specs they cover in his blog.
My focus at this event was to test for the first time our implementation of Kerberos Token Profile 1.1 for interoperability with .NET 3.x. The most difficult part for Kerberos interoperability turned out to be setting up the Kerberos infrastructure for trust. Once we were through this part, all the tests passed without any difficulty. The tests consisted of the following scenarios:
Basic Kerberos token tests
Kerberos Token with Derived Keys
SecureConversation with Kerberos token in Bootstrap policy
SecureConversation with Kerberos token and Derived Keys in Bootstrap policy
All these scenarios are available at the public endpoint from Microsoft at http://mssoapinterop.org/ilab/ . Harold has details on the exact tests and results in his blog.
These tests were run using a single KDC for WSIT client and WCF service and vice versa.
The Kerberos token support will release with a future release of Metro, but if you want to give it a try, you can get one of the nightlies from here. I plan to blog about setting up kerberos infrastructure and running kerberos scenarios in coming weeks.
The next step we want to try is to use different KDCs for client and service and test cross-domain security using Kerberos. We tried it this time and ran across some setup issues with DNS configurations and cross domain trust.
Hi, could you post links to the specs for "Derived Keys"?
Posted by Nico on November 16, 2007 at 11:45 PM IST #
Derived Keys are mentioned in WS-SecureConversation spec. You can find it here: http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/ws-secureconversation-1.3-os.html
Posted by Ashutosh on November 18, 2007 at 02:00 PM IST #
Hello,
I'm currently trying to combine the WS-Conversion spec, and the Kerberos Token Profile into WSS4j.
Currently I have one problem: To implement the DerivedKeyToken I need to obtain a symmetric key from Kerberos. There are two solutions, I can think of but both have problems:
- Use the kerberos session key or subkey directly. But how to obtain this from the sun jgss implementation?
- Generate a symmetric key for the P_SHA1 and send it over in the SecurityContextToken. But is this in line with the WS-SecureConversation spec?
Hope you can answer this question?
Ron
Posted by Ron van de Ven on February 29, 2008 at 01:58 PM IST #