3.1.4.2.2.1 Key Exchange Token Request Processing

  • Article

A RequestSecurityToken message of wst:RequestType of "http://docs.oasis-open.org/ws-sx/ws-trust/200512/KET" is used to retrieve the Key Exchange Token.

For this type of message, a server has additional syntax constraints on the wst:RequestSecurityTokenMsg message.

If the <wst:RequestKET> element is absent, the server MUST return a SOAP fault.

The server requests the Key Exchange Token from the issuer. If the issuer responds with an error, the server MUST respond with a SOAP fault. Otherwise, the server uses the Issuer response to generate a wst:RequestSecurityTokenResponseCollectionMsg message.

The <wst:RequestSecurityTokenResponse> element in the server response follows the [WSTrust1.3] definition in section 8, but for key exchange in the WSTEP protocol, the <wst:KeyExchangeToken> element MUST be present, and provides the key exchange token provided from the Issuer.