Glossary Item Box

Government Gateway 2.2.0 (MR-01) ISV Developer Help (Doc Version 06/03/08) | Send comments on this topic.

# X509SecurityToken

The X509SecurityToken that the Gateway supports is the standard WS-Security BinarySecurityToken.

The X509UsernameToken is incorporated in the GsoDelegateRights method (SOAP method request message) – the only method on the DelegatedRights Interface – to authenticate the caller. The message includes the X509SecurityToken and the message is signed with the caller's corresponding private key

The X.509 certificate must correspond to the X.509 certificate provided for the DRM user account when it was created through the Gateway UI.

Note:

- A DRM user account can only be created through the Gateway UI (www.Gateway.gov.uk) – NOT through a Department Portal.
- A DRM user account is created by a registered normal Gateway user within the organisation.

An example of an X509SecurityToken is given below:

    <wsse:BinarySecurityToken
      ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
      EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
      xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
      wsu:Id="SecurityToken-68740736-304a-471e-a491-bd232800a741">
        MIIDQjCCAuygAwIBAgIKYEX2IwAAAAC1UzANBgkqhkiG9w0BAQUFADBAMQswCQYD
        VQQGEwJHQjENMAsGA1UEBxMEVUtHRzEPMA0GA1UEChMGVUtHRzE2MREwDwYDVQQD
        EwhVS0dHMTZDQTAeFw0wNDAzMDExNTMxMTNaFw0wNDEwMTcxMzE0MzdaMEoxCzAJ
        BgNVBAYTAkdCMQ0wCwYDVQQHEwRVS0dHMQ8wDQYDVQQKEwZVS0dHMTYxGzAZBgNV
        BAMTElZhbGlkIEdhdGV3YXkgQ2VydDBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQDP
        QPzkRfQDMiGWXcSzXVRrmUN8zmkg/NBGjloV1dyzAI2zGMCXl0gRptjGpqtmCHCH
        Bxi9AvvfbMz6rrevE6OJAgMBAAGjggG8MIIBuDAOBgNVHQ8BAf8EBAMCBPAwEwYD
        VR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFJn555Fo3bqcUmEcSN6EydEOsf56
        MHcGA1UdIwRwMG6AFCdJejd27BQRhdeWXtAGfkdYDbEfoUSkQjBAMQswCQYDVQQG
        EwJHQjENMAsGA1UEBxMEVUtHRzEPMA0GA1UEChMGVUtHRzE2MREwDwYDVQQDEwhV
        S0dHMTZDQYIQLTw5+FRESr5PClYzCFA+QTBpBgNVHR8EYjBgMC2gK6AphidodHRw
        Oi8vdWtnZzE2Y2EvQ2VydEVucm9sbC9VS0dHMTZDQS5jcmwwL6AtoCuGKWZpbGU6
        Ly9cXHVrZ2cxNmNhXENlcnRFbnJvbGxcVUtHRzE2Q0EuY3JsMIGNBggrBgEFBQcB
        AQSBgDB+MDwGCCsGAQUFBzAChjBodHRwOi8vdWtnZzE2Y2EvQ2VydEVucm9sbC91
        a2dnMTZjYV9VS0dHMTZDQS5jcnQwPgYIKwYBBQUHMAKGMmZpbGU6Ly9cXHVrZ2cx
        NmNhXENlcnRFbnJvbGxcdWtnZzE2Y2FfVUtHRzE2Q0EuY3J0MA0GCSqGSIb3DQEB
        BQUAA0EAmpG9hc5rOirc3vdh2MZ0HPORcQoHJ3nONM73XsA42/7aaTil/EHiLwCQ
        knucBNg9pHH6LYxJMoqFRbT+qRY1pA==
    </wsse:BinarySecurityToken>

The binary token contains the Base64 representation of the X.509 certificate, and in this form does not prove that the user has the private key. See Calling GsoDelegateRights using a X509SecurityToken to understand how a message that incorporates an X509SecurityToken is signed; proving both the user's identity and the information within the message has not been tampered with.

Further information on the X509SecurityToken can be found on the OASIS web site: Web Services Security X.509 Certificate Token Profile.

© Crown Copyright 2008. All rights reserved