Glossary Item Box

Government Gateway 2.2.0 (MR-01) ISV Developer Help (Doc Version 06/03/08) | Send comments on this topic.

# X509SecurityToken

The X509SecurityToken that the Gateway supports is the standard WS-Security BinarySecurityToken; it contains the user's X.509 certificate credential used by the Gateway.

A UsernameToken is used to request:

- A GatewayToken from the Security Token Service (STS) which can then be used to call methods on the SOAP Portal and Public Interfaces.

An example of an X509SecurityToken is given below:

    <wsse:BinarySecurityToken
      ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
      EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
      xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
      wsu:Id="SecurityToken-68740736-304a-471e-a491-bd232800a741">
        MIIDQjCCAuygAwIBAgIKYEX2IwAAAAC1UzANBgkqhkiG9w0BAQUFADBAMQswCQYD
        VQQGEwJHQjENMAsGA1UEBxMEVUtHRzEPMA0GA1UEChMGVUtHRzE2MREwDwYDVQQD
        EwhVS0dHMTZDQTAeFw0wNDAzMDExNTMxMTNaFw0wNDEwMTcxMzE0MzdaMEoxCzAJ
        BgNVBAYTAkdCMQ0wCwYDVQQHEwRVS0dHMQ8wDQYDVQQKEwZVS0dHMTYxGzAZBgNV
        BAMTElZhbGlkIEdhdGV3YXkgQ2VydDBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQDP
        QPzkRfQDMiGWXcSzXVRrmUN8zmkg/NBGjloV1dyzAI2zGMCXl0gRptjGpqtmCHCH
        Bxi9AvvfbMz6rrevE6OJAgMBAAGjggG8MIIBuDAOBgNVHQ8BAf8EBAMCBPAwEwYD
        VR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFJn555Fo3bqcUmEcSN6EydEOsf56
        MHcGA1UdIwRwMG6AFCdJejd27BQRhdeWXtAGfkdYDbEfoUSkQjBAMQswCQYDVQQG
        EwJHQjENMAsGA1UEBxMEVUtHRzEPMA0GA1UEChMGVUtHRzE2MREwDwYDVQQDEwhV
        S0dHMTZDQYIQLTw5+FRESr5PClYzCFA+QTBpBgNVHR8EYjBgMC2gK6AphidodHRw
        Oi8vdWtnZzE2Y2EvQ2VydEVucm9sbC9VS0dHMTZDQS5jcmwwL6AtoCuGKWZpbGU6
        Ly9cXHVrZ2cxNmNhXENlcnRFbnJvbGxcVUtHRzE2Q0EuY3JsMIGNBggrBgEFBQcB
        AQSBgDB+MDwGCCsGAQUFBzAChjBodHRwOi8vdWtnZzE2Y2EvQ2VydEVucm9sbC91
        a2dnMTZjYV9VS0dHMTZDQS5jcnQwPgYIKwYBBQUHMAKGMmZpbGU6Ly9cXHVrZ2cx
        NmNhXENlcnRFbnJvbGxcdWtnZzE2Y2FfVUtHRzE2Q0EuY3J0MA0GCSqGSIb3DQEB
        BQUAA0EAmpG9hc5rOirc3vdh2MZ0HPORcQoHJ3nONM73XsA42/7aaTil/EHiLwCQ
        knucBNg9pHH6LYxJMoqFRbT+qRY1pA==
    </wsse:BinarySecurityToken>

The binary token contains the Base64 representation of the X.509 certificate, and in this form does not prove that the user has the private key. See Logging on to Gateway with a Certificate, to understand how a message that incorporates an X509SecurityToken is signed; proving both the user's identity and the information within the message has not been tampered with.

Further information on the X509SecurityToken can be found in the OASIS specification: Web Services Security X.509 Certificate Token Profile.

© Crown Copyright 2008. All rights reserved