[Perlgssapi-users] Ws-Security

[Massimiliano M. <mas...@ce...>]

Hello, 

I've another tedious question. I've decided to implement 
my webservices as is, exchanging gss messages in the soap
envelope. Is secure by the protocol. 

I'm referring at your examples, from now:

As you told me, once created the context, I would like to use
this context, using GSS_wrap() and GSS_unwrap(). 

First question: are these function available in your perl module?

What is the value of the variable $gss_output_token, after the first call
to GSSAPI::Context::init?

Where is stored the session key?

Second question: of course, the webservice is stateless. I've to
mantaining a state between the client and the webserver, as a session. 

I've to create a function like this (your example: line 123 and following):

# $gss_output_token is returned by the init() context

if($gss_output_token) {
  print "$counter CLIENT::have token to send ...\n";
  print "$counter CLIENT::GSS token length is " . length($gss_output_token) . "\n";

  #
  # $gss_output_token is binary data
  #
  my $gss_input_token = soap_send(encode_base64($gss_output_token, ''),
	                          uniqueid);
	
  print "$counter CLIENT::sent token to server\n";
}

if ($status->major & GSS_S_CONTINUE_NEEDED) {
 print "$counter CLIENT::Mutual auth requested ...\n";
 if ($gss_input_token) {
   print "$counter CLIENT::got mutual auth token from server\n";
   $gss_input_token = decode_base64($gss_input_token);
   print "$counter CLIENT::mutual auth token length is " . length($gss_input_token) . "\n";
} else {
    print "$counter CLIENT::server did not send needed continue token back\n";
	    $error = 1;
}

And then, second time of while, call to init() for the second time, 
and get mutualauth.


Where uniqueid is a value unique for the client that the server stores 
in the disk as httpsession for maintaining a state. My question is:

Imagine that now I've to send a message to the server, containing the 
string "Achim".

What I should pass now to the server, for using the context? What I must
store with the uniqueid for continuing to use the context, after the
death of the webserice?

Thank you!


-- 
Massimiliano Masi

http://www.comunidelchianti.it/~max