Page History

Versions Compared

Key

This line was added.
This line was removed.
Formatting was changed.

...

Et typisk request vil have nogenlunde følgende struktur:

Code Block

collapse	true

<?xml version="1.0" encoding="UTF-8" ?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/200512" xmlns:wst14="http://docs.oasis-open.org/ws-sx/ws-trust/200802" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
  <soapenv:Header>
    <wsa:Action wsu:Id="action">http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue</wsa:Action>
    <wsa:MessageID wsu:Id="messageID">urn:uuid:1c2818b8-9ab3-4898-9730-dab518020b05</wsa:MessageID>
    <wsse:Security mustUnderstand="1" wsu:Id="security">
      <wsu:Timestamp wsu:Id="ts"><wsu:Created>2018-05-24T09:17:40Z</wsu:Created></wsu:Timestamp>
      <ds:Signature>
        <ds:SignedInfo>
          <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
          <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
          <ds:Reference URI="#messageID"> ... </ds:Reference>
          <ds:Reference URI="#action"> ...</ds:Reference>
          <ds:Reference URI="#ts">...</ds:Reference>
          <ds:Reference URI="#body">...</ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>...</ds:SignatureValue>
        <ds:KeyInfo>
          <ds:X509Data>
            <ds:X509Certificate>
                <!-- FOCES certifikat i base64-encodet form til signering af -->
            </ds:X509Certificate>
          </ds:X509Data>
        </ds:KeyInfo>
      </ds:Signature>
    </wsse:Security>
  </soapenv:Header>
  <soapenv:Body wsu:Id="body">
    <wst:RequestSecurityToken Context="urn:uuid:f637dd3e-fad4-4f5e-ac55-baa504560772">
      <wst:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</wst:TokenType>
      <wst:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</wst:RequestType>
      <wst14:ActAs>
          <!-- nemlogin bootstrap token in cleartext -->
        </saml:Assertion>
      </wst14:ActAs>
      <wsp:AppliesTo>
        <wsa:EndpointReference>
          <wsa:Address>http://audience/clear</wsa:Address>
        </wsa:EndpointReference>
      </wsp:AppliesTo>
      <wst:Claims Dialect="http://docs.oasis-open.org/wsfed/authorization/200706/authclaims">
        <auth:ClaimType Uri="dk:gov:saml:attribute:CprNumberIdentifier">
          <auth:Value>0501792275</auth:Value>
        </auth:ClaimType>
        <auth:ClaimType Uri="dk:healthcare:saml:attribute:OnBehalfOf">
          <auth:Value>urn:dk:healthcare:saml:actThroughProcurationBy:cprNumberIdentifier:1111111118</auth:Value>
        </auth:ClaimType>
      </wst:Claims>
    </wst:RequestSecurityToken>
  </soapenv:Body>
</soapenv:Envelope>

Bemærk at STS IKKE understøtter såkaldte STS er fra version 2.6.5 også begyndt at understøtte SecurityTokenReference til udpegning af signerende certifikat. Det er nødvendigt at indlejre certifikatet direkte som vist i eksemplet.

Der understøttes to typer af claims (se eksempler ovenfor):

CPR claim (obligatorisk). Angiver cpr nummeret på den borger der "sidder bag skærmen". Dette kan enten være tilgængeligt på forhånd i anvender systemet, eller være leveret af borgeren selv i f.eks. en web-grænseflade. Oplysningen vil blive checket op mod en bagvedliggende webservice i Nemid-infrastrukturen.
Fuldmagts-claim (valgfri). Kan benyttes til at angive at den aktuelle borger har fuldmagt til at agere på vegne af en anden borger. Denne fuldmagt vil typisk være afgivet på borger.dk. Oplysningen vil blive checket op mod en bagvedliggende webservice i Nemid-infrastrukturen.

Dette vil forhåbentlig resultere i et svar på formen

Derfor er der et alternativ til direkte indlejring af certifikat.

Code Block

collapse	true

<?xml version="1.0" encoding="UTF-8" ?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:

Code Block

<?xml version="1.0" encoding="UTF-8" ?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/200512" xmlns:wsuwst14="http://docs.oasis-open.org/wss/2004/ws-sx/ws-trust/200802" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
  <soapenv:Header>
    <wsa:Action wsu:Id="action">http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue</wsa:Action>
    <wsa:MessageID wsu:Id="messageID">urn:uuid:b032de90a2621694-34a10d11-44dc44f5-95ce84f5-8b5a61bcf592<c6239df8ecb6</wsa:MessageID>
    <wsa:RelatesTo wsu:Id="relatesTo">urn:uuid:04a6576e-607e-4edc-8b6c-aaa26d75f2d6</wsa:RelatesTo>
    <wsse:Security mustUnderstand="1" wsu:Id="security">
      <wsu:Timestamp wsu:Id="ts">
        <wsu:Created>2018Created>2019-0508-24T0919T21:3710:49Z<09Z</wsu:Created>
      </wsu:Timestamp>
      <ds:Signature>
 <!- response er signeret med STS certifikat --> <ds:SignedInfo>
      </ds:Signature>
    </wsse:Security>
  </soapenv:Header>
  <soapenv:Body wsu:Id="body"<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
    <wst:RequestSecurityTokenResponseCollection>
      <wst<ds:RequestSecurityTokenResponseSignatureMethod ContextAlgorithm="urn:uuid:d1126e37-5ebf-4fd6-bbd7-67c8063509bf"http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
        <wst:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</wst:TokenType>  <ds:Reference URI="#messageID"> ... </ds:Reference>
        <wst:RequestedSecurityToken>
     <ds:Reference URI="#action"> ... </ds:Reference>
       <saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="_0eac8d61-a226-4a85-97c0-8d5a5a964178" IssueInstant="2018-05-24T09:37:49Z" Version="2.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">   <ds:Reference URI="#ts"> ... </ds:Reference>
          <ds:Reference URI="#body"> ... </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>...</ds:SignatureValue>
            <saml:Issuer>TESTSTS</saml:Issuer><ds:KeyInfo>
            <ds:Signature Id="OCESSignature"><wsse:SecurityTokenReference>
            <wsse:Reference  <!-- assertion signeret af STS --URI="#X509Token" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
            </dswsse:Signature>SecurityTokenReference>
            <saml:Subject></ds:KeyInfo>
      </ds:Signature>
    </wsse:Security>
    <saml<wsse:NameIDBinarySecurityToken FormatEncodingType="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">C=DK,O=Ingen organisatorisk tilknytning,CN=Lars Larsen,Serial=PID:9208-2002-2-514358910503</saml:NameID>
              <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key">
                <saml:SubjectConfirmationData NotOnOrAfter="2018-05-24T09:42:48Z" Recipient="http://audience/clear">
                  <ds:KeyInfo>http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="X509Token">
		<!-- FOCES certifikat i base64-encodet form til signering af -->
	</wsse:BinarySecurityToken>
  </soapenv:Header>
  <soapenv:Body wsu:Id="body">
    <wst:RequestSecurityToken Context="urn:uuid:b9ae25b0-dfe6-4b34-94b2-d7df571d1a21">
      <wst:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</wst:TokenType>
      <wst:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</wst:RequestType>
      <wst14:ActAs>
        <saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="_eb365c67-1e56-4b5d-9aa6-4dd7b826d3cf" IssueInstant="2019-08-19T21:10:09Z" Version="2.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
			<!-- nemlogin bootstrap token in cleartext -->
        </saml:Assertion>
      </wst14:ActAs>
      <wsp:AppliesTo>
        <wsa:EndpointReference>
          <wsa:Address>http://audience/clear</wsa:Address>
        </wsa:EndpointReference>
      </wsp:AppliesTo>
      <wst:Claims Dialect="http://docs.oasis-open.org/wsfed/authorization/200706/authclaims">
        <auth:ClaimType Uri="dk:gov:saml:attribute:CprNumberIdentifier">
          <auth:Value>0501792275</auth:Value>
        </auth:ClaimType>
      </wst:Claims>
    </wst:RequestSecurityToken>
  </soapenv:Body>
</soapenv:Envelope>

Der understøttes to typer af claims (se eksempler ovenfor):

CPR claim (obligatorisk). Angiver cpr nummeret på den borger der "sidder bag skærmen". Dette kan enten være tilgængeligt på forhånd i anvender systemet, eller være leveret af borgeren selv i f.eks. en web-grænseflade. Oplysningen vil blive checket op mod en bagvedliggende webservice i Nemid-infrastrukturen.
Fuldmagts-claim (valgfri). Kan benyttes til at angive at den aktuelle borger har fuldmagt til at agere på vegne af en anden borger. Denne fuldmagt vil typisk være afgivet på borger.dk. Oplysningen vil blive checket op mod en bagvedliggende webservice i Nemid-infrastrukturen.

Nedenfor er et forventet svar til et typisk request med indlejret certifikat.

Code Block

collapse	true

<?xml version="1.0" encoding="UTF-8" ?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/200512" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
  <soapenv:Header>
    <wsa:Action wsu:Id="action">http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue</wsa:Action>
    <wsa:MessageID wsu:Id="messageID">urn:uuid:b032de90-34a1-44dc-95ce-8b5a61bcf592</wsa:MessageID>
    <wsa:RelatesTo wsu:Id="relatesTo">urn:uuid:04a6576e-607e-4edc-8b6c-aaa26d75f2d6</wsa:RelatesTo>
    <wsse:Security mustUnderstand="1" wsu:Id="security">
      <wsu:Timestamp wsu:Id="ts">
        <wsu:Created>2018-05-24T09:37:49Z</wsu:Created>
      </wsu:Timestamp>
      <ds:Signature> <!- response er signeret med STS certifikat -->
      </ds:Signature>
    </wsse:Security>
  </soapenv:Header>
  <soapenv:Body wsu:Id="body">
    <wst:RequestSecurityTokenResponseCollection>
      <wst:RequestSecurityTokenResponse Context="urn:uuid:d1126e37-5ebf-4fd6-bbd7-67c8063509bf">
        <wst:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</wst:TokenType>
        <wst:RequestedSecurityToken>
          <saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="_0eac8d61-a226-4a85-97c0-8d5a5a964178" IssueInstant="2018-05-24T09:37:49Z" Version="2.0" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
            <saml:Issuer>TESTSTS</saml:Issuer>
            <ds:Signature Id="OCESSignature">
              <!-- assertion signeret af STS -->
            </ds:Signature>
            <saml:Subject>
              <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">C=DK,O=Ingen organisatorisk tilknytning,CN=Lars Larsen,Serial=PID:9208-2002-2-514358910503</saml:NameID>
              <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key">
                <saml:SubjectConfirmationData NotOnOrAfter="2018-05-24T09:42:48Z" Recipient="http://audience/clear">
                  <ds:KeyInfo>
                    <ds:X509Data>
                      <ds:X509Certificate>MIIGIjCCBQqgAwIBAgIEWBjCxjANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQGEwJESzESMBAGA1UECgwJVFJVU1QyNDA4MSQwIgYDVQQDDBtUUlVTVDI0MDggU3lzdGVtdGVzdCBYSVggQ0EwHhcNMTcwMTMwMDcwNjQ3WhcNMjAwMTMwMDcwNjE0WjCBkDELMAkGA1UEBhMCREsxJzAlBgNVBAoMHk5FVFMgREFOSUQgQS9TIC8vIENWUjozMDgwODQ2MDFYMCAGA1UEBRMZQ1ZSOjMwODA4NDYwLUZJRDo5NDczMTMxNTA0BgNVBAMMLVRVIEdFTkVSRUwgRk9DRVMgZ3lsZGlnIChmdW5rdGlvbnNjZXJ0aWZpa2F0KTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANLzkWLn7qgPVpNZFIpq2X7kUR00IPreIF6osVsdAXWAs61/1mAFr7jMklEOTe9f/2iddZ77SlWhvnsWWnU3y0P9jnKrNnQh6VRo/ykqgKK/wCXMAuHBsZJ9yJ8XuZ6MhDEbY/ktSdSpvCqmoz3eBYLp7fqewNcjMg69hbGW5V+EPmurM4z1+HN+CAKjeyjYnoqwOcENdXJZ8Ctx1Rnwy1UWZizzavHnN0XZzVj+MmT4yVE/SXDRhDwhsR/CEa4ghFWGqG+bCOIh8Q2axZgYaUtLkpb8syYOlPpxq2ow/ZoZAlpctCw9kbbacxPyUH7GT62qzdJbNVnGb6HE49J++gUCAwEAAaOCAsowggLGMA4GA1UdDwEB/wQEAwIDuDCBlwYIKwYBBQUHAQEEgYowgYcwPAYIKwYBBQUHMAGGMGh0dHA6Ly9vY3NwLnN5c3RlbXRlc3QxOS50cnVzdDI0MDguY29tL3Jlc3BvbmRlcjBHBggrBgEFBQcwAoY7aHR0cDovL2YuYWlhLnN5c3RlbXRlc3QxOS50cnVzdDI0MDguY29tL3N5c3RlbXRlc3QxOS1jYS5jZXIwggEgBgNVHSAEggEXMIIBEzCCAQ8GDSsGAQQBgfRRAgQGBAIwgf0wLwYIKwYBBQUHAgEWI2h0dHA6Ly93d3cudHJ1c3QyNDA4LmNvbS9yZXBvc2l0b3J5MIHJBggrBgEFBQcCAjCBvDAMFgVEYW5JRDADAgEBGoGrRGFuSUQgdGVzdCBjZXJ0aWZpa2F0ZXIgZnJhIGRlbm5lIENBIHVkc3RlZGVzIHVuZGVyIE9JRCAxLjMuNi4xLjQuMS4zMTMxMy4yLjQuNi40LjIuIERhbklEIHRlc3QgY2VydGlmaWNhdGVzIGZyb20gdGhpcyBDQSBhcmUgaXNzdWVkIHVuZGVyIE9JRCAxLjMuNi4xLjQuMS4zMTMxMy4yLjQuNi40LjIuMIGqBgNVHR8EgaIwgZ8wPKA6oDiGNmh0dHA6Ly9jcmwuc3lzdGVtdGVzdDE5LnRydXN0MjQwOC5jb20vc3lzdGVtdGVzdDE5LmNybDBfoF2gW6RZMFcxCzAJBgNVBAYTAkRLMRIwEAYDVQQKDAlUUlVTVDI0MDgxJDAiBgNVBAMMG1RSVVNUMjQwOCBTeXN0ZW10ZXN0IFhJWCBDQTEOMAwGA1UEAwwFQ1JMOTYwHwYDVR0jBBgwFoAUzAJVDOSBdK8gVNURFFeckVI4f6AwHQYDVR0OBBYEFM87NIlSfKvNYR6xTrPPLlP5/zDaMAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADggEBAHJ4gA73YkRR4BaFgcbi5BRCtYUqxdr0Ip6Hx/yY9+PZv9YvnhnLTvCRTs18oJK8lGlTL/lAeQfCM/CAo9V/4e6IhhbUYaehmAguR+4uSMrJXyThvB/6aOYLsdyPwpBmXSaBXbCjVIpUgZ7Q6FemhUuslTNsy3Tt/zDfAgqHhlLjB33io9hYOefT9/IIFkJ32pa5itni0yNzOUi1jC4tx8XdOZGN17lBkXtmaGWh9grWd17x3odVG+kYoa+TekdKOys8bY7ZQwkqktJZnitMgQmbtuGHHQ+9ZXeEwZhhL/U+Lda3O92m8HSdgiHRhvoZ4+j3e/PbRaUW2z5YSqBoua4=</ds:X509Certificate>
                    </ds:X509Data>
                  </ds:KeyInfo>
                </saml:SubjectConfirmationData>
              </saml:SubjectConfirmation>
            </saml:Subject>
            <saml:Conditions NotBefore="2018-05-24T09:32:48Z" NotOnOrAfter="2018-05-24T09:42:48Z">
              <saml:AudienceRestriction>
                <saml:Audience>http://audience/clear</saml:Audience>
              </saml:AudienceRestriction>
            </saml:Conditions>
            <saml:AttributeStatement>
              <saml:Attribute Name="dk:gov:saml:attribute:SpecVer" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                <saml:AttributeValue xsi:type="xs:string">DK-SAML-2.0</saml:AttributeValue>
              </saml:Attribute>
              <saml:Attribute Name="dk:gov:saml:attribute:AssuranceLevel" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">      <ds:X509Data>
                      <ds:X509Certificate>MIIGIjCCBQqgAwIBAgIEWBjCxjANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQGEwJESzESMBAGA1UECgwJVFJVU1QyNDA4MSQwIgYDVQQDDBtUUlVTVDI0MDggU3lzdGVtdGVzdCBYSVggQ0EwHhcNMTcwMTMwMDcwNjQ3WhcNMjAwMTMwMDcwNjE0WjCBkDELMAkGA1UEBhMCREsxJzAlBgNVBAoMHk5FVFMgREFOSUQgQS9TIC8vIENWUjozMDgwODQ2MDFYMCAGA1UEBRMZQ1ZSOjMwODA4NDYwLUZJRDo5NDczMTMxNTA0BgNVBAMMLVRVIEdFTkVSRUwgRk9DRVMgZ3lsZGlnIChmdW5rdGlvbnNjZXJ0aWZpa2F0KTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANLzkWLn7qgPVpNZFIpq2X7kUR00IPreIF6osVsdAXWAs61/1mAFr7jMklEOTe9f/2iddZ77SlWhvnsWWnU3y0P9jnKrNnQh6VRo/ykqgKK/wCXMAuHBsZJ9yJ8XuZ6MhDEbY/ktSdSpvCqmoz3eBYLp7fqewNcjMg69hbGW5V+EPmurM4z1+HN+CAKjeyjYnoqwOcENdXJZ8Ctx1Rnwy1UWZizzavHnN0XZzVj+MmT4yVE/SXDRhDwhsR/CEa4ghFWGqG+bCOIh8Q2axZgYaUtLkpb8syYOlPpxq2ow/ZoZAlpctCw9kbbacxPyUH7GT62qzdJbNVnGb6HE49J++gUCAwEAAaOCAsowggLGMA4GA1UdDwEB/wQEAwIDuDCBlwYIKwYBBQUHAQEEgYowgYcwPAYIKwYBBQUHMAGGMGh0dHA6Ly9vY3NwLnN5c3RlbXRlc3QxOS50cnVzdDI0MDguY29tL3Jlc3BvbmRlcjBHBggrBgEFBQcwAoY7aHR0cDovL2YuYWlhLnN5c3RlbXRlc3QxOS50cnVzdDI0MDguY29tL3N5c3RlbXRlc3QxOS1jYS5jZXIwggEgBgNVHSAEggEXMIIBEzCCAQ8GDSsGAQQBgfRRAgQGBAIwgf0wLwYIKwYBBQUHAgEWI2h0dHA6Ly93d3cudHJ1c3QyNDA4LmNvbS9yZXBvc2l0b3J5MIHJBggrBgEFBQcCAjCBvDAMFgVEYW5JRDADAgEBGoGrRGFuSUQgdGVzdCBjZXJ0aWZpa2F0ZXIgZnJhIGRlbm5lIENBIHVkc3RlZGVzIHVuZGVyIE9JRCAxLjMuNi4xLjQuMS4zMTMxMy4yLjQuNi40LjIuIERhbklEIHRlc3QgY2VydGlmaWNhdGVzIGZyb20gdGhpcyBDQSBhcmUgaXNzdWVkIHVuZGVyIE9JRCAxLjMuNi4xLjQuMS4zMTMxMy4yLjQuNi40LjIuMIGqBgNVHR8EgaIwgZ8wPKA6oDiGNmh0dHA6Ly9jcmwuc3lzdGVtdGVzdDE5LnRydXN0MjQwOC5jb20vc3lzdGVtdGVzdDE5LmNybDBfoF2gW6RZMFcxCzAJBgNVBAYTAkRLMRIwEAYDVQQKDAlUUlVTVDI0MDgxJDAiBgNVBAMMG1RSVVNUMjQwOCBTeXN0ZW10ZXN0IFhJWCBDQTEOMAwGA1UEAwwFQ1JMOTYwHwYDVR0jBBgwFoAUzAJVDOSBdK8gVNURFFeckVI4f6AwHQYDVR0OBBYEFM87NIlSfKvNYR6xTrPPLlP5/zDaMAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADggEBAHJ4gA73YkRR4BaFgcbi5BRCtYUqxdr0Ip6Hx/yY9+PZv9YvnhnLTvCRTs18oJK8lGlTL/lAeQfCM/CAo9V/4e6IhhbUYaehmAguR+4uSMrJXyThvB/6aOYLsdyPwpBmXSaBXbCjVIpUgZ7Q6FemhUuslTNsy3Tt/zDfAgqHhlLjB33io9hYOefT9/IIFkJ32pa5itni0yNzOUi1jC4tx8XdOZGN17lBkXtmaGWh9grWd17x3odVG+kYoa+TekdKOys8bY7ZQwkqktJZnitMgQmbtuGHHQ+9ZXeEwZhhL/U+Lda3O92m8HSdgiHRhvoZ4+j3e/PbRaUW2z5YSqBoua4=</ds:X509Certificate>
                <saml:AttributeValue xsi:type="xs:string">3</saml:AttributeValue>
              </dssaml:X509Data>Attribute>
              <saml:Attribute    </ds:KeyInfo>
Name="dk:gov:saml:attribute:CprNumberIdentifier" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                 <<saml:AttributeValue xsi:type="xs:string">0501792275</saml:SubjectConfirmationData>AttributeValue>
              </saml:SubjectConfirmation>Attribute>
            </saml:Subject>
            <saml:ConditionsAttribute NotBeforeName="2018-05-24T09:32:48Z" NotOnOrAfter="2018-05-24T09:42:48Z">
dk:gov:saml:attribute:Privileges_intermediate" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                <saml:AudienceRestriction>AttributeValue xsi:type="xs:string">
                <saml:Audience>http://audience/clear</saml:Audience>
   <!-- fuldmagts privilegier i Base64 encodet      </saml:AudienceRestriction>form -->
            </saml:Conditions>
            <saml</saml:AttributeStatement>AttributeValue>
              <saml:Attribute Name="dk:gov:saml:attribute:SpecVer" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"></saml:Attribute>
                <saml:AttributeValue xsi:type="xs:string">DK-SAML-2.0<</saml:AttributeValue>AttributeStatement>
              </saml:Attribute>Assertion>
        </wst:RequestedSecurityToken>
      <saml:Attribute Name="dk:gov:saml:attribute:AssuranceLevel" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
 <wsp:AppliesTo>
          <wsa:EndpointReference>
           <saml:AttributeValue xsi:type="xs:string">3</saml:AttributeValue>
<wsa:Address>http://audience/clear</wsa:Address>
          </wsa:EndpointReference>
        </samlwsp:Attribute>AppliesTo>
        <wst:Lifetime>
        <saml:Attribute Name="dk:gov:saml:attribute:CprNumberIdentifier" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
    <wsu:Created>2018-05-24T09:32:48Z</wsu:Created>
             <saml:AttributeValue xsi:type="xs:string">0501792275</saml:AttributeValue><wsu:Expires>2018-05-24T09:42:48Z</wsu:Expires>
        </wst:Lifetime>
      </samlwst:Attribute>RequestSecurityTokenResponse>
              <saml:Attribute Name="dk:gov:saml:attribute:Privileges_intermediate" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                <saml:AttributeValue xsi:type="xs:string"></wst:RequestSecurityTokenResponseCollection>
  </soapenv:Body>
</soapenv:Envelope>

Det returnede IdentityToken (SAML assertion) kan herefter anvendes til kald af den bagvedliggende webservice hos eksempelvis FMK.

Hvis request brugte indlejret certifikat, så vil response også bruge indlejret certifikat i signaturen. Og hvis man har angivet certifikat vha. BinarySecurityToken, så vil dette også blive brugt i tilhørende response.

Code Block

language	xml
collapse	true

Indlejret certifikat:
                   <!-- fuldmagts privilegier i Base64 encodet form --><ds:KeyInfo>
          <ds:X509Data>
      </saml:AttributeValue>
      <ds:X509Certificate><!-- FOCES certifikat i base64-encodet form til signering </saml:Attribute>af --></ds:X509Certificate>
            </samlds:AttributeStatement>X509Data>
        </ds:KeyInfo>
      </samlds:Assertion>Signature>
    </wsse:Security>
  </soapenv:Header>

Certifikat vha. </wstBinarySecurityToken:RequestedSecurityToken>
        <wsp<ds:AppliesTo>KeyInfo>
          <wsa<wsse:EndpointReference>SecurityTokenReference>
            <wsa:Address>http://audience/clear</wsa:Address><wsse:Reference URI="#X509Token" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
          </wsawsse:EndpointReference>SecurityTokenReference>
        </ds:KeyInfo>
      </wspds:AppliesTo>Signature>
        <wst:Lifetime></wsse:Security>
    <wsse:BinarySecurityToken      <wsu:Created>2018-05-24T09:32:48Z</wsu:Created>
          <wsu:Expires>2018-05-24T09:42:48Z</wsu:Expires>
        </wst:Lifetime>
      </wst:RequestSecurityTokenResponse>
    </wst:RequestSecurityTokenResponseCollection>EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="X509Token">
MIIGKjCCBRKgAwIBAgIEW6uMBTANBgkqhkiG9w0BAQsFADBIMQswCQYDVQQGEwJESzESMBAGA1UECgwJVFJVU1QyNDA4MSUwIwYDVQQDDBxUUlVTVDI0MDggU3lzdGVtdGVzdCBYWElJIENBMB4XDTE5MDQzMDA5MDcxN1oXDTIyMDQzMDA5MDYzOFowgZQxCzAJBgNVBAYTAkRLMS4wLAYDVQQKDCVTdW5kaGVkc2RhdGFzdHlyZWxzZW4gLy8gQ1ZSOjMzMjU3ODcyMVUwIAYDVQQFExlDVlI6MzMyNTc4NzItRklEOjE4OTExODYxMDEGA1UEAwwqU09TSSBUZXN0IEZlZGVyYXRpb24gKGZ1bmt0aW9uc2NlcnRpZmlrYXQpMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyo57h9E/hM5gimxaDgHB0MLcgVfXGJbQh/8OC1vTdDsCUIzIwRd5lJE+ado8urHF7UmKubFZzfCPduoRv9b3TkNVKaixiHUMtP4egbL8vcgyalk28cNQdUk8f34mg8atgvd45EnIKz2iB+yjs5guJPDBg2OFSbP0r53NU8fVTq3aLtDpDVnkxsyjNQ7HOFtzavyMnKx0vDgafEvrUR3WTSLCGju4aUIg3ThgrWXA7i3lPIAXdV8mQmlY3wn/kIBiyIotmF98UsEket/sxpJNkJ6R6AUpxnGApCDP1Fw2BgxAQWWrtD/c5IoIZwGWNfLgpJEzfhnuIZJ7Bfs9RmHFdQIDAQABo4ICzTCCAskwDgYDVR0PAQH/BAQDAgO4MIGXBggrBgEFBQcBAQSBijCBhzA8BggrBgEFBQcwAYYwaHR0cDovL29jc3Auc3lzdGVtdGVzdDIyLnRydXN0MjQwOC5jb20vcmVzcG9uZGVyMEcGCCsGAQUFBzAChjtodHRwOi8vZi5haWEuc3lzdGVtdGVzdDIyLnRydXN0MjQwOC5jb20vc3lzdGVtdGVzdDIyLWNhLmNlcjCCASAGA1UdIASCARcwggETMIIBDwYNKwYBBAGB9FECBAYEAjCB/TAvBggrBgEFBQcCARYjaHR0cDovL3d3dy50cnVzdDI0MDguY29tL3JlcG9zaXRvcnkwgckGCCsGAQUFBwICMIG8MAwWBURhbklEMAMCAQEagatEYW5JRCB0ZXN0IGNlcnRpZmlrYXRlciBmcmEgZGVubmUgQ0EgdWRzdGVkZXMgdW5kZXIgT0lEIDEuMy42LjEuNC4xLjMxMzEzLjIuNC42LjQuMi4gRGFuSUQgdGVzdCBjZXJ0aWZpY2F0ZXMgZnJvbSB0aGlzIENBIGFyZSBpc3N1ZWQgdW5kZXIgT0lEIDEuMy42LjEuNC4xLjMxMzEzLjIuNC42LjQuMi4wga0GA1UdHwSBpTCBojA9oDugOYY3aHR0cDovL2NybC5zeXN0ZW10ZXN0MjIudHJ1c3QyNDA4LmNvbS9zeXN0ZW10ZXN0MjIxLmNybDBhoF+gXaRbMFkxCzAJBgNVBAYTAkRLMRIwEAYDVQQKDAlUUlVTVDI0MDgxJTAjBgNVBAMMHFRSVVNUMjQwOCBTeXN0ZW10ZXN0IFhYSUkgQ0ExDzANBgNVBAMMBkNSTDE0MjAfBgNVHSMEGDAWgBSrqAFEGbCzQ5na+nzM0gAYA+c8vzAdBgNVHQ4EFgQUGYAVKKL17LHyVGSErL26MBNadTQwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEAjHMO4sWEf8M25WHczBTJYtMitn1wLOqE6raeM6oYyw6R/4FImpOzF6bxBlfNnhhR0vJSXMWTqL/onCyy4gCs9eLglRHZ9BC8a9fmirrguNpOWlR8NAf5GRwOqCyTnkTAfUD1fp0RzVo8TvAd73WiGeUTzTiAVf7OgZFnRIYkcALXLjNs6AwELWSh+bC/gGuQcHUDd8YGSzgKS6w2qz3fIASrykxzlYjeusks58CereC6WfvN0I+GGlL9fIgjpzh7JEELME7r9QJLL9NSrmlRKfhM8gzuE6Vm4vGzmSsnNJxGMf1vTzEve4lXI8pnOtHMTtNl5zw4jCJFakRqcWm3FQ==</wsse:BinarySecurityToken>
  </soapenv:Body>
</soapenv:Envelope>

...

Header>

Eksempel kode (seal.java)

...

Content

Space Tools

Versions Compared

Old Version 5

New Version 6

Key

Eksempel kode (seal.java)