Wrong password digest #22

coinicon72 · 2015-01-15T03:43:11Z

I'm using ws-security password digest, and I found the digest may be wrong.

SOAPEngine generated following xml:
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">NDY3ZDM0ZTU2NDAzNjc4Njg4YmJlODRmY2E1MWUzYTk3ZDQxYzM2Zg==/wsse:Password<wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">MEQ0RDJDQkIzMjM4NEMxODg1QkUwMDU5NDZEMTZERUM=/wsse:Noncewsu:Created2015-01-15T03:33:24Z/wsu:Created

the digest was: NDY3ZDM0ZTU2NDAzNjc4Njg4YmJlODRmY2E1MWUzYTk3ZDQxYzM2Zg==

But my server (CXF) calculated out digest was: WvY1DPYdw/xcQKvULVEvREXx2wg=

They are different.

I also confirmed this issue by soapui.

So, could you please check this out?

Thanks!

coinicon72 · 2015-01-15T03:45:51Z

What? the XML tags are all gone? However, I thought you can still get info from it.

priore · 2015-01-16T17:10:28Z

usually the last standard for the digest is composed nonce + date + password and encode this with sha1 + base64, maybe your server encoding with md5?

coinicon72 · 2015-01-17T02:57:29Z

Thank for your reply.

SHA1 should output a 20 bytes array, and this should be base64 directly, we'll got a string which length is about 28 characters.

your digest is: NDY3ZDM0ZTU2NDAzNjc4Njg4YmJlODRmY2E1MWUzYTk3ZDQxYzM2Zg==, this is a little long than we expected.

I decode your digest and I got "467d34e56403678688bbe84fca51e3a97d41c36f", seems you converted the SHA1 output to hex string before base64.

plus, even convert "467d34e56403678688bbe84fca51e3a97d41c36f" to a byte array, seems it's not the right one.

My server is based on Apache CXF framework, I think it will not fail me in this point.

Thanks.

priore · 2015-01-17T12:01:02Z

is true, it is converted to hexadecimal, this is a mistake, now I send email to you with this fix and after if you confirm for me that is correct, after will update github and, of course, you will have one free license for your excellent cooperation and for your patience

priore · 2015-01-17T12:19:04Z

Please, download and try this, look a your feedback. SOAPEngine

coinicon72 · 2015-01-18T07:04:44Z

Hi priore,

Thanks for your works.

I have tested the lib you sent to me, and noticed that the digest still
been converted to hex string before base64.

Here is my obj-c code to generate the digest:

+(NSString_)GenaratePasswordDigest:(NSData_)nonceBytes
Created:(NSString_)created
Password:(NSString_)password

{

NSData* bc = [created dataUsingEncoding:NSUTF8StringEncoding];

NSData* bp = [password dataUsingEncoding:NSUTF8StringEncoding];

NSMutableData* buff = [NSMutableData alloc];

[buff appendData:nonceBytes];

[buff appendData:bc];

[buff appendData:bp];

uint8_t digest[CC_SHA1_DIGEST_LENGTH];

CC_SHA1(buff.bytes, (CC_LONG)buff.length, digest);

//

NSData* ds = [NSData dataWithBytes:digest length:CC_SHA1_DIGEST_LENGTH];

return [ds base64Encoding];

}

The [NSData base64Encoding] is a catalogy, I'm sure you alreay have a
base64 encoder.

Cheers.

2015-01-17 20:19 GMT+08:00 Danilo Priore notifications@github.com:

Please, download and try this, look a your feedback. SOAPEngine
http://www.prioregroup.com/zips/soapengine1.11.2.zip

—
Reply to this email directly or view it on GitHub
#22 (comment).

priore · 2015-01-18T12:47:52Z

sorry, i found a double coding (mistakenly!).

a9eeaf3

the code that used is written like this :

        CFUUIDRef theUUID = CFUUIDCreate(NULL);
        CFStringRef uuidRef = CFUUIDCreateString(NULL, theUUID);
        NSString *nonce = [(__bridge NSString*)uuidRef stringByReplacingOccurrencesOfString:@"-" withString:@""];
        CFRelease(uuidRef);
        CFRelease(theUUID);

        // digest password
        NSString *s_digest = [NSString stringWithFormat:@"%@%@%@", nonce, created, password];
        NSData *data = [s_digest dataUsingEncoding:NSUTF8StringEncoding];
        uint8_t b_digest[CC_SHA1_DIGEST_LENGTH];
        CC_SHA1(data.bytes, (CC_LONG)data.length, b_digest);
        NSData *digest [[NSData alloc] initWithBytes:b_digest length:CC_SHA1_DIGEST_LENGTH];
        NSString *digestbase64 = [SOAPBase64 base64EncodingWithData:digest];

Sorry for this tests that you do, but at this time I do not have more a server with ws-security for testing it, anyway you will receiving an gift for your trouble, please send me an email to support (at) prioregroup.com for this special gift.

many thanks

coinicon72 · 2015-01-19T05:55:57Z

Hi priore,

Here's your output, I exactd this from my server's log:

<wsse:UsernameToken xmlns:wsu="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
">
wsse:Usernamecoinicon@163.com/wsse:Username
<wsse:Password Type="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest
">23ng4kIel+HtmXjWKGRM+NIQYxo=/wsse:Password
<wsse:Nonce EncodingType="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
">7C1853013A9E4406A32B13BE6B8C868B/wsse:Nonce
wsu:Created2015-01-19T05:42:06Z/wsu:Created
/wsse:UsernameToken

Yes, the digest's length seems ok, but this request still not valid.

Turns out your nonce is the original uuid string(replaced "-" with " ")
, however, you should put base64 of nonce here.

Cheers.

2015-01-18 20:47 GMT+08:00 Danilo Priore notifications@github.com:

sorry, i found a double coding (mistakenly!).

download http://www.prioregroup.com/zips/soapengine1.11.2b.zip

the code that used is written like this :
    CFUUIDRef theUUID = CFUUIDCreate(NULL);
    CFStringRef uuidRef = CFUUIDCreateString(NULL, theUUID);
    NSString *nonce = [(__bridge NSString*)uuidRef stringByReplacingOccurrencesOfString:@"-" withString:@""];
    CFRelease(uuidRef);
    CFRelease(theUUID);

    // digest password
    NSString *s_digest = [NSString stringWithFormat:@"%@%@%@", nonce, created, password];
    NSData *data = [s_digest dataUsingEncoding:NSUTF8StringEncoding];
    uint8_t b_digest[CC_SHA1_DIGEST_LENGTH];
    CC_SHA1(data.bytes, (CC_LONG)data.length, b_digest);
    NSData *digest [[NSData alloc] initWithBytes:b_digest length:CC_SHA1_DIGEST_LENGTH];
    NSString *digestbase64 = [SOAPBase64 base64EncodingWithData:digest];
Sorry for this tests that you do, but at this time I do not have more a
server with ws-security for testing it, anyway you will receiving an gift
for your trouble, please send me an email to support (at) prioregroup.com
for this special gift.

many thanks

—
Reply to this email directly or view it on GitHub
#22 (comment).

priore · 2015-01-19T10:08:29Z

hi,
but the second version (1.11.2, no b) was just so

v.1.11.1 - base64(sha1-hex(base64(nonce)+date+password)) is wrong.
v.1.11.2 - base64(sha1(base64(nonce)+date+password)) is wrong.
v.1.11.2b base64(sha1(nonce+date+password) is wrong ??

nonce = uuid, perhaps use uuid is wrong ?
I need to install a server ws-security, otherwise I can not understand, sorry.

coinicon72 · 2015-01-19T10:12:31Z

Hi,

Sorry, maybe I'm not make myself clear.

digest = base64(sha1(nonce+date+password) , this is no question.

however, you should put base64(nonce) in xml nonce node, not nonce
directly.

Cheer.

2015-01-19 18:08 GMT+08:00 Danilo Priore notifications@github.com:

hi,
but the second version (1.11.2, no b) was just so

v.1.11.1 - base64(sha1-hex(base64(nonce)+date+password)) is wrong.
v.1.11.2 - base64(sha1(base64(nonce)+date+password)) is wrong.
v.1.11.2b base64(sha1(nonce+date+password) is wrong ??

nonce = uuid, perhaps use uuid is wrong ?
I need to install a server ws-security, otherwise I can not understand,
sorry.

—
Reply to this email directly or view it on GitHub
#22 (comment).

coinicon72 · 2015-01-19T10:18:04Z

Hi,

here is my xml:

<wsse:Nonce EncodingType="
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
">YzdiNWE4YmQtM2UzMS00MmFmLWExYmMtYzNhNGUxYmUwZjMw/wsse:Nonce

you can decode nonce, and it should be
: c7b5a8bd-3e31-42af-a1bc-c3a4e1be0f30 .

see, I also use uuid as nonce, but you should put base64(nonce) here.
you may also noticed that nonce using Base64Binary as encodingtype, this
implied base64 should applied.

Cheer.

2015-01-19 18:12 GMT+08:00 曹春 coinicon@gmail.com:

Hi,

Sorry, maybe I'm not make myself clear.

digest = base64(sha1(nonce+date+password) , this is no question.

however, you should put base64(nonce) in xml nonce node, not nonce
directly.

Cheer.

2015-01-19 18:08 GMT+08:00 Danilo Priore notifications@github.com:

hi,
but the second version (1.11.2, no b) was just so

v.1.11.1 - base64(sha1-hex(base64(nonce)+date+password)) is wrong.
v.1.11.2 - base64(sha1(base64(nonce)+date+password)) is wrong.
v.1.11.2b base64(sha1(nonce+date+password) is wrong ??

nonce = uuid, perhaps use uuid is wrong ?
I need to install a server ws-security, otherwise I can not understand,
sorry.

—
Reply to this email directly or view it on GitHub
#22 (comment).

priore · 2015-01-19T10:24:10Z

yes, I understand, it is true, thanks ;)

a9eeaf3

coinicon72 · 2015-01-19T11:31:23Z

Good news, the digest and nonce are all correct and passed the CXF check.

Congratulations!

But, now I'm facing a namespace issue, and trying to figure out why.
Maybe you can give me some helps.

Here is xml snippet from the request which works, I ignored the ws-security
part:

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"
xmlns:ws="http://ws.qs.ihealthtrack.com/">
soap:Body
ws:GetProfile/
/soap:Body
/soap:Envelope

Following is the request which created by soapengine and does not works:

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance">
soap:Body

/soap:Body
/soap:Envelope

Could you please point out what's the different between those two?

Thanks!

2015-01-19 18:24 GMT+08:00 Danilo Priore notifications@github.com:

yes, I understand, it is true, thanks ;)

download http://www.prioregroup.com/zips/soapengine1.11.2c.zip

—
Reply to this email directly or view it on GitHub
#22 (comment).

priore · 2015-01-19T12:01:07Z

try with this :

soap.envelope = @"xmlns:ws=\"http://ws.qs.ihealthtrack.com/\"";

and in the requestURL method to use @"ws:GetProfile" for soapAction param.

coinicon72 · 2015-01-20T03:54:31Z

Hi,

I'm using soap1.2 and got a error.

the content-type from your http header like this:
Content-Type: text/xml; charset=utf-8, action="xxxxxx"\r\n

I think you put a comma (instead of a semicolon) after "utf-8" by
mistake, and this raise a error.

2015-01-19 20:01 GMT+08:00 Danilo Priore notifications@github.com:

try with this :

soap.envelope = @"xmlns:ws="http://ws.qs.ihealthtrack.com/\"";

and in the requestURL method to use @"ws:GetProfile" for soapAction param.

—
Reply to this email directly or view it on GitHub
#22 (comment).

priore · 2015-01-20T14:42:21Z

fixed 789c3c7

coinicon72 · 2015-01-24T02:22:11Z

seems not fixed the comma issue yet.

correct format should be:
Content-Type: text/xml; charset=utf-8; action="xxxxxx"

priore · 2015-01-24T13:47:12Z

sorry, maybe you're using an older version, the new version 789c3c7 the content type is text/xml; charset=utf-8; action="http://www.prioregroup.com/GetVerses"

coinicon72 mentioned this issue Jan 15, 2015

Under ws-security mode, SOAPEngine treats local datetime as GMT datetime #20

Closed

priore added the wontfix label Jan 17, 2015

priore closed this as completed Feb 8, 2015

priore added bug and removed wontfix labels May 10, 2015

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Wrong password digest #22

Wrong password digest #22

coinicon72 commented Jan 15, 2015

coinicon72 commented Jan 15, 2015

priore commented Jan 16, 2015

coinicon72 commented Jan 17, 2015

priore commented Jan 17, 2015

priore commented Jan 17, 2015

coinicon72 commented Jan 18, 2015

priore commented Jan 18, 2015

coinicon72 commented Jan 19, 2015

priore commented Jan 19, 2015

coinicon72 commented Jan 19, 2015

coinicon72 commented Jan 19, 2015

priore commented Jan 19, 2015

coinicon72 commented Jan 19, 2015

priore commented Jan 19, 2015

coinicon72 commented Jan 20, 2015

priore commented Jan 20, 2015

coinicon72 commented Jan 24, 2015

priore commented Jan 24, 2015

Wrong password digest #22

Wrong password digest #22

Comments

coinicon72 commented Jan 15, 2015

coinicon72 commented Jan 15, 2015

priore commented Jan 16, 2015

coinicon72 commented Jan 17, 2015

priore commented Jan 17, 2015

priore commented Jan 17, 2015

coinicon72 commented Jan 18, 2015

priore commented Jan 18, 2015

coinicon72 commented Jan 19, 2015

priore commented Jan 19, 2015

coinicon72 commented Jan 19, 2015

coinicon72 commented Jan 19, 2015

priore commented Jan 19, 2015

coinicon72 commented Jan 19, 2015

priore commented Jan 19, 2015

coinicon72 commented Jan 20, 2015

priore commented Jan 20, 2015

coinicon72 commented Jan 24, 2015

priore commented Jan 24, 2015