Getting rid of the Expires node (xml) in the WS security header

Question

From the snippet below, how do i get rid of the (xml node) <wsu:Expires> tag? I want to either get rid of it or pass it in as a empty element. It is a read only property in objClient.RequestSoapContext.Security.Timestamp.Expires. Any help is appreciated.

<wsse:Security soap:mustUnderstand="1">
        <wsu:Timestamp wsu:Id="Timestamp-26d09d54-10ef-4141-aa2c-11c75ed8172b">
          <wsu:Created>2010-03-08T15:32:16Z</wsu:Created>
          <wsu:Expires>2010-03-08T15:37:16Z</wsu:Expires>
        </wsu:Timestamp>
        <wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-7c9b80ec-98e9-4e41-af2e-ad37070cbdd3">
          <wsse:Username>bubba</wsse:Username>
          <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest"&gt;dsfdfsdfsfs+-dasdf=&lt;/wsse:Password&gt;
          <wsse:Nonce>QQ3C4HUfO2CyGx7HrjzMzg==</wsse:Nonce>
          <wsu:Created>2010-03-08T15:32:16Z</wsu:Created>
        </wsse:UsernameToken>
      </wsse:Security>

I have found and worked on implementing: http://blogs.msdn.com/dhrubach/archive/2008/06/16/modifying-the-security-header-generated-by-wse-runtime.aspx - it does not work for me

Note: Still working on using the method described in the link I have posted above.

Edit 2: I am now able to generate most of the header manually using assertions. How do i hash the password when inserting it into the security header XML

Answer 1

Well, I can definitely help with the password generation part of your question. :-)

According to the spec (line 113), it is:

Base64(SHA1(nonce + created + password))

The documentation also says that the nonce should be converted back to its binary form, and the created timestamp should be used as it appears (lines 129–131).

So suppose your password is "supercalifragilisticexpialidocious". Then the value you hash (given the sample document posted in the question) would be UnBase64("QQ3C4HUfO2CyGx7HrjzMzg==") + "2010-03-08T15:32:16Zsupercalifragilisticexpialidocious".