Web Services Guide

10.5.7
- 10.5.6
- 10.4.0
- 10.2.2 Service Pack 1
- 10.2.2
- 10.2.1

Back Next

Digested Password

Include a digested password in the user name token header of a SOAP request when the user password is an encrypted password that is hashed with a nonce value and a time stamp. The Data Integration Service can process digested passwords in the UsernameToken element.

When you use a digested password, the UsernameToken element includes the following child elements:

Username element: Contains a user name that can be found in the Native security domain.
Password element: Contains a digested password. The password is the value generated from hashing the password concatenated with the nonce value of the Nonce element and the time stamp in the Created element. The password must be hashed with the SHA-1 hash function and encoded to Base64. For digested password security, set the Type attribute of the Password element to "PasswordDigest."
Nonce element: Contains a nonce value, which is a random value that can be used only once. By default, it is valid for 300 seconds after the time that the request is created, as indicated by the value in the Created element. The client application must send the request within the time that the nonce value is valid. For example, the Created value indicates that the request was created at 10:00 a.m. The request is valid from 10:00 a.m. to 10:05 a.m. If the client application sends the request to the web service before 10:00 a.m. or after 10:05 a.m., then the request and the nonce value are not valid and the request will fail.
Created element: Contains a time stamp value that indicates the time when the request was created. The time stamp uses the UTC format,
yyyy-MM-dd'T'HH:mm:ss.SSS'Z'.
For example:
2008-08-11T18:06:32.425Z.

The digested password uses the standard OASIS password digest algorithm:

Password_Digest = Base64 ( SHA-1 ( nonce + created + password ) )

You can use any tool to generate the nonce value, time stamp, and the digested password.

The following sample SOAP header shows an example of a UsernameToken element with a digested password:

<soap:Header>
      <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
         <wsse:UsernameToken wsu:Id="UsernameToken-14" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
            <wsse:Username>Administrator</wsse:Username>
            <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">Ntm58Cxf7SBOQAz3OlsTq1nv-D7</wsse:Password>
            <wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">zWELHdoAzNjQQ9xzlIwFZA==</wsse:Nonce>
            <wsu:Created>2010-10-15T20:56:18.633Z</wsu:Created>
         </wsse:UsernameToken>
      </wsse:Security>
</soap:Header>

Rename Saved Search

Table of Contents

Web Services Guide

Web Services Guide

Digested Password

Digested Password