WS-Trust over OAuth: a third transport for the OpenID server, for the estate that runs on SOAP

Описание и применение

redb.Identity добавил WS-Trust фасад, позволяющий SOAP‑клиентам получать и использовать OAuth‑токены без изменения кода, сохраняя единый токен‑модель и обеспечивая совместимость с HTTP и gRPC.

Задача

Estates that rely on SOAP and WCF/CXF buses need an OAuth-compatible token service without adopting HTTP-based OAuth flows, which require tooling and habits they lack.

Результат

A single redb.Identity instance now supports three transports (HTTP, gRPC, WS-Trust) with a unified token model, allowing legacy SOAP estates to integrate OAuth tokens without new tooling.

Рабочий процесс

• 1. Serve WSDL via GET on the WS-Trust endpoint
• 2. Register a client over HTTP (/connect/register)
• 3. Issue a token via SOAP Issue operation (UsernameToken with client credentials)
• 4. Validate the token via SOAP Validate operation
• 5. Cancel the token via SOAP Cancel operation
• 6. Re-validate to confirm revocation
• 7. Attempt to use the token over HTTP to access a protected endpoint
• 8. Observe that the same token is accepted over HTTP
• 9. Test error handling: send wrong secret, observe soap:Fault with wst:FailedAuthentication
• 10. Verify rate limiting and other core verdicts are correctly mapped to WS-Trust faults

Доказательства

redb.Identity gained a WS-Trust facade: Issue, Validate, Cancel, Renew on the same core routes.

Источник

A token minted over SOAP is accepted over HTTP and gets the same verdict there.

Источник

redb.Identity.Soap refuses to start without TLS: WS-Security UsernameToken carries the client secret in clear text.

Источник