SHYAM RAO

How to Renew a SecureConversationToken Using Metro 1.2

Renewal of SecureConversation Token for submitted and standard(WS-SX) version of SecureConversation specification is supported in Metro 1.2 release. In this blog, i will show you how to enable the renewal of SecureConversation Token automatically, once it is expired.

Metro 1.2 defines the following client side SecureConversation configuration policy :
    1) lifetime of SecureConversation Token.
    2) whether to Renew Expired Secure Session Tokens

Here is the client-side SecureConversation  policy, which has to be put in the client-side configuration (i.e. in wsit-client.xml file)

<scc:SCClientConfiguration xmlns:scc="http://schemas.sun.com/ws/2006/05/sc/client" renewExpiredSCT="true">
     <scc:LifeTime>36000</scc:LifeTime>
</scc:SCClientConfiguration>

We also have a tooling support for this configuration in Netbeans 6.0 onwards. Here is the Netbeans screenshots for configuring Web Services Client with SecureConversation policy.

 Figure 1 : Right click on Web Services Reference node and select Web Services Editor to configure Quality of Service on the client side 

Figure 2 : In Client's Web Services Editor, configure client with SecureConversation policy (i.e Token Lifetime, Enable/disable of token renewal)

Here is the format of Renew request from client :

 <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/" >
    <S:Header>
         ...........
        <Action xmlns="http://www.w3.org/2005/08/addressing" wsu:Id="_5004">
                    http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew</Action>
         .........

Here is the format of Renew response from service :

<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
    <S:Header>
         ...........
        <Action xmlns="http://www.w3.org/2005/08/addressing" wsu:Id="_5005"> 
                        http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew</Action>
         .........

In the WS-SX version of SecurityPolicy specification, MustNotSendRenew policy is being introduced under SecureConversationToken. MustNotSendRenew optional element is a policy assertion that indicates the  SCT Token issuer issuing the secure conversation token does not support SCT/Renew RST messages. If this assertion is not present it means that SCT/Renew RST messages are supported by the STS.

Here is the format of  MustNotSendRenew optional element under SecureConversationToken policy :

<sp:SecureConversationToken sp:IncludeToken="xs:anyURI"? xmlns:sp="..." ... >
    ........
    <wsp:Policy xmlns:wsp="...">
        .......
        <sp:MustNotSendRenew ... /> ?
        <sp:BootstrapPolicy ... >
            <wsp:Policy> ... </wsp:Policy>
        </sp:BootstrapPolicy>
    </wsp:Policy>
</sp:SecureConversationToken>

If client side SecureConversation configuration policy has renewExpiredSCT=true, and MustNotSendRenew optional element is not present in SecureConversationToken service policy, then the  renewal of  SCT token will be successful.

Posted at 09:52PM May 06, 2008 by Shyam Rao in WebServicesSecurity  |  Comments[6]