WCF 客户端绑定以签署对 Java Web 服务的请求正文？答案

【问题标题】：WCF client binding to sign the body of a request to a Java web service?WCF 客户端绑定以签署对 Java Web 服务的请求正文？
【发布时间】：2013-12-03 10:50:04
【问题描述】：

我需要从 WCF 客户端向 Java Web Service 发送一条消息，该消息需要对正文进行签名。似乎有很多关于这个主题的信息，但我无法弄清楚我实际需要做什么才能实现这一目标。

我被告知如下：

客户证书提供身份验证并作为二进制安全令牌包含在内。
客户证书和私钥用于对 SOAP 消息的正文进行签名。
服务解码 SOAP 安全标头并获取客户代码。
服务响应未签名或加密。

我还收到了下面列出的示例请求和响应。

生成我的客户端并尝试设置绑定后，我将请求发回给我（我假设这是一个错误，我不知道为什么会发生这种情况或认为它是相关的）。我尝试创建自定义绑定以仅签名 (as suggested here)：

Dim asec As AsymmetricSecurityBindingElement = CType(SecurityBindingElement.CreateMutualCertificateBindingElement(ServiceModel.MessageSecurityVersion.WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10, True), AsymmetricSecurityBindingElement)
asec.SetKeyDerivation(False)
asec.AllowInsecureTransport = True
asec.IncludeTimestamp = True

但这也会加密消息并给出错误：Endpoint {http://ServiceAddress}ServiceName does not contain operation meta data for: {http://www.w3.org/2001/04/xmlenc#}EncryptedData

研究表明我需要更改客户端代理的 Reference.vb 文件，但是当我尝试使用保护级别 = 符号来装饰请求属性时，它仅将其强制执行为最低限度，因此我怀疑这是错误的方法。

如何正确设置绑定以便能够与服务通信？

编辑：我使用了 CreateCertificateOverTransportBindingElement，它似乎给了我所需的签名，但它似乎删除了请求对象属性的 xml。所以服务给了我一个 500 异常，说它不存在。

请求示例：

<?xml version="1.0"?>
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:enc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:ns0="http://[removed]/1.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <env:Header>
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" env:mustUnderstand="1">
      <wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="token-2-1384851101218-1328853118">MIICBjCCAW8CAwLm/jANBgkqhkiG9w0BAQUFADBAMRQwEgYDVQQDDAtGb3JkRXRpcyBDQTEbMBkG
A1UECgwSRm9yZCBNb3RvciBDb21wYW55MQswCQYDVQQGEwJHQjAgFw0xMzA0MTYxMjQ0MThaGA8y
MTEzMDQxNjEyNDQxOFowUzERMA8GA1UEAwwIREVVVEVTVDYxFDASBgNVBAsMC0ZTQSBTZXJ2aWNl
MRswGQYDVQQKDBJGb3JkIE1vdG9yIENvbXBhbnkxCzAJBgNVBAYTAkdCMIGfMA0GCSqGSIb3DQEB
AQUAA4GNADCBiQKBgQC2r/plg8pUmc35Vajc1ji4koYIFgvb5LFUs4GFl/4R0eRspjNwJ7TW1B3s
XyGd272l5oGyNazsGeAZQ88XDRbL5Q60HwrDaKuA/UvT7pKaQufwvIJUWmUwry0K72x7x4jQNWC1
fR3XXzztlrjpf9MmOkbQE1GMdKonldiCu59YcwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAIdSHIsq
KrUAlwbD7AMSQ1PfyIRP9pX94416ELpcr6h/+2RnYF40HcZO9/oU1VJIgCJREI+pRpR2DISDFAhA
LhqzxLTy4G45zcuKjaoKSi6UcaOfsqxuagEanga2CXsapHHB/DB84jLES6fGf79z09xYZ+82iEm5
Kgm6eho2Bqgn</wsse:BinarySecurityToken>
      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#element-1-1384851100999-344078580">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>sArRh/ub3qQBGzBS+W3zeoHNcTk=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
T6bNaNlFP0CfMGEOWQUprdufyHN7BhjETw8o1JH/sb8we23c+f5qvTmYIHYNH89ervkkCRSYlaQu
SyES0toWkH9Od6CqTiwmN2uubID71z9RgA3Vw9SlEAwI7iJi9iHRRqyiDXZkastVHmd7lXQRqYjQ
7/03PSvZjv8K42n8XEE=
</ds:SignatureValue>
<ds:KeyInfo>
<wsse:SecurityTokenReference wsu:Id="reference-3-1384851101219-204425426"><wsse:Reference URI="#token-2-1384851101218-1328853118" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/></wsse:SecurityTokenReference>
</ds:KeyInfo>
</ds:Signature>
    </wsse:Security>
  </env:Header>
  <env:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="element-1-1384851100999-344078580">
    <ns0:list>
      <String_1>[removed]</String_1>
    </ns0:list>
  </env:Body>
</env:Envelope>

示例响应：

<?xml version="1.0"?>
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">
  <env:Header/>
  <env:Body>
    <ns0:listResponse xmlns:ns0="[removed]/1.0">
      <result xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
        <value>
          <code>[removed]</code>
          <description>[removed]</description>
        </value>
      </result>
    </ns0:listResponse>
  </env:Body>
</env:Envelope>

【问题讨论】：

标签： java vb.net wcf web-services soap

【解决方案1】：

我创建了一个自定义绑定，并使用 TransportSecurityBindingElement 作为安全绑定元素：

Dim tsec As TransportSecurityBindingElement = SecurityBindingElement.CreateCertificateOverTransportBindingElement()
tsec.EnableUnsecuredResponse = True
tsec.SetKeyDerivation(False)
tsec.AllowInsecureTransport = True
tsec.IncludeTimestamp = True

注意：时间戳默认设置为 true。我希望它设置为 false，但这会引发错误。

使用此配置后，消息已发送，但请求中的唯一属性未序列化。为此，我在 Reference.vb 的成员变量中添加了以下内容：

<System.ServiceModel.MessageBodyMemberAttribute([Namespace]:="", [order]:=0)> _
Public String_1 As String

这给出了以下请求，但我不能确定它是否正确，因为服务响应似乎切断了正文（请参阅下面的请求）。

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <s:Header>
        <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <u:Timestamp u:Id="_0">
                <u:Created>2013-12-04T10:53:13.568Z</u:Created>
                <u:Expires>2013-12-04T10:58:13.568Z</u:Expires>
            </u:Timestamp>
            <o:BinarySecurityToken u:Id="uuid-bc441202-6c02-4eb9-a176-02f2a61a6002-1" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">MIICBjCCAW8CAwLm/jANBgkqhkiG9w0BAQUFADBAMRQwEgYDVQQDDAtGb3JkRXRpcyBDQTEbMBkGA1UECgwSRm9yZCBNb3RvciBDb21wYW55MQswCQYDVQQGEwJHQjAgFw0xMzA0MTYxMjQ0MThaGA8yMTEzMDQxNjEyNDQxOFowUzERMA8GA1UEAwwIREVVVEVTVDYxFDASBgNVBAsMC0ZTQSBTZXJ2aWNlMRswGQYDVQQKDBJGb3JkIE1vdG9yIENvbXBhbnkxCzAJBgNVBAYTAkdCMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2r/plg8pUmc35Vajc1ji4koYIFgvb5LFUs4GFl/4R0eRspjNwJ7TW1B3sXyGd272l5oGyNazsGeAZQ88XDRbL5Q60HwrDaKuA/UvT7pKaQufwvIJUWmUwry0K72x7x4jQNWC1fR3XXzztlrjpf9MmOkbQE1GMdKonldiCu59YcwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAIdSHIsqKrUAlwbD7AMSQ1PfyIRP9pX94416ELpcr6h/+2RnYF40HcZO9/oU1VJIgCJREI+pRpR2DISDFAhALhqzxLTy4G45zcuKjaoKSi6UcaOfsqxuagEanga2CXsapHHB/DB84jLES6fGf79z09xYZ+82iEm5Kgm6eho2Bqgn</o:BinarySecurityToken>
            <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
                <SignedInfo>
                    <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                    <Reference URI="#_0">
                        <Transforms>
                            <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>ePSLYY5UDloSReYYUDe4g+QKONk=</DigestValue>
                    </Reference>
                </SignedInfo>
                <SignatureValue>LJfvWJHgU0jvHp69Zw0ZqN+Y/rJw8wm7/AGKMYCvwfzx3nYLA0nGVprBFtM+LSDTlfeHY5/JpiJc2t/qvwS5oMpkmIJtnvnGx/JxZFMEZALj7JBRam5ZdLAnWH6P/A1QgiaKS9vCnVOBf79nMxvKTpgZq1VyYAlXhr7LVqO6pZg=</SignatureValue>
                <KeyInfo>
                    <o:SecurityTokenReference><o:Reference URI="#uuid-bc441202-6c02-4eb9-a176-02f2a61a6002-1"/></o:SecurityTokenReference>
                </KeyInfo>
            </Signature>
        </o:Security>
    </s:Header>
    <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
        <list xmlns="http://hostdomain.com/services/fsa/1.0">
            <String_1 xmlns="">[removed]</String_1>
        </list>
    </s:Body>
</s:Envelope>

响应（由于某种原因不完整）：

<s:Envelope xmlns:s='http://schemas.xmlsoap.org/soap/envelope/' xmlns:u='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd'>
    <s:Header>
        <o:Security s:mustUnderstand='1' xmlns:o='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'>
            <u:Timestamp u:Id='_0'>
                <u:Created>2013-12-04T10:53:13.568Z</u:Created>
                <u:Expires>2013-12-04T10:58:13.568Z</u:Expires>
            </u:Timestamp>
            <o:BinarySecurityToken ValueType='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3' u:Id='uuid-bc441202-6c02-4eb9-a176-02f2a61a6002-1'>MIICBjCCAW8CAwLm/jANBgkqhkiG9w0BAQUFADBAMRQwEgYDVQQDDAtGb3JkRXRpcyBDQTEbMBkGA1UECgwSRm9yZCBNb3RvciBDb21wYW55MQswCQYDVQQGEwJHQjAgFw0xMzA0MTYxMjQ0MThaGA8yMTEzMDQxNjEyNDQxOFowUzERMA8GA1UEAwwIREVVVEVTVDYxFDASBgNVBAsMC0ZTQSBTZXJ2aWNlMRswGQYDVQQKDBJGb3JkIE1vdG9yIENvbXBhbnkxCzAJBgNVBAYTAkdCMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2r/plg8pUmc35Vajc1ji4koYIFgvb5LFUs4GFl/4R0eRspjNwJ7TW1B3sXyGd272l5oGyNazsGeAZQ88XDRbL5Q60HwrDaKuA/UvT7pKaQufwvIJUWmUwry0K72x7x4jQNWC1fR3XXzztlrjpf9MmOkbQE1GMdKonldiCu59YcwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAIdSHIsqKrUAlwbD7AMSQ1PfyIRP9pX94416ELpcr6h/+2RnYF40HcZO9/oU1VJIgCJREI+pRpR2DISDFAhALhqzxLTy4G45zcuKjaoKSi6UcaOfsqxuagEanga2CXsapHHB/DB84jLES6fGf79z09xYZ+82iEm5Kgm6eho2Bqgn</o:BinarySecurityToken>
            <Signature xmlns='http://www.w3.org/2000/09/xmldsig#'>
                <SignedInfo>
                    <CanonicalizationMethod Algorithm='http://www.w3.org/2001/10/xml-exc-c14n#'/>
                    <SignatureMethod Algorithm='http://www.w3.org/2000/09/xmldsig#rsa-sha1'/>
                        <Reference URI='#_0'>
                            <Transforms>
                                <Transform Algorithm='http://www.w3.org/2001/10/xml-exc-c14n#'/>
                            </Transforms>
                            <DigestMethod Algorithm='http://www.w3.org/2000/09/xmldsig#sha1'/>
                            <DigestValue>ePSLYY5UDloSReYYUDe4g+QKONk=</DigestValue>
                        </Reference>
                </SignedInfo>
                <SignatureValue>LJfvWJHgU0jvHp69Zw0ZqN+Y/rJw8wm7/AGKMYCvwfzx3nYLA0nGVprBFtM+LSDTlfeHY5/JpiJc2t/qvwS5oMpkmIJtnvnGx/JxZFMEZALj7JBRam5ZdLAnWH6P/A1QgiaKS9vCnVOBf79nMxvKTpgZq1VyYAlXhr7LVqO6pZg=</SignatureValue>
                <KeyInfo>
                    <o:SecurityTokenReference xmlns:o='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'>
                        <o:Reference URI='#uuid-bc441202-6c02-4eb9-a176-02f2a61a6002-1' xmlns:o='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'/>
                    </o:SecurityTokenReference>
                </KeyInfo>
            </Signature>
        </o:Security>
    </s:Header>
    <s:Body xmlns:xsd='http://www.w3.org/2001/XMLSchema

【讨论】：

有一个引用标签引用_0。这是时间戳标签。因此，如果您问我，请不要在 body 标签上签名。我自己仍在尝试弄清楚如何在标头中签署正文和 BinarySecurityToken :(