php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #47762 SoapClient does not fetch WSDL requiring Digest auth
Submitted: 2009-03-24 14:17 UTC Modified: 2009-10-23 13:49 UTC
Votes:13
Avg. Score:4.8 ± 0.5
Reproduced:12 of 12 (100.0%)
Same Version:5 (41.7%)
Same OS:11 (91.7%)
From: marques at displague dot com Assigned:
Status: Open Package: SOAP related
PHP Version: 5.2.9 OS: *
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2009-03-24 14:17 UTC] marques at displague dot com
Description:
------------
SoapClient does not fetch a WSDL file if Digest auth is required to retrieve the WSDL file.  Aside from Bug #47761, which states that Basic auth for WSDL is broken in 5.2.9, Basic auth has been used in previous PHP versions.

Digest auth should be attempted when retrieving a WSDL file if the login and password options are set.  Especially when 'authentication' is set to SOAP_AUTHENTICATION_DIGEST.

I can understand if a separate set of options are needed to distinguish between WSDL credentials and Soap service credentials.  In practice, I would imagine most WSDL files will be retrieved from the same server as the soap service so the extra authentication options may not be necessary.

Another issue is that Digest requires HTTP/1.1 and that isn't fully supported. Bug #47759 blocks HTTP/1.1 usage because "Transfer Encoding: chunked" must be handled properly.  Bug #46539 notes that SoapClient incorrectly uses HTTP/1.1 options over HTTP/1.0.

This posting is related and sums up how some of these problems are connected:
http://marc.info/?l=php-internals&m=123293240706762&w=2 


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-10-23 07:42 UTC] florin dot daneliuc at iquestint dot com
Is there a plan for fixing this?
 [2009-10-23 13:49 UTC] marques at displague dot com
The problem expressed here is still present in 5.2.11.

As a user, I've had to implement my own stream_filter for HTTP chunked 
data and I've extended SoapClient with a class I call 
SoapClientWithDigest that fetches the wsdl using http/1.1 headers, 
Digest auth, and the chunk stream filter.  It also stores the session 
cookie in the properties exported by the soapclient class so that 
subsequent __calls to the methods of the soap server can take 
advantage of the session cookie acquired fetching the wsdl and skip 
further authentication.

A way around this is to store the wsdl file locally (or fetching it 
with curl extensions or other external tools).

PHP 5.3.0 has a broken chunk stream filter (can't handle chunks beyond 
8k). Because it thought it was handling the situation it removes the 
"Transfer-Encoding: chunked" header.  This prevents my working filter 
from detecting that the data was chunked.  There is no way to remove 
one of these default stream_filters (stream_filter_remove requires the 
resource obtained  when the stream_filter was prepended/appended -  
This isn't available to me.).

Stream wrapper has a register and unregister function.  If 
stream_filter (which has a register function) had an unregister 
function, I imagine I would be able to use that to unregister the 
chunked filter.  Point being, I can't work around the problem in PHP 
5.3.0.

In PHP 5.3.1, I hope all of these problems are resolved (chunking is), 
but I'm not sure about the wsdl fetch behavior - which is the reason 
for this bug report.
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Sun Nov 19 01:31:42 2017 UTC