WS-Trust over OAuth: a third transport for the OpenID server, for the estate that runs on SOAP

说明与用途

redb.Identity 添加了 WS-Trust 门面，使 SOAP 客户端能够在不更改代码的情况下获取和使用 OAuth 令牌，同时保持单一令牌模型，并与 HTTP 和 gRPC 兼容。

问题

Estates that rely on SOAP and WCF/CXF buses need an OAuth-compatible token service without adopting HTTP-based OAuth flows, which require tooling and habits they lack.

结果

A single redb.Identity instance now supports three transports (HTTP, gRPC, WS-Trust) with a unified token model, allowing legacy SOAP estates to integrate OAuth tokens without new tooling.

工作流

• 1. Serve WSDL via GET on the WS-Trust endpoint
• 2. Register a client over HTTP (/connect/register)
• 3. Issue a token via SOAP Issue operation (UsernameToken with client credentials)
• 4. Validate the token via SOAP Validate operation
• 5. Cancel the token via SOAP Cancel operation
• 6. Re-validate to confirm revocation
• 7. Attempt to use the token over HTTP to access a protected endpoint
• 8. Observe that the same token is accepted over HTTP
• 9. Test error handling: send wrong secret, observe soap:Fault with wst:FailedAuthentication
• 10. Verify rate limiting and other core verdicts are correctly mapped to WS-Trust faults

证据

redb.Identity gained a WS-Trust facade: Issue, Validate, Cancel, Renew on the same core routes.

来源

A token minted over SOAP is accepted over HTTP and gets the same verdict there.

来源

redb.Identity.Soap refuses to start without TLS: WS-Security UsernameToken carries the client secret in clear text.

来源