在 KeyInfo 标签下添加 X509Certificate 标签 Soap Signed Envelope Spring Boot Security答案

【问题标题】：Add X509Certificate Tag under KeyInfo Tag Soap Signed Envelope Spring Boot Secruity在 KeyInfo 标签下添加 X509Certificate 标签 Soap Signed Envelope Spring Boot Security
【发布时间】：2023-01-23 15:37:46
【问题描述】：

我正在尝试添加 X509Certificate，它是 KeyInfo 标签下的公钥，同时对 soap 信封进行数字签名。我试了很多方法，还是不看。 PFB 我的代码片段和生成的签名信封。

代码片段

@Bean
public CryptoFactoryBean getCryptoFactoryBean() throws IOException {
    CryptoFactoryBean cryptoFactoryBean = new CryptoFactoryBean();
    cryptoFactoryBean.setKeyStorePassword(Constants.JKS_KEYSTORE_PASSWORD);
    cryptoFactoryBean.setKeyStoreLocation(context.getResource("classpath:certificate/api_cert.p12"));
    return cryptoFactoryBean;
}

@Bean
public Wss4jSecurityInterceptor securityInterceptor() throws Exception {
    Wss4jSecurityInterceptor securityInterceptor = new Wss4jSecurityInterceptor();

    securityInterceptor.setSecurementActions("Signature Timestamp");

    securityInterceptor.setSecurementTimeToLive(900000);
    securityInterceptor.setTimestampPrecisionInMilliseconds(true);

    securityInterceptor.setSecurementUsername("api.cert");
    securityInterceptor.setSecurementPassword(Constants.JKS_KEYSTORE_PASSWORD);
    securityInterceptor.setSecurementSignatureCrypto(getCryptoFactoryBean().getObject());

    securityInterceptor.setSecurementSignatureAlgorithm("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
    securityInterceptor.setSecurementSignatureDigestAlgorithm("http://www.w3.org/2001/04/xmlenc#sha256");

    securityInterceptor.setSecurementMustUnderstand(false);
    securityInterceptor.setSecurementSignatureParts(
            "{Content}{http://schemas.xmlsoap.org/soap/envelope/}Body;{Content}{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Timestamp");
    
    return securityInterceptor;
}

生成的签名信封片段

<ds:KeyInfo Id="KI-1dca42c9-9ff1-463e-a221-cb88577dd3f5">
    <wsse:SecurityTokenReference wsu:Id="STR-5c7abb21-666f-40d2-9f43-ec74f40cc35b">
        <ds:X509Data>
            <ds:X509IssuerSerial>
                <ds:X509IssuerName>CN=DigiCert TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US</ds:X509IssuerName>
                <ds:X509SerialNumber>8989....</ds:X509SerialNumber>
            </ds:X509IssuerSerial>
        </ds:X509Data>
    </wsse:SecurityTokenReference>
</ds:KeyInfo>

所需的签名信封片段

<KeyInfo>
   <X509Data>
      <X509Certificate>MIIGpzCCBY+....</X509Certificate>
      <X509IssuerSerial>
         <X509IssuerName>CN=DigiCert SHA2 Extended Validation Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US</X509IssuerName>
         <X509SerialNumber>206281...</X509SerialNumber>
      </X509IssuerSerial>
   </X509Data>
</KeyInfo>

【问题讨论】：

标签： java spring-boot soap spring-security digital-signature

【解决方案1】：

我也有同样的问题。如果你在这样的时间之后有解决方案，请帮助我

【讨论】：

伊利亚，请不要添加我也是作为答案。它实际上并没有提供问题的答案。如果您有不同但相关的问题，请ask它（如果它有助于提供上下文，请参考此问题）。如果你对这个具体问题感兴趣，你可以upvote它，留下comment，或者一旦你有足够的reputation就开始bounty。