akami 1.2.2 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 825ae5faa9ad5fa6de8a41b5cafaf9440c1ed815
-  data.tar.gz: eb85cd1306247a20e0197a6243f4655814c1ff66
+  metadata.gz: 208bce131b542d769f19dd08ee9ca4fabffd2bb3
+  data.tar.gz: ab59a51d740dcabd830313410803fe6853bedbfa
 SHA512:
-  metadata.gz: 68eca4d3c681de14d7b263214f1572cea56890783daf3dfb7f9fd72e1489f61119e38cce7baae1eac854d22b5afd8bb35fc82f2563c54550006136357a32fb62
-  data.tar.gz: 8888ee881ba31dea74e698f232dd63c72b420d4c01d1aee5ffd06b231d3361026e49ee87571dfcbcb3d1623a3c404a8e92f374c7850058cc0a9818fb2e9a6552
+  metadata.gz: 675a10d8d0cbf41cb96627f736c372c1c8a9fc9793c28e35ffafee7f916c57e0cd7d901be1fda698d42bec82de71fe161bda6fa7ed66a897fcbb379fb687b680
+  data.tar.gz: a2d88a8c8966bad864ebc14f150ee950748de0567a60d9db7568d3983de929ea223a105f308528ad13f6189d3f538479bc63c4c72a2fdffcabff48ff879d60e2

data/.travis.yml

@@ -2,7 +2,11 @@
 language: "ruby"
 script: "bundle exec rake"
 rvm:
-  - 1.9.2
   - 1.9.3
+  - 2.0
+  - 2.1
+  - 2.2
   - jruby-19mode
-  - rbx
+  - rbx-2
+notifications:
+  irc: "irc.freenode.org#savon"

data/CHANGELOG.md

@@ -1,4 +1,6 @@
-## master
+## 1.3.0 (2015-03-31)
+
+* Formally drop support for ruby 1.8.7
 
 ## 1.2.1 (2014-01-31)
 * Fix: [#2](https://github.com/savonrb/akami/pull/2) Fixes related to WS-Security,

data/akami.gemspec

@@ -10,6 +10,7 @@ Gem::Specification.new do |s|
   s.homepage    = "https://github.com/savonrb/#{s.name}"
   s.summary     = "Web Service Security"
   s.description = "Building Web Service Security"
+  s.required_ruby_version = '>= 1.9.2'
 
   s.rubyforge_project = s.name
   s.license = "MIT"
@@ -18,7 +19,7 @@ Gem::Specification.new do |s|
   s.add_dependency "nokogiri"
 
   s.add_development_dependency "rake",    "~> 10.0"
-  s.add_development_dependency "rspec",   "~> 2.12"
+  s.add_development_dependency "rspec",   "~> 2.14"
   s.add_development_dependency "mocha",   "~> 0.13"
   s.add_development_dependency "timecop", "~> 0.5"
 

data/lib/akami/version.rb

@@ -1,5 +1,5 @@
 module Akami
 
-  VERSION = "1.2.2"
+  VERSION = "1.3.0"
 
 end

data/lib/akami/wsse.rb

@@ -115,7 +115,7 @@ module Akami
       if digest?
         token = security_hash :wsse, "UsernameToken",
           "wsse:Username" => username,
-          "wsse:Nonce" => Base64.encode64(nonce),
+          "wsse:Nonce" => Base64.encode64(nonce).chomp,
           "wsu:Created" => timestamp,
           "wsse:Password" => digest_password,
           :attributes! => { "wsse:Password" => { "Type" => PASSWORD_DIGEST_URI },  "wsse:Nonce" => { "EncodingType" => BASE64_URI } }

data/lib/akami/wsse/certs.rb

@@ -9,16 +9,26 @@ module Akami
         end
       end
 
-      attr_accessor :cert_file, :private_key_file, :private_key_password
+      attr_accessor :cert_file, :cert_string, :private_key_file, :private_key_string, :private_key_password
 
-      # Returns an <tt>OpenSSL::X509::Certificate</tt> for the +cert_file+.
+      # Returns an <tt>OpenSSL::X509::Certificate</tt> for the +cert_string+ or +cert_file+.
       def cert
-        @cert ||= OpenSSL::X509::Certificate.new File.read(cert_file) if cert_file
+        @cert ||=
+          if cert_string.present?
+            OpenSSL::X509::Certificate.new(cert_string)
+          elsif cert_file.present?
+            OpenSSL::X509::Certificate.new(File.read(cert_file))
+          end
       end
 
-      # Returns an <tt>OpenSSL::PKey::RSA</tt> for the +private_key_file+.
+      # Returns an <tt>OpenSSL::PKey::RSA</tt> for the +private_key_string+ or +private_key_file+.
       def private_key
-        @private_key ||= OpenSSL::PKey::RSA.new(File.read(private_key_file), private_key_password) if private_key_file
+        @private_key ||=
+          if private_key_string.present?
+            OpenSSL::PKey::RSA.new(private_key_string, private_key_password)
+          elsif private_key_file.present?
+            OpenSSL::PKey::RSA.new(File.read(private_key_file), private_key_password)
+          end
       end
     end
   end

data/lib/akami/wsse/signature.rb

@@ -14,7 +14,8 @@ module Akami
       # Without a document, the document cannot be signed.
       # Generate the document once, and then set document and recall #to_token
       def document
-        @document ? @document.to_s : nil
+        return nil if @document.nil?
+        @document.to_xml(save_with: Nokogiri::XML::Node::SaveOptions::AS_XML)
       end
 
       def document=(document)

data/lib/akami/wsse/verify_signature.rb

@@ -1,88 +1,158 @@
+require 'nokogiri'
+require 'openssl'
+
 module Akami
   class WSSE
     class InvalidSignature < RuntimeError; end
 
+    # Validating WSSE signed messages.
     class VerifySignature
-      include Akami::XPathHelper
       include Akami::C14nHelper
 
       class InvalidDigest < RuntimeError; end
       class InvalidSignedValue < RuntimeError; end
 
-      attr_reader :response_body, :document
+      attr_reader :document
 
-      def initialize(response_body)
-        @response_body = response_body
-        @document = create_document
+      def initialize(xml)
+        @document = Nokogiri::XML(xml.to_s, &:noblanks)
       end
 
-      def generate_digest(element)
-        element = element_for_xpath(element) if element.is_a? String
-        xml = canonicalize(element)
-        digest(xml).strip
+      # Returns XML namespaces that are used internally for document querying.
+      def namespaces
+        @namespaces ||= {
+          wse: Akami::WSSE::WSE_NAMESPACE,
+          ds:  'http://www.w3.org/2000/09/xmldsig#',
+          wsu: Akami::WSSE::WSU_NAMESPACE,
+        }
       end
 
-      def supplied_digest(element)
-        element = element_for_xpath(element) if element.is_a? String
-        find_digest_value element.attributes["Id"]
-      end
-
-      def signature_value
-        element = element_for_xpath("//Security/Signature/SignatureValue")
-        element ? element.text : ""
-      end
+      # Allows to replace used XML namespaces if anyone will ever need. +hash+ should be a +Hash+ with symbol keys +:wse+, +:ds+, and +:wsu+.
+      attr_writer :namespaces
 
+      # Returns signer's certificate, bundled in signed document
       def certificate
-        certificate_value = element_for_xpath("//Security/BinarySecurityToken").text.strip
+        certificate_value = document.at_xpath('//wse:Security/wse:BinarySecurityToken', namespaces).text.strip
         OpenSSL::X509::Certificate.new Base64.decode64(certificate_value)
       end
 
+      # Validates document signature, returns +true+ on success, +false+ otherwise.
       def valid?
         verify
       rescue InvalidDigest, InvalidSignedValue
         return false
       end
 
+      # Validates document signature and digests and raises if anything mismatches.
       def verify!
         verify
       rescue InvalidDigest, InvalidSignedValue => e
         raise InvalidSignature, e.message
       end
 
+      # Returns a hash with currently initialized digesters.
+      #
+      # Will be empty after initialization, and will contain used algorithms after verification.
+      #
+      # May be used to insert additional digesters, not supported out of the box, for example:
+      #
+      #   digesters['http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'] = OpenSSL::Digest::SHA512.new
+
+      def digesters
+        @digesters
+      end
+
       private
 
       def verify
-        xpath(document, "//Security/Signature/SignedInfo/Reference").each do |ref|
-          element_id = ref.attributes["URI"][1..-1] # strip leading '#'
-          element = element_for_xpath(%(//*[@wsu:Id="#{element_id}"]))
-          raise InvalidDigest, "Invalid Digest for #{element_id}" unless supplied_digest(element) == generate_digest(element)
+        document.xpath('//wse:Security/ds:Signature/ds:SignedInfo/ds:Reference', namespaces).each do |ref|
+          digest_algorithm = ref.at_xpath('//ds:DigestMethod', namespaces)['Algorithm']
+          element_id = ref.attributes['URI'].value[1..-1] # strip leading '#'
+          element = document.at_xpath(%(//*[@wsu:Id="#{element_id}"]), namespaces)
+          unless supplied_digest(element) == generate_digest(element, digest_algorithm)
+            raise InvalidDigest, "Invalid Digest for #{element_id}"
+          end
         end
 
         data = canonicalize(signed_info)
         signature = Base64.decode64(signature_value)
+        signature_algorithm = document.at_xpath('//wse:Security/ds:Signature/ds:SignedInfo/ds:SignatureMethod', namespaces)['Algorithm']
+        signature_digester = digester_for_signature_method(signature_algorithm)
 
-        certificate.public_key.verify(OpenSSL::Digest::SHA1.new, signature, data) or raise InvalidSignedValue, "Could not verify the signature value"
+        certificate.public_key.verify(signature_digester, signature, data) or raise InvalidSignedValue, "Could not verify the signature value"
       end
 
-      def create_document
-        Nokogiri::XML response_body
+      def signed_info
+        document.at_xpath('//wse:Security/ds:Signature/ds:SignedInfo', namespaces)
       end
 
-      def element_for_xpath(xpath)
-        document.at_xpath xpath
+      # Generate digest for a given +element+ (or its XPath) with a given +algorithm+
+      def generate_digest(element, algorithm)
+        element = document.at_xpath(element, namespaces) if element.is_a? String
+        xml = canonicalize(element)
+        digest(xml, algorithm).strip
       end
 
-      def signed_info
-        at_xpath document, "//Security/Signature/SignedInfo"
+      def supplied_digest(element)
+        element = document.at_xpath(element, namespaces) if element.is_a? String
+        find_digest_value element.attributes['Id'].value
+      end
+
+      def signature_value
+        element = document.at_xpath('//wse:Security/ds:Signature/ds:SignatureValue', namespaces)
+        element ? element.text : ""
       end
 
       def find_digest_value(id)
-        at_xpath(document, %(//Security/Signature/SignedInfo/Reference[@URI="##{id}"]/DigestValue)).text
+        document.at_xpath(%(//wse:Security/ds:Signature/ds:SignedInfo/ds:Reference[@URI="##{id}"]/ds:DigestValue), namespaces).text
       end
 
-      def digest(string)
-        Base64.encode64 OpenSSL::Digest::SHA1.digest(string)
+      # Calculate digest for string with given algorithm URL and Base64 encodes it.
+      def digest(string, algorithm)
+        Base64.encode64 digester(algorithm).digest(string)
       end
+
+      # Returns digester for calculating digest for signature verification
+      def digester_for_signature_method(algorithm_url)
+        signature_digest_mapping = {
+          'http://www.w3.org/2000/09/xmldsig#rsa-sha1' => 'http://www.w3.org/2000/09/xmldsig#sha1',
+          'http://www.w3.org/2001/04/xmldsig-more#gostr34102001-gostr3411' => 'http://www.w3.org/2001/04/xmldsig-more#gostr3411',
+        }
+        digest_url = signature_digest_mapping[algorithm_url] || algorithm_url
+        digester(digest_url)
+      end
+
+      # Constructors for known digest calculating objects
+      DIGESTERS = {
+          # SHA1
+          'http://www.w3.org/2000/09/xmldsig#sha1' => lambda { OpenSSL::Digest::SHA1.new },
+          # SHA 256
+          'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' => lambda { OpenSSL::Digest::SHA256.new },
+          # GOST R 34.11-94
+          # You need correctly configured gost engine in your system OpenSSL, requires OpenSSL >= 1.0.0
+          # see https://github.com/openssl/openssl/blob/master/engines/ccgost/README.gost
+          'http://www.w3.org/2001/04/xmldsig-more#gostr3411' => lambda {
+            if defined? JRUBY_VERSION
+              OpenSSL::Digest.new('GOST3411')
+            else
+              OpenSSL::Engine.load
+              gost_engine = OpenSSL::Engine.by_id('gost')
+              gost_engine.set_default(0xFFFF)
+              gost_engine.digest('md_gost94')
+            end
+          },
+      }
+
+      # Returns instance of +OpenSSL::Digest+ class, initialized, reset, and ready to calculate new hashes.
+      def digester(url)
+        @digesters ||= {}
+        unless @digesters[url]
+          DIGESTERS[url] or raise InvalidDigest, "Digest algorithm not supported: #{url}"
+          @digesters[url] = DIGESTERS[url].call
+        end
+        @digesters[url].reset
+      end
+
     end
   end
 end

data/spec/akami/wsse/signature_spec.rb

@@ -0,0 +1,34 @@
+require 'spec_helper'
+
+describe Akami::WSSE::Signature do
+
+  let(:validator) { Akami::WSSE::VerifySignature.new(xml) }
+  let(:xml) { '' }
+
+  let(:fixtures_path) {
+    File.join(Bundler.root, 'spec', 'fixtures', 'akami', 'wsse', 'signature' )
+  }
+  let(:cert_path) { File.join(fixtures_path, 'cert.pem') }
+  let(:password) { 'password' }
+
+  let(:signature) {
+    Akami::WSSE::Signature.new(
+      Akami::WSSE::Certs.new(
+        cert_file:            cert_path,
+        private_key_file:     cert_path,
+        private_key_password: password
+      )
+    )
+  }
+
+  context 'to_token' do
+    let(:xml) { fixture('akami/wsse/signature/unsigned.xml') }
+
+    it 'should ignore excessive whitespace' do
+      signature.document = xml
+      expect(signature.document).not_to include("  ")
+    end
+
+  end
+
+end

data/spec/akami/wsse/verify_signature_spec.rb

@@ -0,0 +1,55 @@
+require 'spec_helper'
+
+describe Akami::WSSE::VerifySignature do
+
+  it 'should validate correctly signed XML messages' do
+    xml = fixture('akami/wsse/verify_signature/valid.xml')
+    validator = described_class.new(xml)
+    validator.verify!.should eq(true)
+  end
+
+  it 'should validate correctly signed XML messages with differently named namespaces' do
+    xml = fixture('akami/wsse/verify_signature/valid_namespaces.xml')
+    validator = described_class.new(xml)
+    validator.verify!.should eq(true)
+  end
+
+  it 'should validate correctly signed XML messages with whitespaces' do
+    xml = fixture('akami/wsse/verify_signature/valid_whitespaces.xml')
+    validator = described_class.new(xml)
+    expect(validator.verify!).to equal(true)
+  end
+
+  it 'should not validate signed XML messages with digested content changed' do
+    xml = fixture('akami/wsse/verify_signature/invalid_digested_changed.xml')
+    validator = described_class.new(xml)
+    expect{ validator.verify! }.to raise_error(Akami::WSSE::InvalidSignature)
+  end
+
+  it 'should not validate signed XML messages with digest changed' do
+    xml = fixture('akami/wsse/verify_signature/invalid_digest_changed.xml')
+    validator = described_class.new(xml)
+    expect{ validator.verify! }.to raise_error(Akami::WSSE::InvalidSignature)
+  end
+
+  it 'should not validate signed XML messages with signature changed' do
+    xml = fixture('akami/wsse/verify_signature/invalid_signature_changed.xml')
+    validator = described_class.new(xml)
+    expect{ validator.verify! }.to raise_error(Akami::WSSE::InvalidSignature)
+  end
+
+  # There is no testing for messages signed with GOST as it requires patched Ruby
+  # But we can test GOST digest calculation
+  it 'should validate correctly signed XML messages with RSA-SHA1 signature and GOST R 34.11-94 digests' do
+    xml = fixture('akami/wsse/verify_signature/valid_sha1_gost.xml')
+    validator = described_class.new(xml)
+    expect(validator.verify!).to equal(true)
+  end
+
+  it 'should validate correctly signed XML messages with SHA256 signature and SHA256 digests' do
+    xml = fixture('akami/wsse/verify_signature/valid_sha256.xml')
+    validator = described_class.new(xml)
+    expect(validator.verify!).to equal(true)
+  end
+
+end

data/spec/akami/wsse_spec.rb

@@ -6,81 +6,86 @@ describe Akami do
   let(:wsse) { Akami.wsse }
 
   it "contains the namespace for WS Security Secext" do
-    Akami::WSSE::WSE_NAMESPACE.should ==
+    expect(Akami::WSSE::WSE_NAMESPACE).to eq(
       "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
+    )
   end
 
   it "contains the namespace for WS Security Utility" do
-    Akami::WSSE::WSU_NAMESPACE.should ==
+    expect(Akami::WSSE::WSU_NAMESPACE).to eq(
       "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
+    )
   end
 
   it "contains the namespace for the PasswordText type" do
-    Akami::WSSE::PASSWORD_TEXT_URI.should ==
+    expect(Akami::WSSE::PASSWORD_TEXT_URI).to eq(
       "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"
+    )
   end
 
   it "contains the namespace for the PasswordDigest type" do
-    Akami::WSSE::PASSWORD_DIGEST_URI.should ==
+    expect(Akami::WSSE::PASSWORD_DIGEST_URI).to eq(
       "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest"
+    )
   end
 
   it "contains the namespace for Base64 Encoding type" do 
-    Akami::WSSE::BASE64_URI.should == 
+    expect(Akami::WSSE::BASE64_URI).to eq( 
       "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
+    )
   end
 
   describe "#credentials" do
     it "sets the username" do
       wsse.credentials "username", "password"
-      wsse.username.should == "username"
+      expect(wsse.username).to eq("username")
     end
 
     it "sets the password" do
       wsse.credentials "username", "password"
-      wsse.password.should == "password"
+      expect(wsse.password).to eq("password")
     end
 
     it "defaults to set digest to false" do
       wsse.credentials "username", "password"
-      wsse.should_not be_digest
+      expect(wsse).not_to be_digest
     end
 
     it "sets digest to true if specified" do
       wsse.credentials "username", "password", :digest
-      wsse.should be_digest
+      expect(wsse).to be_digest
     end
   end
 
   describe "#username" do
     it "sets the username" do
       wsse.username = "username"
-      wsse.username.should == "username"
+      expect(wsse.username).to eq("username")
     end
   end
 
   describe "#password" do
     it "sets the password" do
       wsse.password = "password"
-      wsse.password.should == "password"
+      expect(wsse.password).to eq("password")
     end
   end
 
   describe "#digest" do
     it "defaults to false" do
-      wsse.should_not be_digest
+      expect(wsse).not_to be_digest
     end
 
     it "specifies whether to use digest auth" do
       wsse.digest = true
-      wsse.should be_digest
+      expect(wsse).to be_digest
     end
   end
 
   describe "#to_xml" do
     context "with no credentials" do
       it "returns an empty String" do
-        wsse.to_xml.should == ""
+        expect(wsse.to_xml).to eq("")
       end
     end
 
@@ -88,7 +93,7 @@ describe Akami do
       before { wsse.username = "username" }
 
       it "returns an empty String" do
-        wsse.to_xml.should == ""
+        expect(wsse.to_xml).to eq("")
       end
     end
 
@@ -96,7 +101,7 @@ describe Akami do
       before { wsse.password = "password" }
 
       it "returns an empty String" do
-        wsse.to_xml.should == ""
+        expect(wsse.to_xml).to eq("")
       end
     end
 
@@ -105,36 +110,36 @@ describe Akami do
 
       it "contains a wsse:Security tag" do
         namespace = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
-        wsse.to_xml.should include("<wsse:Security xmlns:wsse=\"#{namespace}\">")
+        expect(wsse.to_xml).to include("<wsse:Security xmlns:wsse=\"#{namespace}\">")
       end
 
       it "contains a wsu:Id attribute" do
-        wsse.to_xml.should include('<wsse:UsernameToken wsu:Id="UsernameToken-1"')
+        expect(wsse.to_xml).to include('<wsse:UsernameToken wsu:Id="UsernameToken-1"')
       end
 
       it "increments the wsu:Id attribute count" do
-        wsse.to_xml.should include('<wsse:UsernameToken wsu:Id="UsernameToken-1"')
-        wsse.to_xml.should include('<wsse:UsernameToken wsu:Id="UsernameToken-2"')
+        expect(wsse.to_xml).to include('<wsse:UsernameToken wsu:Id="UsernameToken-1"')
+        expect(wsse.to_xml).to include('<wsse:UsernameToken wsu:Id="UsernameToken-2"')
       end
 
       it "contains the WSE and WSU namespaces" do
-        wsse.to_xml.should include(Akami::WSSE::WSE_NAMESPACE, Akami::WSSE::WSU_NAMESPACE)
+        expect(wsse.to_xml).to include(Akami::WSSE::WSE_NAMESPACE, Akami::WSSE::WSU_NAMESPACE)
       end
 
       it "contains the username and password" do
-        wsse.to_xml.should include("username", "password")
+        expect(wsse.to_xml).to include("username", "password")
       end
 
       it "does not contain a wsse:Nonce tag" do
-        wsse.to_xml.should_not match(/<wsse:Nonce.*>.*<\/wsse:Nonce>/)
+        expect(wsse.to_xml).not_to match(/<wsse:Nonce.*>.*<\/wsse:Nonce>/)
       end
 
       it "does not contain a wsu:Created tag" do
-        wsse.to_xml.should_not match(/<wsu:Created>.*<\/wsu:Created>/)
+        expect(wsse.to_xml).not_to match(/<wsu:Created>.*<\/wsu:Created>/)
       end
 
       it "contains the PasswordText type attribute" do
-        wsse.to_xml.should include(Akami::WSSE::PASSWORD_TEXT_URI)
+        expect(wsse.to_xml).to include(Akami::WSSE::PASSWORD_TEXT_URI)
       end
     end
 
@@ -142,30 +147,30 @@ describe Akami do
       before { wsse.credentials "username", "password", :digest }
 
       it "contains the WSE and WSU namespaces" do
-        wsse.to_xml.should include(Akami::WSSE::WSE_NAMESPACE, Akami::WSSE::WSU_NAMESPACE)
+        expect(wsse.to_xml).to include(Akami::WSSE::WSE_NAMESPACE, Akami::WSSE::WSU_NAMESPACE)
       end
 
       it "contains the username" do
-        wsse.to_xml.should include("username")
+        expect(wsse.to_xml).to include("username")
       end
 
       it "does not contain the (original) password" do
-        wsse.to_xml.should_not include("password")
+        expect(wsse.to_xml).not_to include("password")
       end
 
       it "contains the Nonce base64 type attribute" do
-        wsse.to_xml.should include(Akami::WSSE::BASE64_URI)
+        expect(wsse.to_xml).to include(Akami::WSSE::BASE64_URI)
       end
 
       it "contains a wsu:Created tag" do
         created_at = Time.now
         Timecop.freeze created_at do
-          wsse.to_xml.should include("<wsu:Created>#{created_at.utc.xmlschema}</wsu:Created>")
+          expect(wsse.to_xml).to include("<wsu:Created>#{created_at.utc.xmlschema}</wsu:Created>")
         end
       end
 
       it "contains the PasswordDigest type attribute" do
-        wsse.to_xml.should include(Akami::WSSE::PASSWORD_DIGEST_URI)
+        expect(wsse.to_xml).to include(Akami::WSSE::PASSWORD_DIGEST_URI)
       end
 
       it "should reset the nonce every time" do
@@ -174,7 +179,7 @@ describe Akami do
           nonce_regexp = /<wsse:Nonce.*>([^<]+)<\/wsse:Nonce>/
           nonce_first = Base64.decode64(nonce_regexp.match(wsse.to_xml)[1])
           nonce_second = Base64.decode64(nonce_regexp.match(wsse.to_xml)[1])
-          nonce_first.should_not == nonce_second
+          expect(nonce_first).not_to eq(nonce_second)
         end
       end
 
@@ -184,7 +189,7 @@ describe Akami do
         nonce = Base64.decode64(xml_header.xpath('//Nonce').first.content)
         created_at = xml_header.xpath('//Created').first.content
         password_hash = Base64.decode64(xml_header.xpath('//Password').first.content)
-        password_hash.should == Digest::SHA1.digest((nonce + created_at + "password"))
+        expect(password_hash).to eq(Digest::SHA1.digest((nonce + created_at + "password")))
       end
     end
 
@@ -192,21 +197,21 @@ describe Akami do
       before { wsse.timestamp = true }
 
       it "contains a wsse:Timestamp node" do
-        wsse.to_xml.should include('<wsu:Timestamp wsu:Id="Timestamp-1" ' +
+        expect(wsse.to_xml).to include('<wsu:Timestamp wsu:Id="Timestamp-1" ' +
           'xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">')
       end
 
       it "contains a wsu:Created node defaulting to Time.now" do
         created_at = Time.now
         Timecop.freeze created_at do
-          wsse.to_xml.should include("<wsu:Created>#{created_at.utc.xmlschema}</wsu:Created>")
+          expect(wsse.to_xml).to include("<wsu:Created>#{created_at.utc.xmlschema}</wsu:Created>")
         end
       end
 
       it "contains a wsu:Expires node defaulting to Time.now + 60 seconds" do
         created_at = Time.now
         Timecop.freeze created_at do
-          wsse.to_xml.should include("<wsu:Expires>#{(created_at + 60).utc.xmlschema}</wsu:Expires>")
+          expect(wsse.to_xml).to include("<wsu:Expires>#{(created_at + 60).utc.xmlschema}</wsu:Expires>")
         end
       end
     end
@@ -215,11 +220,11 @@ describe Akami do
       before { wsse.created_at = Time.now + 86400 }
 
       it "contains a wsu:Created node with the given time" do
-        wsse.to_xml.should include("<wsu:Created>#{wsse.created_at.utc.xmlschema}</wsu:Created>")
+        expect(wsse.to_xml).to include("<wsu:Created>#{wsse.created_at.utc.xmlschema}</wsu:Created>")
       end
 
       it "contains a wsu:Expires node set to #created_at + 60 seconds" do
-        wsse.to_xml.should include("<wsu:Expires>#{(wsse.created_at + 60).utc.xmlschema}</wsu:Expires>")
+        expect(wsse.to_xml).to include("<wsu:Expires>#{(wsse.created_at + 60).utc.xmlschema}</wsu:Expires>")
       end
     end
 
@@ -229,12 +234,12 @@ describe Akami do
       it "contains a wsu:Created node defaulting to Time.now" do
         created_at = Time.now
         Timecop.freeze created_at do
-          wsse.to_xml.should include("<wsu:Created>#{created_at.utc.xmlschema}</wsu:Created>")
+          expect(wsse.to_xml).to include("<wsu:Created>#{created_at.utc.xmlschema}</wsu:Created>")
         end
       end
 
       it "contains a wsu:Expires node set to the given time" do
-        wsse.to_xml.should include("<wsu:Expires>#{wsse.expires_at.utc.xmlschema}</wsu:Expires>")
+        expect(wsse.to_xml).to include("<wsu:Expires>#{wsse.expires_at.utc.xmlschema}</wsu:Expires>")
       end
     end
 
@@ -245,15 +250,15 @@ describe Akami do
       end
 
       it "contains a wsu:Created node" do
-        wsse.to_xml.should include("<wsu:Created>")
+        expect(wsse.to_xml).to include("<wsu:Created>")
       end
 
       it "contains a wsu:Expires node" do
-        wsse.to_xml.should include("<wsu:Expires>")
+        expect(wsse.to_xml).to include("<wsu:Expires>")
       end
 
       it "contains the username and password" do
-        wsse.to_xml.should include("username", "password")
+        expect(wsse.to_xml).to include("username", "password")
       end
     end
   end

data/spec/fixtures/akami/wsse/signature/cert.pem

@@ -0,0 +1,37 @@
+-----BEGIN CERTIFICATE-----
+MIIDIjCCAougAwIBAgIJAI53JnRgJIJwMA0GCSqGSIb3DQEBBQUAMGoxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNp
+c2NvMQ4wDAYDVQQKEwVTYXZvbjEOMAwGA1UECxMFU2F2b24xDjAMBgNVBAMTBVNh
+dm9uMB4XDTE0MTIwMjAwMTMwMloXDTI0MTEyOTAwMTMwMlowajELMAkGA1UEBhMC
+VVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28x
+DjAMBgNVBAoTBVNhdm9uMQ4wDAYDVQQLEwVTYXZvbjEOMAwGA1UEAxMFU2F2b24w
+gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM56hKF3+4SSUu8msb5HWMvp322y
+QL+luJ+Lt/r/ib7EPeb4UU68b+Wf3xIa3N1+w8tDQghCR4YuEIILKH/UGC785Old
+VJfikD4kxiwF4jB0RgdRK/JEG/UthHKqJID+oyijW4ws4MgZ/bWMhSbSVRioqcwe
+2JElg/m2TemKJkXDAgMBAAGjgc8wgcwwHQYDVR0OBBYEFKSd+UicrRDQS2NeLSEA
+Zpipjk8EMIGcBgNVHSMEgZQwgZGAFKSd+UicrRDQS2NeLSEAZpipjk8EoW6kbDBq
+MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2Fu
+IEZyYW5jaXNjbzEOMAwGA1UEChMFU2F2b24xDjAMBgNVBAsTBVNhdm9uMQ4wDAYD
+VQQDEwVTYXZvboIJAI53JnRgJIJwMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF
+BQADgYEAWI27+cDx3U53zaJROXKfQutqUZzZz9B0NzQ0vlN2h5UbACGbXH9C1wLz
+MBvNjgEiK+/jHSadSDgfvADv+2hCsFw8eNgbisWiV5yvDyTqttg3cSJHz8jRDeA+
+jnvaC9Y//AoRr/WGKKU3FY40J7pQKcQNczGUzCS+ag0IO64agTs=
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-EDE3-CBC,A0BF079E41C9A4C1
+
+rEO5mWOWbnr8uyjtfIRwW9wRo2/y1wMON2c605BkgaNeAKH/++1UC9qEhNtHfE2Q
+omQkXiHfV6yt3l3dWPcnA9ToT9PRNLyoRMMC+Ds5EuEk4ypihQ8SS2xt3wqCRkwm
+3/AyrRZXUnBTVzZ9D35lz1HCFfJ61UpOMN9XOZy4yUqDZVG/ybMhXilfNKgTr8xJ
+StTb7ruwV/8xTiEgmcxGKJbOcDKqwsd/mW3VbDN6zOqYC0TlFc/eiCbJxMd35l6a
+oRfHWHbabumcfZplqoDcOwYpRb8ZiDbu74RrDogKnpH7nnJrp8jSYueCiXGDWGFG
+ZXB6f2FhsbrLEM87L8cxJO6Hk6+c39qgiP2aRICeKjUNKPOfSiPr4yP4/g3tFY2z
+sI9xur3nAXoqxXBrEkEdvXiH35UfJpqOTxbAN+Ozxnj1QeLWDDE8nkMW/XRRxdCk
+jeUwR5PS3sM2S/fIn7rThQSKRMxznK//cEUsMwz514HekxnKyj8rZUETcFFySxmz
+lmOzDOaPNejDOgNSrlT+IDqE9YlMxLObv5l960QOjk0qBaO8e33HkgfBqENzq7Uv
+Wrj3FyBlNz4vfhCZHBY0+rSgdZHM64DV0HybE7yc+mMUwrV7ish1bGb/Bek/4JF+
+lrpRuxTEQFGNTGFYa0C5zDpz9UtiSUs2X4EX74GfxCUmn7kNND+4OVrndZiEONPz
+/6QffS7YG1UtahDpDzI1wOCYD9Iwg/HnmTWMcXj2Yw7jRvlG0sArw/5dNJkrmuJY
+6PvFoEeZSF4qrUCDlw/BUJMaGDlhSCyTWulZZU+wWuJRTWCiDxYO1g==
+-----END RSA PRIVATE KEY-----

data/spec/fixtures/akami/wsse/signature/unsigned.xml

@@ -0,0 +1 @@
+<?xml version="1.0" encoding="UTF-8"?><env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tns="https://api.example.com/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><env:Header xmlns:wsa="http://www.w3.org/2005/08/addressing"><wsa:Action>http://api.example.com/echo</wsa:Action><wsa:To>https://api.example.com</wsa:To><wsa:MessageID xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing">urn:uuid:52d12080-5bec-0132-62fb-38f6b11526bf</wsa:MessageID></env:Header><env:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Body-69182b6fd3cdbaa69e00e0bca6c58f6aee1e0c27"><tns:echo>Example</tns:echo></env:Body></env:Envelope>

data/spec/fixtures/akami/wsse/verify_signature/invalid_digest_changed.xml

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsa="http://www.w3.org/2005/08/addressing"><soap:Header><oasis:Security xmlns:oasis="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
+     <oasis:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" wsu:Id="uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1">MIIEZTCCA02gAwIBAgIJALaQmjuYuxpuMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNVBAYTAldXMRIwEAYDVQQIEwlXb3JsZHdpZGUxETAPBgNVBAcTCFhNTCBjaXR5MREwDwYDVQQKEwhTYXZvbi5yYjEhMB8GA1UECxMYQWthbWkgdGVzdGluZyBkZXBhcnRtZW50MRIwEAYDVQQDEwlBa2FtaSBHZW0wHhcNMTQwNjEwMDg1NjEzWhcNMjQwNjA3MDg1NjEzWjB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvjKxq8WnYOT7ymrSNmN95NFMXhLxdumQz0QniRURVQ1P2sOwxOw9mlFnMsdGwsTYUJ9TwwBvA82UAaHEp/mMlHVc0oIKBzMWXj3qK3paRpcooh9hVSGlnqGep+/mzpP9SgPeJRXUgewnnXYsdPkV3k+EFLP/ZwGKOu3lTf4eTNm+TfnW4jHQYg2DpXHXtfV/H2mlDl/p/oUSoUnD3rWrF8IDPTSpy/30KtiY9ijy4RhllbSxM5Y230rpvlty1qqlNI/g34thL15nFaU/aIWQ/KwiCqthldd3m92S9gQ+iY4YtJkxAFsVAWT8gF32pmCKeH5IMmihZqlno6pUG0pIHwIDAQABo4HlMIHiMB0GA1UdDgQWBBQxpPv3f9MSv1y+BoR07lNRWi78ODCBsgYDVR0jBIGqMIGngBQxpPv3f9MSv1y+BoR07lNRWi78OKGBg6SBgDB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtggkAtpCaO5i7Gm4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAZphue2C31+5SpoZiIQav3xtwfIt+PRtK0ZN0w2ZxR1LmbWS9jX4elvwE5B5Yyu4UmjyvXGA6j9s5PGedXMabpi9GWsaEfHRKsF/TrH0KauhPrAWTuc1UxMFM5zPc6LeWJ8ofaVIgg4S4UFnf/fnkc/BtMMDCIyb62HkRmV+FqOOD+LlkcT701VKty68ubCg9xKaLg7L4zZBPYJrt0iLY2LWKh4ABinxfA1DFEVw9PVIEQKopwkO1A10rrKbfZqALQg5egVQypfVJ7E0Nkq5VeT3d3u3ybnZw/ZprQR0uPm+Ap492itLMMUX3iyJkxteAfT+03ztKWEsmGMbZpzG7VA==</oasis:BinarySecurityToken><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference URI="#_779bc0e70903ff79e62739956a11c7e3584a9012"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>8yHW2c0jdon+CADkxk47/gLo0ps=</DigestValue></Reference><Reference URI="#_747c942c134dd275275707f2cf63e8de7881d367"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>eRsb4CWXD17hl5exQvaZYDnOQOM=</DigestValue></Reference><Reference URI="#_2dc10b4daca971ef4ddb482338ebd7ba30112e2a"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>1aznRVYGR81veFFG2lNU9WjUhDs=</DigestValue></Reference><Reference URI="#_1f546393fdadf04fd9afcf172658c78cfd1b735d"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>KXKU6ZFziN415Hd2K6WevzUihYs=</DigestValue></Reference><Reference URI="#_724554b8920321ee32020dac076be1f58d92d3c7"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>YrKqrE99N7hNGYEvrhifL/LaxKQ=</DigestValue></Reference><Reference URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>VevrJZBe3aVif18GuHIrSZz5my8=</DigestValue></Reference></SignedInfo><SignatureValue>NEJTWOxr2IdWOyV+b1XjRU1Koaa0OYDbz0MqErcqjEgLt3rgK2YyZpg2yMBB++YmlwhS2Gm/Iqnyv6U909hvF4Hg+9/kw/FiwqhavcW+/N9HZKo0vGww/rU4qcKrNdU/lETQhxfk5DpKAoAUWV6yGxnbP8GzTXWGtP4sfLlcFjfOkTnePEM7QLjJLk9l2YkvbmyaRClj3psYrh0Fo1G+LWZ7W8UpaPzoo8e+s2EkKDAbchWoQJp2vEIhLnRRWDMuweRpsURigjbIkJCKnawmZ8SG1nA68nYa9jTh6824XVepxbkvtvNzEFC6dmZAjwAWhADf1+7lpqUyml/wZyHWRw==</SignatureValue><KeyInfo><o:SecurityTokenReference><o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"/></o:SecurityTokenReference></KeyInfo></Signature></oasis:Security><wsa:Action wsu:Id="_779bc0e70903ff79e62739956a11c7e3584a9012">SomeAction</wsa:Action><wsa:To wsu:Id="_747c942c134dd275275707f2cf63e8de7881d367">https://strict.endpoint/path</wsa:To><wsa:ReplyTo wsu:Id="_2dc10b4daca971ef4ddb482338ebd7ba30112e2a"><wsa:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</wsa:Address></wsa:ReplyTo><wsa:MessageID wsu:Id="_1f546393fdadf04fd9afcf172658c78cfd1b735d">SRV-0f687bbd-62503e99-926a4d3c-5dde443c-dbf6d68f</wsa:MessageID></soap:Header><soap:Body wsu:Id="_724554b8920321ee32020dac076be1f58d92d3c7"><messageCode>code</messageCode><!-- Comments should be ignored during canonicalization --><message>message</message></soap:Body></soap:Envelope>

data/spec/fixtures/akami/wsse/verify_signature/invalid_digested_changed.xml

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsa="http://www.w3.org/2005/08/addressing"><soap:Header><oasis:Security xmlns:oasis="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
+     <oasis:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" wsu:Id="uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1">MIIEZTCCA02gAwIBAgIJALaQmjuYuxpuMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNVBAYTAldXMRIwEAYDVQQIEwlXb3JsZHdpZGUxETAPBgNVBAcTCFhNTCBjaXR5MREwDwYDVQQKEwhTYXZvbi5yYjEhMB8GA1UECxMYQWthbWkgdGVzdGluZyBkZXBhcnRtZW50MRIwEAYDVQQDEwlBa2FtaSBHZW0wHhcNMTQwNjEwMDg1NjEzWhcNMjQwNjA3MDg1NjEzWjB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvjKxq8WnYOT7ymrSNmN95NFMXhLxdumQz0QniRURVQ1P2sOwxOw9mlFnMsdGwsTYUJ9TwwBvA82UAaHEp/mMlHVc0oIKBzMWXj3qK3paRpcooh9hVSGlnqGep+/mzpP9SgPeJRXUgewnnXYsdPkV3k+EFLP/ZwGKOu3lTf4eTNm+TfnW4jHQYg2DpXHXtfV/H2mlDl/p/oUSoUnD3rWrF8IDPTSpy/30KtiY9ijy4RhllbSxM5Y230rpvlty1qqlNI/g34thL15nFaU/aIWQ/KwiCqthldd3m92S9gQ+iY4YtJkxAFsVAWT8gF32pmCKeH5IMmihZqlno6pUG0pIHwIDAQABo4HlMIHiMB0GA1UdDgQWBBQxpPv3f9MSv1y+BoR07lNRWi78ODCBsgYDVR0jBIGqMIGngBQxpPv3f9MSv1y+BoR07lNRWi78OKGBg6SBgDB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtggkAtpCaO5i7Gm4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAZphue2C31+5SpoZiIQav3xtwfIt+PRtK0ZN0w2ZxR1LmbWS9jX4elvwE5B5Yyu4UmjyvXGA6j9s5PGedXMabpi9GWsaEfHRKsF/TrH0KauhPrAWTuc1UxMFM5zPc6LeWJ8ofaVIgg4S4UFnf/fnkc/BtMMDCIyb62HkRmV+FqOOD+LlkcT701VKty68ubCg9xKaLg7L4zZBPYJrt0iLY2LWKh4ABinxfA1DFEVw9PVIEQKopwkO1A10rrKbfZqALQg5egVQypfVJ7E0Nkq5VeT3d3u3ybnZw/ZprQR0uPm+Ap492itLMMUX3iyJkxteAfT+03ztKWEsmGMbZpzG7VA==</oasis:BinarySecurityToken><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference URI="#_779bc0e70903ff79e62739956a11c7e3584a9012"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>8yHW2c0jdon+cADkxk47/gLo0ps=</DigestValue></Reference><Reference URI="#_747c942c134dd275275707f2cf63e8de7881d367"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>eRsb4CWXD17hl5exQvaZYDnOQOM=</DigestValue></Reference><Reference URI="#_2dc10b4daca971ef4ddb482338ebd7ba30112e2a"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>1aznRVYGR81veFFG2lNU9WjUhDs=</DigestValue></Reference><Reference URI="#_1f546393fdadf04fd9afcf172658c78cfd1b735d"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>KXKU6ZFziN415Hd2K6WevzUihYs=</DigestValue></Reference><Reference URI="#_724554b8920321ee32020dac076be1f58d92d3c7"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>YrKqrE99N7hNGYEvrhifL/LaxKQ=</DigestValue></Reference><Reference URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>VevrJZBe3aVif18GuHIrSZz5my8=</DigestValue></Reference></SignedInfo><SignatureValue>NEJTWOxr2IdWOyV+b1XjRU1Koaa0OYDbz0MqErcqjEgLt3rgK2YyZpg2yMBB++YmlwhS2Gm/Iqnyv6U909hvF4Hg+9/kw/FiwqhavcW+/N9HZKo0vGww/rU4qcKrNdU/lETQhxfk5DpKAoAUWV6yGxnbP8GzTXWGtP4sfLlcFjfOkTnePEM7QLjJLk9l2YkvbmyaRClj3psYrh0Fo1G+LWZ7W8UpaPzoo8e+s2EkKDAbchWoQJp2vEIhLnRRWDMuweRpsURigjbIkJCKnawmZ8SG1nA68nYa9jTh6824XVepxbkvtvNzEFC6dmZAjwAWhADf1+7lpqUyml/wZyHWRw==</SignatureValue><KeyInfo><o:SecurityTokenReference><o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"/></o:SecurityTokenReference></KeyInfo></Signature></oasis:Security><wsa:Action wsu:Id="_779bc0e70903ff79e62739956a11c7e3584a9012">SomeAction</wsa:Action><wsa:To wsu:Id="_747c942c134dd275275707f2cf63e8de7881d367">https://strict.endpoint/path</wsa:To><wsa:ReplyTo wsu:Id="_2dc10b4daca971ef4ddb482338ebd7ba30112e2a"><wsa:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</wsa:Address></wsa:ReplyTo><wsa:MessageID wsu:Id="_1f546393fdadf04fd9afcf172658c78cfd1b735d">SRV-0f687bbd-62503e99-926a4d3c-5dde443c-dbf6d68f</wsa:MessageID></soap:Header><soap:Body wsu:Id="_724554b8920321ee32020dac076be1f58d92d3c7"><messageCode>code</messageCode><!-- Comments should be ignored during canonicalization --><message>fake_message</message></soap:Body></soap:Envelope>

data/spec/fixtures/akami/wsse/verify_signature/invalid_signature_changed.xml

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsa="http://www.w3.org/2005/08/addressing"><soap:Header unexpected="unexpected"><oasis:Security xmlns:oasis="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
+     <oasis:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" wsu:Id="uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1">MIIEZTCCA02gAwIBAgIJALaQmjuYuxpuMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNVBAYTAldXMRIwEAYDVQQIEwlXb3JsZHdpZGUxETAPBgNVBAcTCFhNTCBjaXR5MREwDwYDVQQKEwhTYXZvbi5yYjEhMB8GA1UECxMYQWthbWkgdGVzdGluZyBkZXBhcnRtZW50MRIwEAYDVQQDEwlBa2FtaSBHZW0wHhcNMTQwNjEwMDg1NjEzWhcNMjQwNjA3MDg1NjEzWjB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvjKxq8WnYOT7ymrSNmN95NFMXhLxdumQz0QniRURVQ1P2sOwxOw9mlFnMsdGwsTYUJ9TwwBvA82UAaHEp/mMlHVc0oIKBzMWXj3qK3paRpcooh9hVSGlnqGep+/mzpP9SgPeJRXUgewnnXYsdPkV3k+EFLP/ZwGKOu3lTf4eTNm+TfnW4jHQYg2DpXHXtfV/H2mlDl/p/oUSoUnD3rWrF8IDPTSpy/30KtiY9ijy4RhllbSxM5Y230rpvlty1qqlNI/g34thL15nFaU/aIWQ/KwiCqthldd3m92S9gQ+iY4YtJkxAFsVAWT8gF32pmCKeH5IMmihZqlno6pUG0pIHwIDAQABo4HlMIHiMB0GA1UdDgQWBBQxpPv3f9MSv1y+BoR07lNRWi78ODCBsgYDVR0jBIGqMIGngBQxpPv3f9MSv1y+BoR07lNRWi78OKGBg6SBgDB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtggkAtpCaO5i7Gm4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAZphue2C31+5SpoZiIQav3xtwfIt+PRtK0ZN0w2ZxR1LmbWS9jX4elvwE5B5Yyu4UmjyvXGA6j9s5PGedXMabpi9GWsaEfHRKsF/TrH0KauhPrAWTuc1UxMFM5zPc6LeWJ8ofaVIgg4S4UFnf/fnkc/BtMMDCIyb62HkRmV+FqOOD+LlkcT701VKty68ubCg9xKaLg7L4zZBPYJrt0iLY2LWKh4ABinxfA1DFEVw9PVIEQKopwkO1A10rrKbfZqALQg5egVQypfVJ7E0Nkq5VeT3d3u3ybnZw/ZprQR0uPm+Ap492itLMMUX3iyJkxteAfT+03ztKWEsmGMbZpzG7VA==</oasis:BinarySecurityToken><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference URI="#_779bc0e70903ff79e62739956a11c7e3584a9012"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>8yHW2c0jdon+cADkxk47/gLo0ps=</DigestValue></Reference><Reference URI="#_747c942c134dd275275707f2cf63e8de7881d367"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>eRsb4CWXD17hl5exQvaZYDnOQOM=</DigestValue></Reference><Reference URI="#_2dc10b4daca971ef4ddb482338ebd7ba30112e2a"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>1aznRVYGR81veFFG2lNU9WjUhDs=</DigestValue></Reference><Reference URI="#_1f546393fdadf04fd9afcf172658c78cfd1b735d"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>KXKU6ZFziN415Hd2K6WevzUihYs=</DigestValue></Reference><Reference URI="#_724554b8920321ee32020dac076be1f58d92d3c7"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>YrKqrE99N7hNGYEvrhifL/LaxKQ=</DigestValue></Reference><Reference URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>VevrJZBe3aVif18GuHIrSZz5my8=</DigestValue></Reference></SignedInfo><SignatureValue>NYETWOxr2IdWOyV+b1XjRU1Koaa0OYDbz0MqErcqjEgLt3rgK2YyZpg2yMBB++YmlwhS2Gm/Iqnyv6U909hvF4Hg+9/kw/FiwqhavcW+/N9HZKo0vGww/rU4qcKrNdU/lETQhxfk5DpKAoAUWV6yGxnbP8GzTXWGtP4sfLlcFjfOkTnePEM7QLjJLk9l2YkvbmyaRClj3psYrh0Fo1G+LWZ7W8UpaPzoo8e+s2EkKDAbchWoQJp2vEIhLnRRWDMuweRpsURigjbIkJCKnawmZ8SG1nA68nYa9jTh6824XVepxbkvtvNzEFC6dmZAjwAWhADf1+7lpqUyml/wZyHWRw==</SignatureValue><KeyInfo><o:SecurityTokenReference><o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"/></o:SecurityTokenReference></KeyInfo></Signature></oasis:Security><wsa:Action wsu:Id="_779bc0e70903ff79e62739956a11c7e3584a9012">SomeAction</wsa:Action><wsa:To wsu:Id="_747c942c134dd275275707f2cf63e8de7881d367">https://strict.endpoint/path</wsa:To><wsa:ReplyTo wsu:Id="_2dc10b4daca971ef4ddb482338ebd7ba30112e2a"><wsa:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</wsa:Address></wsa:ReplyTo><wsa:MessageID wsu:Id="_1f546393fdadf04fd9afcf172658c78cfd1b735d">SRV-0f687bbd-62503e99-926a4d3c-5dde443c-dbf6d68f</wsa:MessageID></soap:Header><soap:Body wsu:Id="_724554b8920321ee32020dac076be1f58d92d3c7"><messageCode>code</messageCode><!-- Comments should be ignored during canonicalization --><message>message</message></soap:Body></soap:Envelope>

data/spec/fixtures/akami/wsse/verify_signature/valid.xml

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsa="http://www.w3.org/2005/08/addressing"><soap:Header><oasis:Security xmlns:oasis="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
+     <oasis:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" wsu:Id="uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1">MIIEZTCCA02gAwIBAgIJALaQmjuYuxpuMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNVBAYTAldXMRIwEAYDVQQIEwlXb3JsZHdpZGUxETAPBgNVBAcTCFhNTCBjaXR5MREwDwYDVQQKEwhTYXZvbi5yYjEhMB8GA1UECxMYQWthbWkgdGVzdGluZyBkZXBhcnRtZW50MRIwEAYDVQQDEwlBa2FtaSBHZW0wHhcNMTQwNjEwMDg1NjEzWhcNMjQwNjA3MDg1NjEzWjB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvjKxq8WnYOT7ymrSNmN95NFMXhLxdumQz0QniRURVQ1P2sOwxOw9mlFnMsdGwsTYUJ9TwwBvA82UAaHEp/mMlHVc0oIKBzMWXj3qK3paRpcooh9hVSGlnqGep+/mzpP9SgPeJRXUgewnnXYsdPkV3k+EFLP/ZwGKOu3lTf4eTNm+TfnW4jHQYg2DpXHXtfV/H2mlDl/p/oUSoUnD3rWrF8IDPTSpy/30KtiY9ijy4RhllbSxM5Y230rpvlty1qqlNI/g34thL15nFaU/aIWQ/KwiCqthldd3m92S9gQ+iY4YtJkxAFsVAWT8gF32pmCKeH5IMmihZqlno6pUG0pIHwIDAQABo4HlMIHiMB0GA1UdDgQWBBQxpPv3f9MSv1y+BoR07lNRWi78ODCBsgYDVR0jBIGqMIGngBQxpPv3f9MSv1y+BoR07lNRWi78OKGBg6SBgDB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtggkAtpCaO5i7Gm4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAZphue2C31+5SpoZiIQav3xtwfIt+PRtK0ZN0w2ZxR1LmbWS9jX4elvwE5B5Yyu4UmjyvXGA6j9s5PGedXMabpi9GWsaEfHRKsF/TrH0KauhPrAWTuc1UxMFM5zPc6LeWJ8ofaVIgg4S4UFnf/fnkc/BtMMDCIyb62HkRmV+FqOOD+LlkcT701VKty68ubCg9xKaLg7L4zZBPYJrt0iLY2LWKh4ABinxfA1DFEVw9PVIEQKopwkO1A10rrKbfZqALQg5egVQypfVJ7E0Nkq5VeT3d3u3ybnZw/ZprQR0uPm+Ap492itLMMUX3iyJkxteAfT+03ztKWEsmGMbZpzG7VA==</oasis:BinarySecurityToken><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference URI="#_779bc0e70903ff79e62739956a11c7e3584a9012"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>8yHW2c0jdon+cADkxk47/gLo0ps=</DigestValue></Reference><Reference URI="#_747c942c134dd275275707f2cf63e8de7881d367"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>eRsb4CWXD17hl5exQvaZYDnOQOM=</DigestValue></Reference><Reference URI="#_2dc10b4daca971ef4ddb482338ebd7ba30112e2a"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>1aznRVYGR81veFFG2lNU9WjUhDs=</DigestValue></Reference><Reference URI="#_1f546393fdadf04fd9afcf172658c78cfd1b735d"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>KXKU6ZFziN415Hd2K6WevzUihYs=</DigestValue></Reference><Reference URI="#_724554b8920321ee32020dac076be1f58d92d3c7"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>YrKqrE99N7hNGYEvrhifL/LaxKQ=</DigestValue></Reference><Reference URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>VevrJZBe3aVif18GuHIrSZz5my8=</DigestValue></Reference></SignedInfo><SignatureValue>NEJTWOxr2IdWOyV+b1XjRU1Koaa0OYDbz0MqErcqjEgLt3rgK2YyZpg2yMBB++YmlwhS2Gm/Iqnyv6U909hvF4Hg+9/kw/FiwqhavcW+/N9HZKo0vGww/rU4qcKrNdU/lETQhxfk5DpKAoAUWV6yGxnbP8GzTXWGtP4sfLlcFjfOkTnePEM7QLjJLk9l2YkvbmyaRClj3psYrh0Fo1G+LWZ7W8UpaPzoo8e+s2EkKDAbchWoQJp2vEIhLnRRWDMuweRpsURigjbIkJCKnawmZ8SG1nA68nYa9jTh6824XVepxbkvtvNzEFC6dmZAjwAWhADf1+7lpqUyml/wZyHWRw==</SignatureValue><KeyInfo><o:SecurityTokenReference><o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"/></o:SecurityTokenReference></KeyInfo></Signature></oasis:Security><wsa:Action wsu:Id="_779bc0e70903ff79e62739956a11c7e3584a9012">SomeAction</wsa:Action><wsa:To wsu:Id="_747c942c134dd275275707f2cf63e8de7881d367">https://strict.endpoint/path</wsa:To><wsa:ReplyTo wsu:Id="_2dc10b4daca971ef4ddb482338ebd7ba30112e2a"><wsa:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</wsa:Address></wsa:ReplyTo><wsa:MessageID wsu:Id="_1f546393fdadf04fd9afcf172658c78cfd1b735d">SRV-0f687bbd-62503e99-926a4d3c-5dde443c-dbf6d68f</wsa:MessageID></soap:Header><soap:Body wsu:Id="_724554b8920321ee32020dac076be1f58d92d3c7"><messageCode>code</messageCode><!-- Comments should be ignored during canonicalization --><message>message</message></soap:Body></soap:Envelope>

data/spec/fixtures/akami/wsse/verify_signature/valid_namespaces.xml

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<bzzz:Envelope xmlns:bzzz="http://www.w3.org/2003/05/soap-envelope" xmlns:argh="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:blam="http://www.w3.org/2005/08/addressing"><bzzz:Header><pfff:Security xmlns:pfff="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
+     <pfff:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" argh:Id="uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1">MIIEZTCCA02gAwIBAgIJALaQmjuYuxpuMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNVBAYTAldXMRIwEAYDVQQIEwlXb3JsZHdpZGUxETAPBgNVBAcTCFhNTCBjaXR5MREwDwYDVQQKEwhTYXZvbi5yYjEhMB8GA1UECxMYQWthbWkgdGVzdGluZyBkZXBhcnRtZW50MRIwEAYDVQQDEwlBa2FtaSBHZW0wHhcNMTQwNjEwMDg1NjEzWhcNMjQwNjA3MDg1NjEzWjB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvjKxq8WnYOT7ymrSNmN95NFMXhLxdumQz0QniRURVQ1P2sOwxOw9mlFnMsdGwsTYUJ9TwwBvA82UAaHEp/mMlHVc0oIKBzMWXj3qK3paRpcooh9hVSGlnqGep+/mzpP9SgPeJRXUgewnnXYsdPkV3k+EFLP/ZwGKOu3lTf4eTNm+TfnW4jHQYg2DpXHXtfV/H2mlDl/p/oUSoUnD3rWrF8IDPTSpy/30KtiY9ijy4RhllbSxM5Y230rpvlty1qqlNI/g34thL15nFaU/aIWQ/KwiCqthldd3m92S9gQ+iY4YtJkxAFsVAWT8gF32pmCKeH5IMmihZqlno6pUG0pIHwIDAQABo4HlMIHiMB0GA1UdDgQWBBQxpPv3f9MSv1y+BoR07lNRWi78ODCBsgYDVR0jBIGqMIGngBQxpPv3f9MSv1y+BoR07lNRWi78OKGBg6SBgDB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtggkAtpCaO5i7Gm4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAZphue2C31+5SpoZiIQav3xtwfIt+PRtK0ZN0w2ZxR1LmbWS9jX4elvwE5B5Yyu4UmjyvXGA6j9s5PGedXMabpi9GWsaEfHRKsF/TrH0KauhPrAWTuc1UxMFM5zPc6LeWJ8ofaVIgg4S4UFnf/fnkc/BtMMDCIyb62HkRmV+FqOOD+LlkcT701VKty68ubCg9xKaLg7L4zZBPYJrt0iLY2LWKh4ABinxfA1DFEVw9PVIEQKopwkO1A10rrKbfZqALQg5egVQypfVJ7E0Nkq5VeT3d3u3ybnZw/ZprQR0uPm+Ap492itLMMUX3iyJkxteAfT+03ztKWEsmGMbZpzG7VA==</pfff:BinarySecurityToken><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference URI="#_32e8273d0122bb59bb8369e2cd2c3bc4d9f0fd94"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>/qQ8ucFN9UNj/PeYzpqdBaqfbDE=</DigestValue></Reference><Reference URI="#_ae66d576c72c371b63c5cb64f506a7cfbb6523b1"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>zwhy5nIdDYQw+PAtp5xJF37AwKY=</DigestValue></Reference><Reference URI="#_1f38c96249928ef39807ddc3ae7810691e080b3d"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>0ka0+fILJ/K0l+QquJ7oGI5BZ/g=</DigestValue></Reference><Reference URI="#_10cdeece6969bac5d9e6ac8d7d40df9c604781a4"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>JukA7+7mBcqtplGntFoHJ+Fk+jQ=</DigestValue></Reference><Reference URI="#_35c546657feb5dc1cf4474488f7b5d5a991f0604"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>fCQv9hvbeyNBGBrqbJ/A166hSB8=</DigestValue></Reference><Reference URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>5uVUuwPoZPnXoWjo5czBnYIywcA=</DigestValue></Reference></SignedInfo><SignatureValue>BXSWTruDmrWJYwmqqkMDUquD+Q39mOLJ2d2XZ31o/jU0jdaWg4fGwTnAYsIELbDdLBbFj5R9gsMSzw+nprglOtuMyheYuO4EZbwJijeR2n5hoaYAqQdjA4n8tFXiKo+puiKvAsWUDmVqVqSLOUtKCTCxL+NjJavgUjVKwmK3dRgMKcH4RZHTM/qgMT42N7DvSOLbuBbW/hblz74pcc86vDMrMOLrC3z7F18vOFTUpoScZuFf14wes6G+FoS7un7EvLV4Yvjq15VUh7Tczv2qzzkWfUY0So+SujGo+JivULYjJ9UJB+sL6SOrazgYNLXyz1eHHcfraUKHKJVOp4naqg==</SignatureValue><KeyInfo><o:SecurityTokenReference><o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"/></o:SecurityTokenReference></KeyInfo></Signature></pfff:Security><blam:Action argh:Id="_32e8273d0122bb59bb8369e2cd2c3bc4d9f0fd94">SomeAction</blam:Action><blam:To argh:Id="_ae66d576c72c371b63c5cb64f506a7cfbb6523b1">https://strict.endpoint/path</blam:To><blam:ReplyTo argh:Id="_1f38c96249928ef39807ddc3ae7810691e080b3d"><blam:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</blam:Address></blam:ReplyTo><blam:MessageID argh:Id="_10cdeece6969bac5d9e6ac8d7d40df9c604781a4">SRV-0f687bbd-62503e99-926a4d3c-5dde443c-dbf6d68f</blam:MessageID></bzzz:Header><bzzz:Body argh:Id="_35c546657feb5dc1cf4474488f7b5d5a991f0604"><ws:messageCode>code</ws:messageCode><!-- Comments should be ignored during canonicalization --><ws:message>message</ws:message></bzzz:Body></bzzz:Envelope>

data/spec/fixtures/akami/wsse/verify_signature/valid_sha1_gost.xml

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsa="http://www.w3.org/2005/08/addressing"><soap:Header><oasis:Security xmlns:oasis="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
+     <oasis:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" wsu:Id="uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1">MIIEZTCCA02gAwIBAgIJALaQmjuYuxpuMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNVBAYTAldXMRIwEAYDVQQIEwlXb3JsZHdpZGUxETAPBgNVBAcTCFhNTCBjaXR5MREwDwYDVQQKEwhTYXZvbi5yYjEhMB8GA1UECxMYQWthbWkgdGVzdGluZyBkZXBhcnRtZW50MRIwEAYDVQQDEwlBa2FtaSBHZW0wHhcNMTQwNjEwMDg1NjEzWhcNMjQwNjA3MDg1NjEzWjB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvjKxq8WnYOT7ymrSNmN95NFMXhLxdumQz0QniRURVQ1P2sOwxOw9mlFnMsdGwsTYUJ9TwwBvA82UAaHEp/mMlHVc0oIKBzMWXj3qK3paRpcooh9hVSGlnqGep+/mzpP9SgPeJRXUgewnnXYsdPkV3k+EFLP/ZwGKOu3lTf4eTNm+TfnW4jHQYg2DpXHXtfV/H2mlDl/p/oUSoUnD3rWrF8IDPTSpy/30KtiY9ijy4RhllbSxM5Y230rpvlty1qqlNI/g34thL15nFaU/aIWQ/KwiCqthldd3m92S9gQ+iY4YtJkxAFsVAWT8gF32pmCKeH5IMmihZqlno6pUG0pIHwIDAQABo4HlMIHiMB0GA1UdDgQWBBQxpPv3f9MSv1y+BoR07lNRWi78ODCBsgYDVR0jBIGqMIGngBQxpPv3f9MSv1y+BoR07lNRWi78OKGBg6SBgDB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtggkAtpCaO5i7Gm4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAZphue2C31+5SpoZiIQav3xtwfIt+PRtK0ZN0w2ZxR1LmbWS9jX4elvwE5B5Yyu4UmjyvXGA6j9s5PGedXMabpi9GWsaEfHRKsF/TrH0KauhPrAWTuc1UxMFM5zPc6LeWJ8ofaVIgg4S4UFnf/fnkc/BtMMDCIyb62HkRmV+FqOOD+LlkcT701VKty68ubCg9xKaLg7L4zZBPYJrt0iLY2LWKh4ABinxfA1DFEVw9PVIEQKopwkO1A10rrKbfZqALQg5egVQypfVJ7E0Nkq5VeT3d3u3ybnZw/ZprQR0uPm+Ap492itLMMUX3iyJkxteAfT+03ztKWEsmGMbZpzG7VA==</oasis:BinarySecurityToken><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference URI="#_779bc0e70903ff79e62739956a11c7e3584a9012"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#gostr3411"/><DigestValue>Ua/7KXhpaT9/zNLttYl7kWc6zxrssuvI9FopvNyl/hs=</DigestValue></Reference><Reference URI="#_747c942c134dd275275707f2cf63e8de7881d367"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#gostr3411"/><DigestValue>0tk2wqp+ybAP16lhi/7Rrvl3B7+/sOLDmX1jev5ZMdM=</DigestValue></Reference><Reference URI="#_2dc10b4daca971ef4ddb482338ebd7ba30112e2a"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#gostr3411"/><DigestValue>WI8rWnflY+PhigG807yZijyET1K8iBLMdX4KOgWoEjU=</DigestValue></Reference><Reference URI="#_1f546393fdadf04fd9afcf172658c78cfd1b735d"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#gostr3411"/><DigestValue>rvdJaIekkEvD7QImJX7nMevmVQN5B3xW5ZExpyoMdN0=</DigestValue></Reference><Reference URI="#_724554b8920321ee32020dac076be1f58d92d3c7"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#gostr3411"/><DigestValue>3OkHjVwY6I/pj8hKhOzKfPOdBjAFcjCzM6IsRJpbQEU=</DigestValue></Reference><Reference URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#gostr3411"/><DigestValue>zTmupwEL0lMuPyQlc9qx9+R+SOuIA8zwAqOA0qnXI1g=</DigestValue></Reference></SignedInfo><SignatureValue>TFqPZHrnQuN8QdquaMSG4uKkijaXmsNa1bikQ5z5JTrfGsOHaAZc/+a/jIo5Gd+m7eF1O22rtk8lm1MPmDaRXBc71uQ5yJ+qefCShfYua/gb9y24Cowoh6ONf+WymVJ1fi/H2DjmZ1T1lRq3KoqTlv7tk34t1Ta2hjFv0buBO039woXfNflbFNsfvzlTRgMeZiDC5tMGe7tmlAdll3eD/R1lGCMgRHY6KraSeksWwNVPewDyqc26nv7/R6a4VJ5E7UvDAgSi/pvy37QROiFSt59ONSM1PPaGE18U0A6Q6kH4o6JM6+bqa5jKCThLqf3yyDRKha5Co+A7s/OerJuA0A==</SignatureValue><KeyInfo><o:SecurityTokenReference><o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"/></o:SecurityTokenReference></KeyInfo></Signature></oasis:Security><wsa:Action wsu:Id="_779bc0e70903ff79e62739956a11c7e3584a9012">SomeAction</wsa:Action><wsa:To wsu:Id="_747c942c134dd275275707f2cf63e8de7881d367">https://strict.endpoint/path</wsa:To><wsa:ReplyTo wsu:Id="_2dc10b4daca971ef4ddb482338ebd7ba30112e2a"><wsa:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</wsa:Address></wsa:ReplyTo><wsa:MessageID wsu:Id="_1f546393fdadf04fd9afcf172658c78cfd1b735d">SRV-0f687bbd-62503e99-926a4d3c-5dde443c-dbf6d68f</wsa:MessageID></soap:Header><soap:Body wsu:Id="_724554b8920321ee32020dac076be1f58d92d3c7"><messageCode>code</messageCode><!-- Comments should be ignored during canonicalization --><message>message</message></soap:Body></soap:Envelope>

data/spec/fixtures/akami/wsse/verify_signature/valid_sha256.xml

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsa="http://www.w3.org/2005/08/addressing"><soap:Header><oasis:Security xmlns:oasis="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
+     <oasis:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" wsu:Id="uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1">MIIEZTCCA02gAwIBAgIJALaQmjuYuxpuMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNVBAYTAldXMRIwEAYDVQQIEwlXb3JsZHdpZGUxETAPBgNVBAcTCFhNTCBjaXR5MREwDwYDVQQKEwhTYXZvbi5yYjEhMB8GA1UECxMYQWthbWkgdGVzdGluZyBkZXBhcnRtZW50MRIwEAYDVQQDEwlBa2FtaSBHZW0wHhcNMTQwNjEwMDg1NjEzWhcNMjQwNjA3MDg1NjEzWjB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvjKxq8WnYOT7ymrSNmN95NFMXhLxdumQz0QniRURVQ1P2sOwxOw9mlFnMsdGwsTYUJ9TwwBvA82UAaHEp/mMlHVc0oIKBzMWXj3qK3paRpcooh9hVSGlnqGep+/mzpP9SgPeJRXUgewnnXYsdPkV3k+EFLP/ZwGKOu3lTf4eTNm+TfnW4jHQYg2DpXHXtfV/H2mlDl/p/oUSoUnD3rWrF8IDPTSpy/30KtiY9ijy4RhllbSxM5Y230rpvlty1qqlNI/g34thL15nFaU/aIWQ/KwiCqthldd3m92S9gQ+iY4YtJkxAFsVAWT8gF32pmCKeH5IMmihZqlno6pUG0pIHwIDAQABo4HlMIHiMB0GA1UdDgQWBBQxpPv3f9MSv1y+BoR07lNRWi78ODCBsgYDVR0jBIGqMIGngBQxpPv3f9MSv1y+BoR07lNRWi78OKGBg6SBgDB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtggkAtpCaO5i7Gm4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAZphue2C31+5SpoZiIQav3xtwfIt+PRtK0ZN0w2ZxR1LmbWS9jX4elvwE5B5Yyu4UmjyvXGA6j9s5PGedXMabpi9GWsaEfHRKsF/TrH0KauhPrAWTuc1UxMFM5zPc6LeWJ8ofaVIgg4S4UFnf/fnkc/BtMMDCIyb62HkRmV+FqOOD+LlkcT701VKty68ubCg9xKaLg7L4zZBPYJrt0iLY2LWKh4ABinxfA1DFEVw9PVIEQKopwkO1A10rrKbfZqALQg5egVQypfVJ7E0Nkq5VeT3d3u3ybnZw/ZprQR0uPm+Ap492itLMMUX3iyJkxteAfT+03ztKWEsmGMbZpzG7VA==</oasis:BinarySecurityToken><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><Reference URI="#_779bc0e70903ff79e62739956a11c7e3584a9012"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><DigestValue>5kMYzrEfrLHK1wquUdWVF9ZxWLWh1p3AUi55JEcEpwA=</DigestValue></Reference><Reference URI="#_747c942c134dd275275707f2cf63e8de7881d367"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><DigestValue>kXFE39LW1LZapv8qvvwDI1aAYGvpIyJJt5tfwFHpWLM=</DigestValue></Reference><Reference URI="#_2dc10b4daca971ef4ddb482338ebd7ba30112e2a"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><DigestValue>bd5OjPsMDJpwQV1Y3F4fFd3aAdV73cBYkpqu/R/ywPs=</DigestValue></Reference><Reference URI="#_1f546393fdadf04fd9afcf172658c78cfd1b735d"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><DigestValue>EsMzDJn7KGXHPwFqTGiaa8E17Wp67tFomVdODtNmKQ4=</DigestValue></Reference><Reference URI="#_724554b8920321ee32020dac076be1f58d92d3c7"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><DigestValue>5gEEiIwYC1zy99DExX+YRXD1Sv8+xVgGPeyDQjMPddU=</DigestValue></Reference><Reference URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><DigestValue>U+JTJP1qMZnzGV7bhlQ7y4D/aeYO2ajghskz4mjFNwI=</DigestValue></Reference></SignedInfo><SignatureValue>Fh+YPbR+D1DQcEvdlYn2krKGI445VKRW75mNtIm/n10k0QoAwL+BQ49cnc81UTzZBB1bs22Y6wDGFYwLXMhGa3YioGoyo0IqnCacIDuaNn1OjUVWGDheEl8wTvKIHPDMEhkb6XFLXokLjv/IXdoNq7g7sbhoPd8Qcx8CKYU3aDq1oyiCrtPbowDf4YEBsKxMkZbR4jXzjUmhNI3A82bzTweQLrkxgB/DmtyPHLXF/jitdzKqpKM/K7+4BVWuuKcOFIKYcN3gn4lTXPCVXfCiwhVhIogW+mmC5mjmglKP80hSUBn5csKLbFB8pHtBDcfO9PPV1NoaUtgOwdWGEKqI3w==</SignatureValue><KeyInfo><o:SecurityTokenReference><o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"/></o:SecurityTokenReference></KeyInfo></Signature></oasis:Security><wsa:Action wsu:Id="_779bc0e70903ff79e62739956a11c7e3584a9012">SomeAction</wsa:Action><wsa:To wsu:Id="_747c942c134dd275275707f2cf63e8de7881d367">https://strict.endpoint/path</wsa:To><wsa:ReplyTo wsu:Id="_2dc10b4daca971ef4ddb482338ebd7ba30112e2a"><wsa:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</wsa:Address></wsa:ReplyTo><wsa:MessageID wsu:Id="_1f546393fdadf04fd9afcf172658c78cfd1b735d">SRV-0f687bbd-62503e99-926a4d3c-5dde443c-dbf6d68f</wsa:MessageID></soap:Header><soap:Body wsu:Id="_724554b8920321ee32020dac076be1f58d92d3c7"><messageCode>code</messageCode><!-- Comments should be ignored during canonicalization --><message>message</message></soap:Body></soap:Envelope>

data/spec/fixtures/akami/wsse/verify_signature/valid_whitespaces.xml

@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsa="http://www.w3.org/2005/08/addressing">
+	<soap:Header>
+		<oasis:Security xmlns:oasis="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
+			<oasis:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" wsu:Id="uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1">MIIEZTCCA02gAwIBAgIJALaQmjuYuxpuMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNVBAYTAldXMRIwEAYDVQQIEwlXb3JsZHdpZGUxETAPBgNVBAcTCFhNTCBjaXR5MREwDwYDVQQKEwhTYXZvbi5yYjEhMB8GA1UECxMYQWthbWkgdGVzdGluZyBkZXBhcnRtZW50MRIwEAYDVQQDEwlBa2FtaSBHZW0wHhcNMTQwNjEwMDg1NjEzWhcNMjQwNjA3MDg1NjEzWjB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvjKxq8WnYOT7ymrSNmN95NFMXhLxdumQz0QniRURVQ1P2sOwxOw9mlFnMsdGwsTYUJ9TwwBvA82UAaHEp/mMlHVc0oIKBzMWXj3qK3paRpcooh9hVSGlnqGep+/mzpP9SgPeJRXUgewnnXYsdPkV3k+EFLP/ZwGKOu3lTf4eTNm+TfnW4jHQYg2DpXHXtfV/H2mlDl/p/oUSoUnD3rWrF8IDPTSpy/30KtiY9ijy4RhllbSxM5Y230rpvlty1qqlNI/g34thL15nFaU/aIWQ/KwiCqthldd3m92S9gQ+iY4YtJkxAFsVAWT8gF32pmCKeH5IMmihZqlno6pUG0pIHwIDAQABo4HlMIHiMB0GA1UdDgQWBBQxpPv3f9MSv1y+BoR07lNRWi78ODCBsgYDVR0jBIGqMIGngBQxpPv3f9MSv1y+BoR07lNRWi78OKGBg6SBgDB+MQswCQYDVQQGEwJXVzESMBAGA1UECBMJV29ybGR3aWRlMREwDwYDVQQHEwhYTUwgY2l0eTERMA8GA1UEChMIU2F2b24ucmIxITAfBgNVBAsTGEFrYW1pIHRlc3RpbmcgZGVwYXJ0bWVudDESMBAGA1UEAxMJQWthbWkgR2VtggkAtpCaO5i7Gm4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAZphue2C31+5SpoZiIQav3xtwfIt+PRtK0ZN0w2ZxR1LmbWS9jX4elvwE5B5Yyu4UmjyvXGA6j9s5PGedXMabpi9GWsaEfHRKsF/TrH0KauhPrAWTuc1UxMFM5zPc6LeWJ8ofaVIgg4S4UFnf/fnkc/BtMMDCIyb62HkRmV+FqOOD+LlkcT701VKty68ubCg9xKaLg7L4zZBPYJrt0iLY2LWKh4ABinxfA1DFEVw9PVIEQKopwkO1A10rrKbfZqALQg5egVQypfVJ7E0Nkq5VeT3d3u3ybnZw/ZprQR0uPm+Ap492itLMMUX3iyJkxteAfT+03ztKWEsmGMbZpzG7VA==</oasis:BinarySecurityToken>
+			<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
+				<SignedInfo>
+					<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+					<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+					<Reference URI="#_779bc0e70903ff79e62739956a11c7e3584a9012">
+						<Transforms>
+							<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+						</Transforms>
+						<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+						<DigestValue>8yHW2c0jdon+cADkxk47/gLo0ps=</DigestValue>
+					</Reference>
+					<Reference URI="#_747c942c134dd275275707f2cf63e8de7881d367">
+						<Transforms>
+							<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+						</Transforms>
+						<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+						<DigestValue>eRsb4CWXD17hl5exQvaZYDnOQOM=</DigestValue>
+					</Reference>
+					<Reference URI="#_2dc10b4daca971ef4ddb482338ebd7ba30112e2a">
+						<Transforms>
+							<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+						</Transforms>
+						<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+						<DigestValue>1aznRVYGR81veFFG2lNU9WjUhDs=</DigestValue>
+					</Reference>
+					<Reference URI="#_1f546393fdadf04fd9afcf172658c78cfd1b735d">
+						<Transforms>
+							<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+						</Transforms>
+						<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+						<DigestValue>KXKU6ZFziN415Hd2K6WevzUihYs=</DigestValue>
+					</Reference>
+					<Reference URI="#_724554b8920321ee32020dac076be1f58d92d3c7">
+						<Transforms>
+							<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+						</Transforms>
+						<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+						<DigestValue>YrKqrE99N7hNGYEvrhifL/LaxKQ=</DigestValue>
+					</Reference>
+					<Reference URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1">
+						<Transforms>
+							<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+						</Transforms>
+						<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+						<DigestValue>VevrJZBe3aVif18GuHIrSZz5my8=</DigestValue>
+					</Reference>
+				</SignedInfo>
+				<SignatureValue>
+					NEJTWOxr2IdWOyV+b1XjRU1Koaa0OYDbz0MqErcqjEgLt3rgK2YyZpg2yMBB++YmlwhS2Gm/Iqnyv6U909hvF4Hg+9/kw/FiwqhavcW+/N9HZKo0vGww/rU4qcKrNdU/lETQhxfk5DpKAoAUWV6yGxnbP8GzTXWGtP4sfLlcFjfOkTnePEM7QLjJLk9l2YkvbmyaRClj3psYrh0Fo1G+LWZ7W8UpaPzoo8e+s2EkKDAbchWoQJp2vEIhLnRRWDMuweRpsURigjbIkJCKnawmZ8SG1nA68nYa9jTh6824XVepxbkvtvNzEFC6dmZAjwAWhADf1+7lpqUyml/wZyHWRw==
+				</SignatureValue>
+				<KeyInfo>
+					<o:SecurityTokenReference>
+						<o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-639b8970-7644-4f9e-9bc4-9c2e367808fc-1"/>
+					</o:SecurityTokenReference>
+				</KeyInfo>
+			</Signature>
+		</oasis:Security>
+		<wsa:Action wsu:Id="_779bc0e70903ff79e62739956a11c7e3584a9012">SomeAction</wsa:Action>
+		<wsa:To wsu:Id="_747c942c134dd275275707f2cf63e8de7881d367">https://strict.endpoint/path</wsa:To>
+		<wsa:ReplyTo wsu:Id="_2dc10b4daca971ef4ddb482338ebd7ba30112e2a">
+			<wsa:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</wsa:Address>
+		</wsa:ReplyTo>
+		<wsa:MessageID wsu:Id="_1f546393fdadf04fd9afcf172658c78cfd1b735d">SRV-0f687bbd-62503e99-926a4d3c-5dde443c-dbf6d68f</wsa:MessageID>
+	</soap:Header>
+	<soap:Body wsu:Id="_724554b8920321ee32020dac076be1f58d92d3c7">
+		<messageCode>code</messageCode>
+		<!-- Comments should be ignored during canonicalization -->
+		<message>message</message>
+	</soap:Body>
+</soap:Envelope>

data/spec/spec_helper.rb

@@ -1,2 +1,6 @@
 require "bundler"
 Bundler.require :default, :development
+
+def fixture(local_path)
+  File.read(File.join(File.dirname(__FILE__), 'fixtures', local_path))
+end

metadata

@@ -1,97 +1,97 @@
 --- !ruby/object:Gem::Specification
 name: akami
 version: !ruby/object:Gem::Version
-  version: 1.2.2
+  version: 1.3.0
 platform: ruby
 authors:
 - Daniel Harrington
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-04-18 00:00:00.000000000 Z
+date: 2015-04-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: gyoku
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 0.4.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 0.4.0
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '10.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '10.0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.12'
+        version: '2.14'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.12'
+        version: '2.14'
 - !ruby/object:Gem::Dependency
   name: mocha
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '0.13'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '0.13'
 - !ruby/object:Gem::Dependency
   name: timecop
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '0.5'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '0.5'
 description: Building Web Service Security
@@ -101,9 +101,9 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- .gitignore
-- .rspec
-- .travis.yml
+- ".gitignore"
+- ".rspec"
+- ".travis.yml"
 - CHANGELOG.md
 - Gemfile
 - LICENSE
@@ -119,7 +119,19 @@ files:
 - lib/akami/wsse/signature.rb
 - lib/akami/wsse/verify_signature.rb
 - lib/akami/xpath_helper.rb
+- spec/akami/wsse/signature_spec.rb
+- spec/akami/wsse/verify_signature_spec.rb
 - spec/akami/wsse_spec.rb
+- spec/fixtures/akami/wsse/signature/cert.pem
+- spec/fixtures/akami/wsse/signature/unsigned.xml
+- spec/fixtures/akami/wsse/verify_signature/invalid_digest_changed.xml
+- spec/fixtures/akami/wsse/verify_signature/invalid_digested_changed.xml
+- spec/fixtures/akami/wsse/verify_signature/invalid_signature_changed.xml
+- spec/fixtures/akami/wsse/verify_signature/valid.xml
+- spec/fixtures/akami/wsse/verify_signature/valid_namespaces.xml
+- spec/fixtures/akami/wsse/verify_signature/valid_sha1_gost.xml
+- spec/fixtures/akami/wsse/verify_signature/valid_sha256.xml
+- spec/fixtures/akami/wsse/verify_signature/valid_whitespaces.xml
 - spec/spec_helper.rb
 homepage: https://github.com/savonrb/akami
 licenses:
@@ -131,20 +143,32 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.9.2
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: akami
-rubygems_version: 2.1.11
+rubygems_version: 2.2.2
 signing_key: 
 specification_version: 4
 summary: Web Service Security
 test_files:
+- spec/akami/wsse/signature_spec.rb
+- spec/akami/wsse/verify_signature_spec.rb
 - spec/akami/wsse_spec.rb
+- spec/fixtures/akami/wsse/signature/cert.pem
+- spec/fixtures/akami/wsse/signature/unsigned.xml
+- spec/fixtures/akami/wsse/verify_signature/invalid_digest_changed.xml
+- spec/fixtures/akami/wsse/verify_signature/invalid_digested_changed.xml
+- spec/fixtures/akami/wsse/verify_signature/invalid_signature_changed.xml
+- spec/fixtures/akami/wsse/verify_signature/valid.xml
+- spec/fixtures/akami/wsse/verify_signature/valid_namespaces.xml
+- spec/fixtures/akami/wsse/verify_signature/valid_sha1_gost.xml
+- spec/fixtures/akami/wsse/verify_signature/valid_sha256.xml
+- spec/fixtures/akami/wsse/verify_signature/valid_whitespaces.xml
 - spec/spec_helper.rb