Lua Requires Chilkat v9.5.0.66+
Lua
SOAP WS-Security UsernameToken
See more XML Examples
Demonstrates how to add a UsernameToken with the WSS SOAP Message Security header.Chilkat Lua Downloads
local chilkat = require("chilkat")
-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.
-- An HTTP SOAP request is an HTTP request where the SOAP XML composes the body.
-- This example demonstrates how to add a WS-Security header such as the following:
--
-- <wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-6138db82-5a4c-4bf7-915f-af7a10d9ae96">
-- <wsse:Username>user</wsse:Username>
-- <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">CBb7a2itQDgxVkqYnFtggUxtuqk=</wsse:Password>
-- <wsse:Nonce>5ABcqPZWb6ImI2E6tob8MQ==</wsse:Nonce>
-- <wsu:Created>2010-06-08T07:26:50Z</wsu:Created>
-- </wsse:UsernameToken>
--
-- First build some simple SOAP XML that has some header and body.
local xml = chilkat.Xml.new()
xml.tag = "env:Envelope"
xml:add_attribute("xmlns:env", "http://www.w3.org/2003/05/soap-envelope")
xml:update_attr_at("env:Header|n:alertcontrol", true, "xmlns:n", "http://example.org/alertcontrol")
xml:update_child_content("env:Header|n:alertcontrol|n:priority", "1")
xml:update_child_content("env:Header|n:alertcontrol|n:expires", "2001-06-22T14:00:00-05:00")
xml:update_attr_at("env:Body|m:alert", true, "xmlns:m", "http://example.org/alert")
xml:update_child_content("env:Body|m:alert|m:msg", "Pick up Mary at school at 2pm")
print(xml:get_xml())
print("----")
-- The following SOAP XML is built:
-- <env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope">
-- <env:Header>
-- <n:alertcontrol xmlns:n="http://example.org/alertcontrol">
-- <n:priority>1</n:priority>
-- <n:expires>2001-06-22T14:00:00-05:00</n:expires>
-- </n:alertcontrol>
-- </env:Header>
-- <env:Body>
-- <m:alert xmlns:m="http://example.org/alert">
-- <m:msg>Pick up Mary at school at 2pm</m:msg>
-- </m:alert>
-- </env:Body>
-- </env:Envelope>
--
-- Now build the WSSE XML housing that we'll insert into the above SOAP XML at the end.
-- <wsse:Security>
-- <wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="WSU_ID">
-- <wsse:Username>USERNAME</wsse:Username>
-- <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">PASSWORD_DIGEST</wsse:Password>
-- <wsse:Nonce>NONCE</wsse:Nonce>
-- <wsu:Created>CREATED</wsu:Created>
-- </wsse:UsernameToken>
-- </wsse:Security>
local wsse = chilkat.Xml.new()
wsse.tag = "wsse:Security"
wsse:update_attr_at("wsse:UsernameToken", true, "xmlns:wsu", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd")
wsse:update_attr_at("wsse:UsernameToken", true, "wsu:Id", "WSU_ID")
wsse:update_child_content("wsse:UsernameToken|wsse:Username", "USERNAME")
wsse:update_attr_at("wsse:UsernameToken|wsse:Password", true, "Type", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest")
wsse:update_child_content("wsse:UsernameToken|wsse:Password", "PASSWORD_DIGEST")
wsse:update_child_content("wsse:UsernameToken|wsse:Nonce", "NONCE")
wsse:update_child_content("wsse:UsernameToken|wsu:Created", "CREATED")
print(wsse:get_xml())
print("----")
-- Insert the wsse:Security XML into the existing SOAP header:
local xHeader = xml:get_child_with_tag("env:Header")
xHeader:add_child_tree(wsse)
-- Now show the SOAP XML with the wsse:Security header added:
print(xml:get_xml())
print("----")
-- Now our XML looks like this:
-- <env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope">
-- <env:Header>
-- <n:alertcontrol xmlns:n="http://example.org/alertcontrol">
-- <n:priority>1</n:priority>
-- <n:expires>2001-06-22T14:00:00-05:00</n:expires>
-- </n:alertcontrol>
-- <wsse:Security>
-- <wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="WSU_ID">
-- <wsse:Username>USERNAME</wsse:Username>
-- <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">PASSWORD_DIGEST</wsse:Password>
-- <wsse:Nonce>NONCE</wsse:Nonce>
-- <wsu:Created>CREATED</wsu:Created>
-- </wsse:UsernameToken>
-- </wsse:Security>
-- </env:Header>
-- <env:Body>
-- <m:alert xmlns:m="http://example.org/alert">
-- <m:msg>Pick up Mary at school at 2pm</m:msg>
-- </m:alert>
-- </env:Body>
-- </env:Envelope>
--
-- -----------------------------------------------------
-- Now let's fill-in-the-blanks with actual information...
-- -----------------------------------------------------
local wsu_id = "Example-1"
wsse:update_attr_at("wsse:UsernameToken", true, "wsu:Id", wsu_id)
local password = "password"
local username = "user"
wsse:update_child_content("wsse:UsernameToken|wsse:Username", username)
-- The nonce should be 16 random bytes.
local prng = chilkat.Prng.new()
local bd = chilkat.BinData.new()
-- Generate 16 random bytes into bd.
prng:gen_random_bd(16, bd)
local nonce = bd:get_encoded("base64")
wsse:update_child_content("wsse:UsernameToken|wsse:Nonce", nonce)
-- Get the current date/time in a string with this format: 2010-06-08T07:26:50Z
local dt = chilkat.DateTime.new()
dt:set_from_current_system_time()
local bLocal = false
local created = dt:get_as_timestamp(bLocal)
wsse:update_child_content("wsse:UsernameToken|wsu:Created", created)
-- The password digest is calculated like this:
-- Password_Digest = Base64 ( SHA-1 ( nonce + created + password ) )
bd:append_string(created, "utf-8")
bd:append_string(password, "utf-8")
local crypt = chilkat.Crypt2.new()
crypt.hash_algorithm = "SHA-1"
crypt.encoding_mode = "base64"
local passwordDigest = crypt:hash_bd_enc(bd)
wsse:update_child_content("wsse:UsernameToken|wsse:Password", passwordDigest)
-- Examine the final SOAP XML with WS-Security header added.
print(xml:get_xml())