Encrypting UsernameTokens in WSE2

Thanks Benjamin for this info on how to encrypt a UsernameToken. I didn’t happen to see it anywhere else. I mostly liked looking at the soap message to see the effect (note that username=”John”, password=”Doe” and I am hashing the password in both cases and then encrypting the UsernameToken in the AFTER). Cool! I love this stuff. It’s like a big game. Based on the length of the encrypted UsernameToken, can you tell what I used to encrypt it with?

BEFORE

<wsse:UsernameToken wsu:Id=”SecurityToken-87259cd0-5a08-4a51-881e-fa901b96d5d9>
  <wsse:Username>john</wsse:Username>
  <wsse:Password Type=”http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest>z1YyKPkZdyPd0Hfs86gKWgQRurs=</wsse:Password>
  <wsse:Nonce>14KcMOY5cCTeMCTNPeCypA==</wsse:Nonce>
  <wsu:Created>2004-11-02T22:35:43Z</wsu:Created>
  </wsse:UsernameToken>
 
and AFTER
<wsse:UsernameToken wsu:Id=”SecurityToken-428cde88-3f56-47bd-8d09-e5efef45fca3>
<xenc:EncryptedData Id=”EncryptedContent-caa96918-e4ee-41c0-bafc-9b9740c6feea Type=”http://www.w3.org/2001/04/xmlenc#Content xmlns:xenc=”http://www.w3.org/2001/04/xmlenc#>
  <xenc:EncryptionMethod Algorithm=”http://www.w3.org/2001/04/xmlenc#aes128-cbc />
<xenc:CipherData>
  <xenc:CipherValue>4xon7GAwNMsX3hU9kJ2atKGCf3bVbj/W6G5JsLV2lirb
WPyLuXcVG1bhzxeY6RPB1sElmVKMCz6iqfsC1yP
q/+HjhDKb5dB8h1NwPMSIkFbIkikHl3RyXSgUhtF
xUayFNAsef/Nq6XqN4WqwjWFG+x6il86Mf/x3O
IsojxHxVrqkyNbMw5OmHjbQBiM8bYFIpEDnk
1bYXB7zerytLP1zhPkBL+91ZptyTdZI2m3kFqc5e
/wtyFQInZ02ePhfUDPTc0jSlHDLPfDUN/doEkexe
Q264gYjWzXq1jaSFptxLDzcgOoH3f9AoQKsCitl
wo3tY2rLnK8lLgUOhjqbNV2FIiTwV/7aAVzhNmL
WzZdnBHRtA82X3jiqMtrvcyG2D0IDYfzFdLevp1
QPyil6Q9vaGr4I3yaUlqcgL+Ap5xn52lupxC+rv
Jv+xL2Xc9vKJaICsx8ib4ThGLod/damll3XO/1fbho1
NUU06nbMplzcifajNaVRsM4GbdLFsQfwp5rY1mePJpsjGq
m2hw7c1yxnlu4hCjDLdaxQU0H0IbPOlCufi6TT9jU+nPn
sCYg8p6sZXtKAoA4LAhgyKRduJMJmyV0Kjdh1pRUy4X
HKWxW1cxU/k4fC5VYaaDIpK6WK3eXcyoQ/RTRUzW4f
qeLgrUr6qXSSFF7WqZb4M+ZQYqqLl5Geq8AgPJrMNKC
xp1R1kQBFGwCRMALLR6L8BV0QhJgyIczuFyXSlpjJNSH
YJqBvTAeMTZwiIsmZeLTqgIFnMQ11XuGk8sc/P70ByYJ
WNP0Axt1I1gpjONzV4cwgu//fZD6DCRC4YW4NDBQAL
J687nfezcENZuBAHqUOxb7d/PRHcgCX0C1ggso63eOg
3XWFrvN+QreU3xmAEGJNZJCJFXeav+mg52lzJGCV15
Dv85ziccHHctOUxLYjIbaD647NDM4=</xenc:CipherValue>
  </xenc:CipherData>
  </xenc:EncryptedData>
  </wsse:UsernameToken>


Posted from BLInk!

Crystal Reports.NET Developer Zone

You probably know that Crystal was bought by Business Objects last year. Crystal is a great product with a horrible support reputation. That’s not about individual support people (I spoke with an awesome one last night) but just an overall problem. I have suffered plenty as well. I will never get past the experience of upgrading from 6.0 to 8.0 and how it horribly shattered many of my client applications and the deployment nightmares I went through (and my famous $500 phone bill for calling the free support line in Canada). And still, when I do have a problem, I sometimes cannot find the solution to it (granted at this point I have wierd problems, but still….)

But they are really trying. Now they have a .NET Developer Zone. It’s still a work in progress, but the more we use it, the better it will get.

I know that we all want it to be a good resource. So use it and if you don’t like it, let them know about it. Let them know what they can do to make it good so that we don’t roll our eyes when talking about Crystal Reports.

This is the tool I have used for years and am still using it even though I do keep looking over at ActiveReports and SQL Reporting Services. The hook for me is I know how to use Crystal. I only run into trouble once in a while, but I just don’t wnat to have to spend 4 hours researching a problem and still not come up with a solution.



Posted from BLInk!

WSE2 in production app

Did I happen to mention that I have WSE2 running in a production app? We are replacing the old version of the app with the new one a few users at a time at the client site and on the laptops as well as at the few remote sites. They won’t know the difference, but I sure do!

Posted from BLInk!

oops – I’m a dope

I have been trying to figure out why my crystal reports are mysteriously growing to 2+MB in one of my applications. Ummm DUH – I kind of forgot that I had embedded a watermark in them and that file is over 1MB. I actually got them to call me to help me about it (awesome tech support guy who has been with Crystal for 7 years). I think sometimes I am too quick to get aggravated by Crystal.

Now I have to figure out how to either shrink the watermark or I was told I can deploy the rpt files outside of the dlls.

Update: not so dopey. Even if I use a 30KB jpeg for the watermark, it still get’s morphed into an OLE bitmap and makes a 400KB dll with a crystal report in it go to 2MB. It’s just how it works.

Posted from BLInk!

Wow – I created my first pain free cd

I have always had problems writing cd’s. This is with 2 different cdr’s and lots of different software over the course of many many years. I would have to toss about 2 cd’s for everyone written. So I basically avoid it like the plague. But I just downloaded an ISO image and discovered that Windows XP has built in software and I don’t have to struggle any more. I just dragged and dropped the file to the cd in windows explorer and xp handled the rest. Finally. Thanks to whomever put that in there.

Of course I still have to test that it worked…

Okay I confess. I literally copied the ISO so I had to toss 2 cd’s after all. Then read the in your face ISO instructions and downloaded ISO Recorder (note there’s an XP and a new XPSP2 Beta version) and also note this is shareware. If you use it enough to justify thanking the creator, click on that PayPal button. This makes it pain free – right click on the ISO file and you’re almost done. Thanks Alex!!

Posted from BLInk!