CDATA Zone - XML

xmlseclibs 1.3.0 Released

nospam@example.com (Rob Richards) — Mon, 26 Sep 2011 07:59:48 -0400

It's been some time since the last release and there have been a number of features and a few bug fixes so I figured it was time for a new release. A few of you have sent me some patches that are not included in this release as they were too major for this release but they will be included for a 2.0 branch I am planning on starting shortly.

You can find 1.3.0 here:
xmlseclibs 1.3.0

Things added or fixed in this release:

26, Sep 2011, 1.3.0
Features:
- Add param to append sig to node when signing. Fixes a problem when using
inclusive canonicalization to append a signature within a namespaced subtree.
ex. $objDSig->sign($objKey, $appendToNode);
- Add ability to encrypt by reference
- Add support for refences within an encrypted key
- Add thumbprint generation capability (XMLSecurityKey->getX509Thumbprint() and
XMLSecurityKey::getRawThumbprint($cert))
- Return signature element node from XMLSecurityDSig::insertSignature() and
XMLSecurityDSig::appendSignature() methods
- Support for with simple URI Id reference.
- Add XMLSecurityKey::getSymmetricKeySize() method (Olav)
- Add XMLSecEnc::getCipherValue() method (Olav)
- Improve XMLSecurityKey:generateSessionKey() logic (Olav)

Bug Fixes:
- Change split() to explode() as split is now depreciated
- ds:References using empty or simple URI Id reference should never include
comments in canonicalized data.
- Make sure that the elements in EncryptedData are emitted in the correct
sequence.

WS-* for PHP

nospam@example.com (Rob Richards) — Fri, 19 Mar 2010 08:49:00 -0400

Support for dealing with encrypted SOAP messages was a feature that had been missing from my WS-* libraries pretty much due to my lack of time to implement it. When people ask for help interoperating with a SOAP server that requires encryption I typically just point them over to the WSF project. The problem has been that in many cases people are unable to install that framework, as they don't control the servers, or more recently I have gotten reports that they simply could not get it to work. Either it didn't support what they needed, wouldn't compile, or simple wouldn't work with even simple SOAP requests. I decided to finally set aside some time and implement the encryption/decryption portion of the library. Note that it was developed against some WCF services implementing message level security, so your mileage might vary against other platforms. Bug reports would be fastest way of getting any of those issues dealt with.

As part of the recent changes, I also finally got around to creating an official project for the libraries rather than just being ad-hoc files people pulled from my web site. The libraries are now officially part of the wse-php project hosted over at Google Code. It was a toss up between that and GitHub, but I really wanted to play around with Mercurial since I already use Git over at the Gnome project. Currently the libraries provide support for a portion of WS-Addressing and WS-Security that can be used with ext/soap in PHP. As time goes on I plan to add some support for simplified configuration of messaging as well as some other of the WS-* specs that might be useful when interoperating with other SOAP servers.

Xmlseclibs 1.2.2 Released

nospam@example.com (Rob Richards) — Mon, 11 Jan 2010 09:02:00 -0500

After quite some time, version 1.2.2 has finally been released. It can be downloaded at: http://xmlseclibs.googlecode.com/files/xmlseclibs-1.2.2.tar.gz

Changes include:

Features:
- Add support XPath support when creating signature. Provides support for
working with EBXML documents.
- Add reference option to force creation of URI attribute. For use
when adding a DOM Document where by default no URI attribute is added.
- Add support for RSA-SHA256

Bug Fixes:
- fix bug #5: createDOMDocumentFragment() in decryptNode when data is node
content (patch by Francois Wang)

Please submit any bugs or feature requests into the Issue Tracker.

Streaming XML

nospam@example.com (Rob Richards) — Thu, 28 May 2009 07:21:00 -0400

Another php|tek has come and gone. Although a bit behind, I finally got my slides online for my Streaming XML talk. I lingered a little too long on a few topics so the XMLWriter portion was a bit rushed. If anyone has questions on any of the topics, feel free to drop me a line. I did promise a few people I would write a bit about XMLReader and XMLWriter, but it's slow going as I try to find the time. Hopefully in the not to distant future I can get to this. This Dad thing is really time consuming

Entities, ext/xml and libxml 2.7

nospam@example.com (Rob Richards) — Tue, 13 Jan 2009 10:20:00 -0500

As many people have found out, entity handling in ext/xml is broken when used with libxml2 2.7.0-2.7.2. The problem lies with the way pre-defined entities are handled; or rather not handled when used with one of the newer libxml2 versions. The entities, &, < , >, ' and " never get passed to the user's callbacks, causing a big problem in quite a number of applications out there. Needless to say, I've received a good amount of hate mail over this problem. Got to love people. You never hear how grateful anyone ever is, but sure as hell once there is a problem they are all over you. Anyways, I digress.

Although I have been telling people for a few years now that they should use XMLReader rather than ext/xml, this breakage was not intentional; no matter what anyone says – Yes, I've had a few throw that out there. The good news is that the problem has finally been fixed, but will require both an updated PHP (5.2.9+) and libxml2-2.7.3, although none of them have yet been released. Until things are available, the available options are to either compile your own builds using the code from the libxml2 and PHP repositories, don't upgrade to libxml2 2.7.x yet if you haven't yet done so, build ext/xml with expat rather than libxml2, or lastly, convert your PHP code to use XMLReader.

My parting thought on this to everyone is just switch to the XMLReader extension. It's faster, easier to use and much more powerful.

xmlseclibs 1.2.1 Released

nospam@example.com (Rob Richards) — Tue, 08 Jul 2008 16:05:00 -0400

The long awaited 1.2.1 release finally sees the light of day.
It can be downloaded from:
http://xmlseclibs.googlecode.com/files/xmlseclibs-1.2.1.tar.gz

Changes include the following:

Features:
- Attempt to use mhash when hash extension is not present. (Alfredo Cubitos).
- Add fallback to built-in sha1 if both hash and mhash are not available and
throw error for other for other missing hashes. (patch by Olav Morken).
- Add getX509Certificate method to retrieve the x509 cert used for Key.
(patch by Olav Morken).
- Add getValidatedNodes method to retrieve the elements signed by the
signature. (patch by Olav Morken).
- Add insertSignature method for precision signature insertion. Merge
functionality from appendSignature in the process. (Olav Morken, Rob).
- Finally add some tests

Bug Fixes:
- Fix canonicalization for Document node when using PHP < 5.2.
- Add padding for RSA_SHA1. (patch by Olav Morken).

This library has undergone extensive testing prior to release so, please
let me know if anyone runs into any issues.

php|tek Slides

nospam@example.com (Rob Richards) — Tue, 27 May 2008 10:07:00 -0400

I had a good number of requests for write-ups of the material I presented in the Streaming XML session, so will try to put something together over the next couple of days. The session went over by just a bit so if I missed addressing any questions, please feel free to email me with them.

Working with Web Services
Who Am I?
Streaming XML

xmlseclibs Get Infrastructure

nospam@example.com (Rob Richards) — Sun, 27 Jan 2008 08:00:00 -0500

For a long time now I have been saying that I need to get the library within a public source repository, write documentation, etc... Thanks to Andreas Solberg, all of this is finally coming to fruition. He has setup a home page for xmlseclibs, as well as the xmlseclibs project at Google Code. Things are still in the early stages, so there is still no documentation, but at least everyone now has access to the source repositry, mailing list and bug tracker for it. Documentation is something sorely needly, so if anyone would like to help in this aspect, please contact me personally or send a message to the mailing list.

2008 Rings In Unemployment

nospam@example.com (Rob Richards) — Sat, 05 Jan 2008 19:05:00 -0500

2008 is sure off to a lousy start. I went back to work the first work day of the new year after some relaxing time off just to be told the entire IT department has been let go effective immediately. I am just praying this isn't an indication about how the rest of the year is going to go. I get enough of the open position emails, but the trouble is that I am not going to leave Maine. I like it here and it's a great place to raise a family. That being said, if anyone is looking or knows of someone looking for a developer in Maine (I'm trying to avoid doing Java full time) or that allows for a full time telecommuter, I would appreciate any leads: You either already have my email address or contact me via: =rob.richards.

As far as outside projects I am involved in and work on, I do plan on continuing working on them, although I might be a bit MIA for some time until I get settled. My apologies for tagging this in all categories, but hey I need to get maximum exposure here.

Book Review: PHP Oracle Web Development

nospam@example.com (Rob Richards) — Mon, 17 Dec 2007 11:22:00 -0500

The good folks from Packt Publishing were kind enough to send me a few books to review and I've been a little lax posting a review, so over the next few days I hope to have them all up. Overall I would have to say that PHP Oracle Web Development is a good book for a PHP developer needing to get up to speed quickly working with an Oracle database. I've worked with Oracle before using other languages, but never with PHP. I found the chapters progressed through the various topics in a logical and straightforward manner. It was easily to follow along, of course coding as you go, and easy to understand what was going on.

There were some features that, prior to this, I hadn't used before, such as their native XML support. Lately, I have been using DB2 and XQuery and was both surprised and glad to find the book cover some of this. Again, easy to understand and follow. After about 15 minutes, I was doing all sorts of crazy XML operations within Oracle.

The only place I found the book lacking was the initial setup of the environment. This is definitely a minor nit, but something that was a bit frustrating until I got it all working. The book tends to favor a Windows installation, which usually is simple anyways. I decided, however, to install on my linux box. The missing step came when I was trying to configure the oci8 extension in PHP. I was not using the instant client and had not setup the environment, so things weren't found. After checking the oci8 config.m4 in PHP, I found it was looking for ORACLE_HOME. A little searching and I found that all I needed was to execute a shell command (included in the Oracle install) to have them properly setup:
/usr/lib/oracle/xe/app/oracle/product/10.2.0/server/bin/oracle_env.sh

After that, install went smoothly. Now, the only other issue I am having is trying to configure PHP to work on my Fedora 8 system using the 11.1 instant client. The configure script (using PHP 5.2 from CVS that does support this Oracle version) doesn't like it for some reason. Something to work on another day.

All in all, I would definitely recommend this book, PHP Oracle Web Development, to a PHP developer needing to learn or at least have a reference book on integrating with Oracle.

Updated 12/19/2007: I finally resolved the instant client issue on Fedora 8. Also fixed my typos :/

Microsoft and XML Fundamentals

nospam@example.com (Rob Richards) — Mon, 17 Dec 2007 09:07:00 -0500

I was meaning to write about some of the new openinfocard features this weekend, but instead I spent my time trying to get the openinfocard selector working against the Windows Live Beta site supporting Information Cards. I finally found the problem and really just could not believe it. A few months ago, I received a similar, yet unrelated, bug report against my own libraries. A person was using my wsse/xmlsec libs to communicate against a .NET SOAP service that required messages to be signed and told me that it would not work unless the XMLDSIG elements used a default namespace. This means that ... would work, while .. would not. Anyone who works with XML is fully aware that these two are exactly the same, so I just couldn't accept that. In fact, when mixing namespace (as often is the case when working with XMLDSIG and XMLENC) its easier to read the document when prefixes are used.

Within my libraries, I do prefix namespaces. Unfortunately for that person, I did not believe them and stressed that it had to be a coding error either on their part or from the service provider. Note that I didn't just dismiss their report. I was unable to reproduce the issue, was not given access to test against their service, do successfully interoperate with other .NET systems, and have a large number of users implementing my code against .NET services employing encryption and digital signatures. I hadn't heard anything more and ended up forgetting about it... that is until now.

Over the weekend, I spent a good amount of time comparing tokens from various selectors and trying different parameters. There were only two differences between tokens from Openinfocard and those from CardSpace. The first, which I spent most of my time on, was the timestamps. CardSpace provides a full hour for token validity. Openinfocard, on the other hand, allows the token 10 minutes of validity. I have run into a number of problems in the past due to the clock from either the client or server not being in synch. A fudge factor is usually built into the interactions (the client might set their NotBefore time to a few minutes prior to the current time, and the server might allow an extra ten minutes past the expire time), but I have seen cases, especially due to day light savings and systems not being updated, that the clocks between the client and server are too far off and the token is not considered valid when submitted. Anyways, this didn't end up being the problem.

Come to find out, the Windows Live Beta site has the exact same problem when dealing with the SAML token as the bug reported I told you about before. The issue is unrelated to the client code (so thankfully it wasn't an issue in my library - written in PHP); Openinfocard, which is the selector having a problem working with Windows Live, is in fact written in Java, and also prefixes namespaces. After altering the openinfocard code to use default namespaces, building new jars, installing the new jars and restarting firefox (sounds simple, yet REALLY time consuming), I finally got Windows Live to accept my Infocard. The underlying problem itself still eludes me. All I know is that the issue lies on the server side. I have no idea if this is a problem stemming from a particular version of the .NET libraries or if a third party library is being used.
Either way, I would have expected more from Microsoft. It's forgivable that a developer from a small company might use an outside library to work with digital signatures (that also happens to be buggy), but for a company that pushes the WS-* stack (XML Digital Signatures being a core component of WS-Security) and provides core libraries for working with it, this is a serious issue. It also seems to not be isolated either; as exemplified by the same issue against a .NET SOAP service.

Now hopefully someone can get me some answers to where this problem stems from so in the future I have a little more insight if I personally end up encounter it when dealing with a SOAP service; or at least can provide some help to someone reporting the issue to me again.

Library Updates and Other Dealings

nospam@example.com (Rob Richards) — Mon, 10 Dec 2007 09:35:00 -0500

Life and work have been eating up all my time, so I have had no time to write anything about what's been going on. I finally decided to take a break from work, sit down and try to catch up with things.
Although busy, I have been updating my libraries; adding deatures, fixing bugs and trying to get some structure going. The libraries are used by a good number of projects, so I figured it was about time to make some of the changes known. First off, I started tracking versions and keeping changelogs for the different libraries (Only those that have changed since I started version tracking have changelogs right now). The libraries can all be found on my Source Code page. As for some of the specific changes....

Continue reading "Library Updates and Other Dealings"

Catching Up

nospam@example.com (Rob Richards) — Thu, 05 Jul 2007 12:40:00 -0400

Work has been keeping me extremely busy over the past few months, so I haven't had much time for any new entries. This, however, doesn't mean that there hasn't been anything going on. I figured it was about time I provided an update so people will quit asking if I'm still alive

XMLSec/WS-*:
Contrary to what I said in the past about no longer maintaining these libraries, I have been quietly releasing updated versions of the code with bug fixes. There are quite a number of people using them for various reasons so I have decided to continue supporting and developing all the libraries. There will be a few changes though. I have had far too many emails and questions concerning the lack of licensing (For some reason people don't get the public domain concept). To hopefully reduce the amount of questions I get about this, I will be releasing the next versions under a BSD license. I will also being maintaining versioning information for each file and the changes made between versions. The changes made so far have primarily been concerned with fixes when used through a SOAP server context, some ability to perform encryption in a SOAP message from the client side and some new features that I have needed for an Managed Identity provider (see the Infocard section for details).

Identity/OpenID/Infocard:

Continue reading "Catching Up"

PHP Quebec 2007 slides

nospam@example.com (Rob Richards) — Tue, 20 Mar 2007 02:56:00 -0400

I finally managed to get my slides converted to PDFs (and a decent size). They can be found in the Talks section along with older ones. Yann and the rest of the crew did a great job (as usual) putting together the 2007 PHP Quebec conference. I had a great time in Montreal and my body is still getting over the sugar shock from consuming so much maple syrup on Saturday.

WS-Addressing for ext/soap

nospam@example.com (Rob Richards) — Tue, 21 Nov 2006 05:15:00 -0500

I've ran into services in the past that supported WS-Addressing, but it was only recently that I worked with one requiring it in addition to WS-Security. It's not very difficult to implement, but I threw together a library for anyone else that might need to leverage it.

WS-Addressing Library: soap-wsa.php
WS-Addressing Example: soap-wsa-example.php
* The example also uses WS-Security (not required for WS-Addressing) but demonstrates some new WS-Security functionality.

The functionality has only been implemented for a SOAP client side and has only been tested against a .NET service. If anyone runs into any bugs or interoperability issues, please let me know so they can be addressed.

Continue reading "WS-Addressing for ext/soap"