WCF客户端绑定将请求的主体签名到Java web服务?

I need to send a message from a WCF client to a Java Web Service that requires the body to be signed. There seems to be a lot of information on this subject, but I can't work out what I actually need to do to achieve this.

我需要从WCF客户机向需要签名的Java Web服务发送消息。关于这个问题似乎有很多信息，但是我不知道我到底需要做什么才能达到这个目的。

I've been told the following:

我被告知如下:

• The customers certificate provides authentication and is included as a binary security token.
• 客户证书提供身份验证，并作为二进制安全令牌包含在其中。
• The customers certificate and the private key are used to sign the body of the SOAP message.
• 客户证书和私钥用于对SOAP消息的主体进行签名。
• The service decodes the SOAP security header and obtains the customer code.
• 服务解码SOAP安全头并获取客户代码。
• The service response is not signed or encrypted.
• 服务响应没有签名或加密。

I've also been provided with an example request and response which is listed below.

我还得到了一个示例请求和响应，如下所示。

Having generated my client and tried to set up the bindings, I get the request sent back to me (I assume this is in place of an error, I don't know why this happens or think it is relevant). I've tried creating a custom binding to sign only (as suggested here):

生成了客户端并尝试设置绑定后，我将请求发送回给我(我假设这代替了错误，我不知道为什么会发生这种情况，也不认为这是相关的)。我尝试过创建一个自定义绑定来进行签名(如下所示):

Dim asec As AsymmetricSecurityBindingElement = CType(SecurityBindingElement.CreateMutualCertificateBindingElement(ServiceModel.MessageSecurityVersion.WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10, True), AsymmetricSecurityBindingElement)
asec.SetKeyDerivation(False)
asec.AllowInsecureTransport = True
asec.IncludeTimestamp = True

but this encrypts the message as well and give the error: Endpoint {http://ServiceAddress}ServiceName does not contain operation meta data for: {http://www.w3.org/2001/04/xmlenc#}EncryptedData

但是这也加密了消息并给出了错误:端点{http://ServiceAddress}ServiceName不包含{http://www.w3.org/2001/04/xmlenc# EncryptedData的操作元数据

Research suggests I need to change the client proxy's Reference.vb file, but when I tried to decorate the request property with protection level = sign, it only enforces this as a minimum, so I suspect that is the wrong approach.

研究表明我需要改变客户代理的引用。vb文件，但是当我试图用保护级别来装饰请求属性时，它只会将这个值设置为最小值，所以我怀疑这是错误的方法。

How do I get the binding to set up correctly to be able to communicate with the service?

如何正确设置绑定，以便能够与服务进行通信?

EDIT: I've used CreateCertificateOverTransportBindingElement which seems to give me the signature I require, however it seems to remove the xml for the properties of the request object. So the service gives me a 500 exception saying it isn't there.

编辑:我使用了CreateCertificateOverTransportBindingElement，它似乎提供了我需要的签名，但是它似乎删除了请求对象属性的xml。所以服务给了我500个例外说它不存在。

EXAMPLE REQUEST:

示例请求:

<?xml version="1.0"?>
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:enc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:ns0="http://[removed]/1.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <env:Header>
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" env:mustUnderstand="1">
      <wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="token-2-1384851101218-1328853118">MIICBjCCAW8CAwLm/jANBgkqhkiG9w0BAQUFADBAMRQwEgYDVQQDDAtGb3JkRXRpcyBDQTEbMBkG
A1UECgwSRm9yZCBNb3RvciBDb21wYW55MQswCQYDVQQGEwJHQjAgFw0xMzA0MTYxMjQ0MThaGA8y
MTEzMDQxNjEyNDQxOFowUzERMA8GA1UEAwwIREVVVEVTVDYxFDASBgNVBAsMC0ZTQSBTZXJ2aWNl
MRswGQYDVQQKDBJGb3JkIE1vdG9yIENvbXBhbnkxCzAJBgNVBAYTAkdCMIGfMA0GCSqGSIb3DQEB
AQUAA4GNADCBiQKBgQC2r/plg8pUmc35Vajc1ji4koYIFgvb5LFUs4GFl/4R0eRspjNwJ7TW1B3s
XyGd272l5oGyNazsGeAZQ88XDRbL5Q60HwrDaKuA/UvT7pKaQufwvIJUWmUwry0K72x7x4jQNWC1
fR3XXzztlrjpf9MmOkbQE1GMdKonldiCu59YcwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAIdSHIsq
KrUAlwbD7AMSQ1PfyIRP9pX94416ELpcr6h/+2RnYF40HcZO9/oU1VJIgCJREI+pRpR2DISDFAhA
LhqzxLTy4G45zcuKjaoKSi6UcaOfsqxuagEanga2CXsapHHB/DB84jLES6fGf79z09xYZ+82iEm5
Kgm6eho2Bqgn</wsse:BinarySecurityToken>
      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#element-1-1384851100999-344078580">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>sArRh/ub3qQBGzBS+W3zeoHNcTk=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
T6bNaNlFP0CfMGEOWQUprdufyHN7BhjETw8o1JH/sb8we23c+f5qvTmYIHYNH89ervkkCRSYlaQu
SyES0toWkH9Od6CqTiwmN2uubID71z9RgA3Vw9SlEAwI7iJi9iHRRqyiDXZkastVHmd7lXQRqYjQ
7/03PSvZjv8K42n8XEE=
</ds:SignatureValue>
<ds:KeyInfo>
<wsse:SecurityTokenReference wsu:Id="reference-3-1384851101219-204425426"><wsse:Reference URI="#token-2-1384851101218-1328853118" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/></wsse:SecurityTokenReference>
</ds:KeyInfo>
</ds:Signature>
    </wsse:Security>
  </env:Header>
  <env:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="element-1-1384851100999-344078580">
    <ns0:list>
      <String_1>[removed]</String_1>
    </ns0:list>
  </env:Body>
</env:Envelope>

EXAMPLE RESPONSE:

示例响应:

<?xml version="1.0"?>
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">
  <env:Header/>
  <env:Body>
    <ns0:listResponse xmlns:ns0="[removed]/1.0">
      <result xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
        <value>
          <code>[removed]</code>
          <description>[removed]</description>
        </value>
      </result>
    </ns0:listResponse>
  </env:Body>
</env:Envelope>

1 个解决方案

#1

I created a custom binding, and used a TransportSecurityBindingElement as the security binding element:

我创建了一个自定义绑定，并使用传输安全绑定元素作为安全绑定元素:

Dim tsec As TransportSecurityBindingElement = SecurityBindingElement.CreateCertificateOverTransportBindingElement()
tsec.EnableUnsecuredResponse = True
tsec.SetKeyDerivation(False)
tsec.AllowInsecureTransport = True
tsec.IncludeTimestamp = True

Note: The timestamp is set to true by default. I want it set to false, but that throws an error.

注意:时间戳默认设置为true。我想让它设置为false，但这会抛出一个错误。

With this configured, the message sent, but the only property in the request didn't serialise. To make this happen, I added the following to the member variable in Reference.vb:

通过这个配置，消息发送了，但是请求中唯一的属性没有序列化。为了实现这一点，我在Reference.vb中为成员变量添加了以下内容:

<System.ServiceModel.MessageBodyMemberAttribute([Namespace]:="", [order]:=0)> _
Public String_1 As String

This gives the following request, though I can't be sure if it is correct yet as the services response seems to cut the body off (see below request).

这给出了下面的请求，尽管我还不能确定它是否正确，因为服务响应似乎切断了主体(参见下面的请求)。

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <s:Header>
        <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <u:Timestamp u:Id="_0">
                <u:Created>2013-12-04T10:53:13.568Z</u:Created>
                <u:Expires>2013-12-04T10:58:13.568Z</u:Expires>
            </u:Timestamp>
            <o:BinarySecurityToken u:Id="uuid-bc441202-6c02-4eb9-a176-02f2a61a6002-1" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">MIICBjCCAW8CAwLm/jANBgkqhkiG9w0BAQUFADBAMRQwEgYDVQQDDAtGb3JkRXRpcyBDQTEbMBkGA1UECgwSRm9yZCBNb3RvciBDb21wYW55MQswCQYDVQQGEwJHQjAgFw0xMzA0MTYxMjQ0MThaGA8yMTEzMDQxNjEyNDQxOFowUzERMA8GA1UEAwwIREVVVEVTVDYxFDASBgNVBAsMC0ZTQSBTZXJ2aWNlMRswGQYDVQQKDBJGb3JkIE1vdG9yIENvbXBhbnkxCzAJBgNVBAYTAkdCMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2r/plg8pUmc35Vajc1ji4koYIFgvb5LFUs4GFl/4R0eRspjNwJ7TW1B3sXyGd272l5oGyNazsGeAZQ88XDRbL5Q60HwrDaKuA/UvT7pKaQufwvIJUWmUwry0K72x7x4jQNWC1fR3XXzztlrjpf9MmOkbQE1GMdKonldiCu59YcwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAIdSHIsqKrUAlwbD7AMSQ1PfyIRP9pX94416ELpcr6h/+2RnYF40HcZO9/oU1VJIgCJREI+pRpR2DISDFAhALhqzxLTy4G45zcuKjaoKSi6UcaOfsqxuagEanga2CXsapHHB/DB84jLES6fGf79z09xYZ+82iEm5Kgm6eho2Bqgn</o:BinarySecurityToken>
            <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
                <SignedInfo>
                    <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                    <Reference URI="#_0">
                        <Transforms>
                            <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>ePSLYY5UDloSReYYUDe4g+QKONk=</DigestValue>
                    </Reference>
                </SignedInfo>
                <SignatureValue>LJfvWJHgU0jvHp69Zw0ZqN+Y/rJw8wm7/AGKMYCvwfzx3nYLA0nGVprBFtM+LSDTlfeHY5/JpiJc2t/qvwS5oMpkmIJtnvnGx/JxZFMEZALj7JBRam5ZdLAnWH6P/A1QgiaKS9vCnVOBf79nMxvKTpgZq1VyYAlXhr7LVqO6pZg=</SignatureValue>
                <KeyInfo>
                    <o:SecurityTokenReference><o:Reference URI="#uuid-bc441202-6c02-4eb9-a176-02f2a61a6002-1"/></o:SecurityTokenReference>
                </KeyInfo>
            </Signature>
        </o:Security>
    </s:Header>
    <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
        <list xmlns="http://hostdomain.com/services/fsa/1.0">
            <String_1 xmlns="">[removed]</String_1>
        </list>
    </s:Body>
</s:Envelope>

Response (for some reason it isn't complete):

回复(由于某些原因它不完整):

<s:Envelope xmlns:s='http://schemas.xmlsoap.org/soap/envelope/' xmlns:u='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd'>
    <s:Header>
        <o:Security s:mustUnderstand='1' xmlns:o='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'>
            <u:Timestamp u:Id='_0'>
                <u:Created>2013-12-04T10:53:13.568Z</u:Created>
                <u:Expires>2013-12-04T10:58:13.568Z</u:Expires>
            </u:Timestamp>
            <o:BinarySecurityToken ValueType='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3' u:Id='uuid-bc441202-6c02-4eb9-a176-02f2a61a6002-1'>MIICBjCCAW8CAwLm/jANBgkqhkiG9w0BAQUFADBAMRQwEgYDVQQDDAtGb3JkRXRpcyBDQTEbMBkGA1UECgwSRm9yZCBNb3RvciBDb21wYW55MQswCQYDVQQGEwJHQjAgFw0xMzA0MTYxMjQ0MThaGA8yMTEzMDQxNjEyNDQxOFowUzERMA8GA1UEAwwIREVVVEVTVDYxFDASBgNVBAsMC0ZTQSBTZXJ2aWNlMRswGQYDVQQKDBJGb3JkIE1vdG9yIENvbXBhbnkxCzAJBgNVBAYTAkdCMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2r/plg8pUmc35Vajc1ji4koYIFgvb5LFUs4GFl/4R0eRspjNwJ7TW1B3sXyGd272l5oGyNazsGeAZQ88XDRbL5Q60HwrDaKuA/UvT7pKaQufwvIJUWmUwry0K72x7x4jQNWC1fR3XXzztlrjpf9MmOkbQE1GMdKonldiCu59YcwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAIdSHIsqKrUAlwbD7AMSQ1PfyIRP9pX94416ELpcr6h/+2RnYF40HcZO9/oU1VJIgCJREI+pRpR2DISDFAhALhqzxLTy4G45zcuKjaoKSi6UcaOfsqxuagEanga2CXsapHHB/DB84jLES6fGf79z09xYZ+82iEm5Kgm6eho2Bqgn</o:BinarySecurityToken>
            <Signature xmlns='http://www.w3.org/2000/09/xmldsig#'>
                <SignedInfo>
                    <CanonicalizationMethod Algorithm='http://www.w3.org/2001/10/xml-exc-c14n#'/>
                    <SignatureMethod Algorithm='http://www.w3.org/2000/09/xmldsig#rsa-sha1'/>
                        <Reference URI='#_0'>
                            <Transforms>
                                <Transform Algorithm='http://www.w3.org/2001/10/xml-exc-c14n#'/>
                            </Transforms>
                            <DigestMethod Algorithm='http://www.w3.org/2000/09/xmldsig#sha1'/>
                            <DigestValue>ePSLYY5UDloSReYYUDe4g+QKONk=</DigestValue>
                        </Reference>
                </SignedInfo>
                <SignatureValue>LJfvWJHgU0jvHp69Zw0ZqN+Y/rJw8wm7/AGKMYCvwfzx3nYLA0nGVprBFtM+LSDTlfeHY5/JpiJc2t/qvwS5oMpkmIJtnvnGx/JxZFMEZALj7JBRam5ZdLAnWH6P/A1QgiaKS9vCnVOBf79nMxvKTpgZq1VyYAlXhr7LVqO6pZg=</SignatureValue>
                <KeyInfo>
                    <o:SecurityTokenReference xmlns:o='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'>
                        <o:Reference URI='#uuid-bc441202-6c02-4eb9-a176-02f2a61a6002-1' xmlns:o='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'/>
                    </o:SecurityTokenReference>
                </KeyInfo>
            </Signature>
        </o:Security>
    </s:Header>
    <s:Body xmlns:xsd='http://www.w3.org/2001/XMLSchema