title: Which bits of SOAP / WS-Security / WS-Addressing / etc do I need to send this message
body: <p>EDIT:
  I think the only bit left to understand is the signing of the message using the <a href="http://msdn.microsoft.com/en-us/library/ms824701.aspx" rel="nofollow">username token profile</a>.  Any pointers/clues/info on how to implement that would be great.  I have played with the Visual Studio .Net 2003 with WSE 2 and the username token profile sample does this be default- so my fallback is to use that, but prefer to run on Linux, as that is the server we have.  Plus no Mono port of WSE. I get the impression that this is not used much/its deprecated...</p>
  
  <p>I have to talk to a Web Service and have been given the sample below.  I am trying to translate this into English... or at least understand which bits of the WS security specs I need to be looking at to communicate to it.</p>
  
  <p>I am using Ruby/<a href="http://savon.rubiii.com/" rel="nofollow">Savon</a> for other WS calls, but it seems to only support basic WSSE, username/passwords.  </p>
  
  <p>I can see this message has a <strong>Signature</strong> - but is it signed via an external file/certificate/code or do I have enough details below to do the same signing within my own code.</p>
  
  <p>I dont see any X509 or Cipher entries which seems to imply its not done with such a certificate (in my naive understanding of this), so what is being used to produce the Signature- perhaps just a simple hash of the message?</p>
  
  <p>It also seems to use some sort of digest/message checking as when I try tweaking the sample and resending it, its bounced as invalid - although I guess this might be related to the signature issue...</p>
  
  <p>I dont think Savon supports this and so I am thinking I need to switch to JRuby and use a Java WS library, perhaps <a href="http://axis.apache.org/axis2/java/rampart/index.html" rel="nofollow">Rampart</a> with <a href="http://axis.apache.org/axis2/java/core/index.html" rel="nofollow">Axis2</a> or maybe <a href="http://static.springsource.org/spring-ws/sites/1.5/" rel="nofollow">Spring security</a> bits.  Any tips/reccomendation/good tutorials?  I see <a href="http://www.ibm.com/developerworks/java/library/j-jws4/index.html" rel="nofollow">this from IBM</a>, but thinking I need something higher level so I can grasp the "big picture"</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:xsd="http://www.w3.org/2001/XMLSchema"
  xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/03/addressing"
  xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
  xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
  
    &lt;soap:Header&gt;
      &lt;wsa:Action wsu:Id="Id-6762c167-412b-4bf8-8839-518e9bc25da5"&gt;
      http://host/path/func&lt;/wsa:Action&gt;
      &lt;wsa:MessageID wsu:Id="Id-00bb0af8-232d-43a8-adbb-39f230599c56"&gt;
      uuid:2005639d-39b8-4df6-bf41-e18741c45291&lt;/wsa:MessageID&gt;
      &lt;wsa:ReplyTo wsu:Id="Id-c53a1dbe-244f-46a9-b656-883f4b06dcfe"&gt;
        &lt;wsa:Address&gt;
        http://schemas.xmlsoap.org/ws/2004/03/addressing/role/anonymous&lt;/wsa:Address&gt;
      &lt;/wsa:ReplyTo&gt;
      &lt;wsa:To wsu:Id="Id-017877f6-e5a3-43ae-aa2b-4886adb7060c"&gt;
      http://host/path/func.asmx&lt;/wsa:To&gt;
      &lt;wsse:Security soap:mustUnderstand="1"&gt;
        &lt;wsu:Timestamp wsu:Id="Timestamp-1a38d0f9-077f-4e95-991b-fa899a171920"&gt;
  
          &lt;wsu:Created&gt;2011-03-14T15:00:09Z&lt;/wsu:Created&gt;
          &lt;wsu:Expires&gt;2011-03-14T15:05:09Z&lt;/wsu:Expires&gt;
        &lt;/wsu:Timestamp&gt;
        &lt;wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
        wsu:Id="SecurityToken-42ae32d2-f6ff-431e-9369-7696b44965e3"&gt;
          &lt;wsse:Username&gt;crypteduser&lt;/wsse:Username&gt;
          &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;
          cryptedpass&lt;/wsse:Password&gt;
          &lt;wsse:Nonce&gt;fLSoqLm9kuOumxy39JRHaw==&lt;/wsse:Nonce&gt;
          &lt;wsu:Created&gt;2011-03-14T15:00:09Z&lt;/wsu:Created&gt;
        &lt;/wsse:UsernameToken&gt;
        &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;SignedInfo&gt;
            &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"
            xmlns:ds="http://www.w3.org/2000/09/xmldsig#" /&gt;
            &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1" /&gt;
            &lt;Reference URI="#Id-6762c167-412b-4bf8-8839-518e9bc25da5"&gt;
  
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;SAYl5o1kh33HteOe0L7G6KIKqWg=&lt;/DigestValue&gt;
            &lt;/Reference&gt;
            &lt;Reference URI="#Id-00bb0af8-232d-43a8-adbb-39f230599c56"&gt;
  
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;//LMuFkNC1FO1/9A9W7l6o75Y2M=&lt;/DigestValue&gt;
            &lt;/Reference&gt;
            &lt;Reference URI="#Id-c53a1dbe-244f-46a9-b656-883f4b06dcfe"&gt;
  
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;9pgN7bU48UKi1UTnpOCikOnp2G0=&lt;/DigestValue&gt;
            &lt;/Reference&gt;
            &lt;Reference URI="#Id-017877f6-e5a3-43ae-aa2b-4886adb7060c"&gt;
  
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;lWZNjtSHfVtiZeOFZAosV868Uos=&lt;/DigestValue&gt;
            &lt;/Reference&gt;
            &lt;Reference URI="#Timestamp-1a38d0f9-077f-4e95-991b-fa899a171920"&gt;
  
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;H3nYPY6kfIWEIWQhpwaz8VKeQIM=&lt;/DigestValue&gt;
            &lt;/Reference&gt;
            &lt;Reference URI="#Id-f95dfea2-3af8-4e95-8e60-141858db9532"&gt;
  
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;uRTu+Hzxw+zdaTYgW0z+j35diIQ=&lt;/DigestValue&gt;
            &lt;/Reference&gt;
          &lt;/SignedInfo&gt;
          &lt;SignatureValue&gt;
          Hdn2wxWhmr450pefMuc41o6GgOA=&lt;/SignatureValue&gt;
          &lt;KeyInfo&gt;
            &lt;wsse:SecurityTokenReference&gt;
              &lt;wsse:Reference URI="#SecurityToken-42ae32d2-f6ff-431e-9369-7696b44965e3"
              ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#UsernameToken" /&gt;
            &lt;/wsse:SecurityTokenReference&gt;
          &lt;/KeyInfo&gt;
        &lt;/Signature&gt;
      &lt;/wsse:Security&gt;
    &lt;/soap:Header&gt;
    &lt;soap:Body wsu:Id="Id-f95dfea2-3af8-4e95-8e60-141858db9532"&gt;
      &lt;func xmlns="http://host/path/"&gt;
        &lt;xml_in&gt;yucky xml inside xml...&lt;/xml_in&gt;
      &lt;/func&gt;
    &lt;/soap:Body&gt;
  &lt;/soap:Envelope&gt;
  </code></pre>
  
  <p>Many thanks in advance for any tips/pointers you can give.</p>
  
  <p>Regards,
  Chris</p>
  
  <p>EDIT</p>
  
  <p>Seems similar to this question... which does use an X509 cert, so perhaps it is needed.
  Currently reading the <a href="http://en.wikipedia.org/wiki/XML_Signature" rel="nofollow">wikipedia entry</a> for this.</p>
  
  <p>EDIT2</p>
  
  <p>Seems like its this - hopefully the username based option... <a href="http://msdn.microsoft.com/en-us/library/ms824647.aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/ms824647.aspx</a></p>
  
  <p>EDIT3</p>
  
  <p>I think I have most of it <a href="https://github.com/kimptoc/savon" rel="nofollow">sorted now</a> - the main thing outstanding is the username digest'ing. How do I do it - where does the signature value come from...</p>
  
  <p>EDIT4</p>
  
  <p>Thinking my best bet is to write a client in .Net and either that will give me enough clues to do it directly in Ruby, or I can wrap it in a simpler version - at least for the short term...</p>