SmartBear/soapui — pull request #35 by wsalembi (2014-02-12 16:45:51+00:00)
Title: Wss sign custom token

Please consider this pull request so SoapUI can support the SAML Token Profile specification. My company implements the SAML Holder-of-Key security standard (using a WS-Trust compliant SecurityTokenService). Unfortunately it isn't supported by SoapUI yet.

There are two reasons why not:
1) The SAML (XML) component strips whitespace and breaks the signature embedded in the SAML assertion returned by the STS.
2) To reference the SAML assertion in the Signature KeyInfo, a wss4j custom token key identifier is needed to add the SAML Assertion Id. SignatureEntry does not allow custom tokens.

ID_c27deac8-568c-4ee6-a201-6a41bc3cb2a7

This pull request builds further open the previously submitted security patches (SOAP-4586 & SOAP-4430).

http://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-errata-os-SAMLTokenProfile.pdf