Options of login module "DigestLoginModule"

[ankit_srivastava3]

Hello Experts,

I am configuring a login policy using "DigestLoginModule" at http://<host:port>/nwa/auth . I would like to use option for skew time. What is the correct option for skew time?

Thanks & Regards,

Ankit Srivastava

[Former Member]

Hi Ankit,

what should be the purpose of skew time for digest authentication?

As you tagged the thread being related to WSSEC, do you refert to WS-Security based authentication? This should be part of the sender agreement. Please check the docs for more info on this.

Kind regards,

Patrick

[ankit_srivastava3]

Hello Patrick,

Thanks for a quick reply.

In WS-Security header, I want to use time skew to allow for any small variation in the clocks of sender & PO system.

I am using SOAP Adapter with AXIS to define & use username token andwsu:Timestamp. I am not sure as where to define the time skew in this case. Please suggest.

Regards,

Ankit

[Former Member]

Hi Ankit,

sorry, I'm not an expert for the Axis Adapter. However did you check the AXIS FAQ? They have some info on how to do WS-Security with AXIS. This also includes how to use WS Security with AXIS.

Regards,

Patrick

[ankit_srivastava3]

Hello Patrick,

Yes, I have already checked AXIS FAQ and it does talk about WS-Security but it does not talk about additional options/features like time skew.

Thanks,

Ankit

[Former Member]

Hi Ankit,

The feature is simply not called time skew but validity peroid. As written in the docs:

In addition, you specify a validity period in the sender agreement, within which the delivery of a message is accepted (based on the time stamp).

So you have to set the timestamp on one end (this is what you already did) and specify a permitted difference between timestamp and actual time the message was received.

Please see the part on 'Security Settings for Time Stamp and Expiry Date of Signature' in the docs.

Regards,

Patrick

[Former Member]

Hello Ankit

I am not sure if you are already aware of this. DigestLoginModule is not supported by SAP. Although DigestLoginModule is available in sap documentation and also available in the list of available login modules in visual admin and nwa, but it does not work and was not meant to work in the past. I have asked the responsible colleagues in sap to change sap documentation accordingly. It will take some time. I faced similar situation with another customer and this what i told him too.

Please post back should you need any further clarification.

Cheers

Tapan

[ankit_srivastava3]

Hello Tapan,

I am not aware of this - "DigestLoginModule is not officially supported by SAP". Now, this brings me to another question:

"How is WS-Security password digest is supported by SAP in such a case?"

Regards,

Ankit Srivastava

[Former Member]

Hello Ankit

Please refer sap help link:

Recommended WS Security Scenarios (Java)

=================================

https://help.sap.com/saphelp_nwce72/helpdata/en/48/8ebbba66be06b2e10000000a42189b/frameset.htm

Regards,

Tapan

[Ivan-Mirisola]

Hi,

Please read the following note:

http://service.sap.com/sap/support/notes/2028823

It is valid for all releases. The DigestLoginModule is not officially supported by SAP.

BR,

Ivan