<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type"
content="text/html;charset=windows-1252">
<title></title>
</head>
<body>
Thanks for examples! I am forwarding to the list the compilation of your<br>
findings. It seems to me that Websphere does wrong thing here. If we
are <br>
talking about c14n then the xmlns="" must be rendered because of this:<br>
<br>
<i> Namespace Axis-</i> Consider a list <b><i>L</i></b> containing
only namespace nodes <br>
in the axis and in the node-set in lexicographic order
(ascending). To begin <br>
processing <b><i>L</i></b>, if the first node is not the
default namespace node (a node with <br>
no namespace URI and no local name), then generate a space
followed by <br>
<code>xmlns=""</code> <i>if and only</i> if the following
conditions are met: <br>
<ul>
<li>the element <b><i>E</i></b> that owns the axis is in the
node-set</li>
<li>The nearest ancestor element of <b><i>E</i></b> in the node-set
has a default namespace node in the node-set (default namespace
nodes always have non-empty values in XPath)</li>
</ul>
In our case, the nearest ancsetor of <in0> is <getGreeting>
and it has a default namespace<br>
node. Thus, xmlns="" must be rendered in <in0>.<br>
<br>
In exc c14n you have to render xmlns="" because it is visibly utilized
by <in0> node.<br>
Finally, from logical point of view, websphere c14n changes the
namespace for<br>
<in0> node from "" to <a class="moz-txt-link-rfc2396E" href="http://Sample8.wsdk.ibm.com">"http://Sample8.wsdk.ibm.com"</a> which does
not look right to me.<br>
<br>
I wonder what other guys on the list think about that.<br>
<br>
I am glad you found a relativly simple workaround :)<br>
<br>
Aleksey<br>
<br>
<br>
<br>
Venky Madireddi wrote:<br>
<pre wrap="">
Yes, I did find out the problem. The problem occurs in the case where you
have empty Namespaces. Websphere drops the Namespace attribute for C14n
while Libxml2 doesn't. So, as a fix I parse the document and get rid of all
the empty Namespaces before signing or verification. I know that this is a
kludge, but it worked for me.
given that the following node is what you are signing:
<getGreeting xmlns=<a class="moz-txt-link-rfc2396E"
href="http://Sample8.wsdk.ibm.com">"http://Sample8.wsdk.ibm.com"</a>>
<in0 xmlns="">venky</in0>
</getGreeting>
Notice the Namespace for <in0> is an empty string.
Here is what Websphere's c14n outputs:
<getGreeting xmlns=<a class="moz-txt-link-rfc2396E"
href="http://Sample8.wsdk.ibm.com">"http://Sample8.wsdk.ibm.com"</a>>
<in0>venky</in0>
</getGreeting>
While Libxml2 outputs:
<getGreeting xmlns=<a class="moz-txt-link-rfc2396E"
href="http://Sample8.wsdk.ibm.com">"http://Sample8.wsdk.ibm.com"</a>>
<in0 xmlns="">venky</in0>
</getGreeting>
</pre>
<br>
</body>
</html>