Implements a "WSSE-based" authentication. By
including a WSSSE token a Cosmo request, the request can be
authenticated without sending the password in clear text,
as basic auth does.
Authentication Details
The algorithm works like this:
- Start with 2 pieces of information: username and password.
- Create a nonce, which is a cryptographically random string
- Create a "creation timestamp" of the current time, in W3DTF format
- Create a password digest:
PasswordDigest = Base64 \ (SHA1 (Nonce + CreationTimestamp + Password))
This requires the server to have access to the clear text password. Because
Cosmo only stores the MD5 hash, the MD5 hash can be thought of as the password
equivalent and all references to Password
really mean the MD5 hash
of the user's password.
The server verifies the token by re-calculating the hash given the username, nonce, creation timestamp,
and the password equivalent stored in the database. The server will reject any token
that does not match or that contains an out-of-date creation timestamp (to prevent replay attacks).
In future implementations, the nonce should be cached and tokens should also be rejected
if the nonce has been used before, but cosmo currently does not do this.
So an example on how to authenticate usssing a WSSE UserToken:
- User Joe has username "joeschmoe" has a password "abcd" (assume MD5 hash is 5f4dcc3b5aa765d61d8327deb882cf99)
- Joe creates a nonce, "d36e316282959a9ed4c89851497a717f"
- Joe created this nonce at "2003-12-15T14:43:07Z", so that's the creation timestamp.
- Joe's password digest is
Base64(SHA1 ("d36e316282959a9ed4c89851497a717f" + "2003-12-15T14:43:07Z" + "5f4dcc3b5aa765d61d8327deb882cf99"))
, which is "quR/EWLAV4xLf9Zqyw4pDmfV90Y=".
- Joe request includes the following header:
X-WSSE: UsernameToken Username="bob", PasswordDigest="quR/EWLAV4xLf9Zqyw4pDmfV9OY=", Nonce="d36e316282959a9ed4c89851497a717f", Created="2003-12-15T14:43:07Z"
Related Documentation