1

I have a SOAP server. The soap request that is receiving at the server has ws security headers. Following are the main nodes of the request XML.

  1. BinarySecurityToken (X509PKIPathv1 certificate)
  2. DigestMethod
  3. DigestValue
  4. SignatureValue
  5. SecurityTokenReference

  6. Data (data that is send by client in SOAP body)

I have to verify the request using the certificate(.cer files) which is provided by the client (sender of the request).

What are the steps I have to do to validate the requests? I Googled but no hope. Please help me to understand the concept.

closed as off-topic by Deer Hunter, user45139, RoraΖ, TildalWave, WhiteWinterWolf Oct 17 '15 at 11:28

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Deer Hunter, Community, WhiteWinterWolf
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Even if the request is transmitted over TLS, the authentication does not use TLS client-auth. Why do you think this has something to do with TLS and OpenSSL? Look into WS-Security and the library/framework you work with to find out how to validate the request. – Z.T. Oct 16 '15 at 17:40
  • It just completely depends on which SOAP server you are using and your exact use-case. I fear there is no general answer which can be given to this question (moreover development or product configuration requests are most likely out-of-topic here). – WhiteWinterWolf Oct 17 '15 at 11:27