Is the Amazon SimpleDB WSDL for SOAP without WS-Security correct?

Question

The SimpleDB documentation includes this example request for a ListDomains method. Note that there are Signature, Timestamp, AWSAccessKeyId and Version subelements:

  <SOAP-ENV:Body>
    <ListDomainsRequest xmlns=" http://sdb.amazonaws.com/doc/2007-11-07"&gt;
      <Signature>SZf1CHmQnrZbsrC13hCZS061ywsEXAMPLE&lt;</Signature>
      <Timestamp>2009-02-16T17:39:51.000Z</Timestamp>
      <AWSAccessKeyId>1D9FVRAYCP1VJS767E02EXAMPLE</AWSAccessKeyId>
      <Version>2007-11-07</Version>
      <Action>ListDomains</Action>
    </ListDomainsRequest>
  </SOAP-ENV:Body>

The WSDL uses this definition for ListDomains:

<xs:element name="ListDomains">
 <xs:complexType>
  <xs:sequence>
   <xs:element name="MaxNumberOfDomains" type="xs:int" minOccurs="0"/>
   <xs:element name="NextToken" type="xs:string" minOccurs="0"/>
  </xs:sequence>
 </xs:complexType>
</xs:element>
...
<wsdl:operation name="ListDomains">
 <soap:operation soapAction="ListDomains"/>
 <wsdl:input>
  <soap:body use="literal"/>
     </wsdl:input>
     <wsdl:output>
      <soap:body use="literal"/>
     </wsdl:output>
    </wsdl:operation>

The Signature, Timestamp, AWSAccessKeyId and Version information is not in the ListDomains definition.

AWS customer support already has investigated this and says this is as designed:

"The WSDL will continue to cover only application-level elements, as it is a cleaner approach, fitting better with the long-term "SOAP with WS-Security" envelope/body model."

Is the example request correct? Importing the WSDL for example in Delphi does not generate code for the authorization elements.

Answer 1

Well, it would appear that the authorization elements are indeed not part of the WSDL which is a bit odd....

Even funnier - the Amazon docs talks about providing that information in the SOAP header - yet, their sample clearly puts it in the <SOAP-ENV:Body> element....

What happens if you manually add those additional elements either in Delphi code, or in the WSDL itself? Can you tweak it to be so that the SimpleDB service is happy with it?

Marc