1

我有一个自定义绑定,如下所示,用于我试图从soapUI 4.5.1 调用的 WCF 服务

  <customBinding>
    <binding name="NewBinding0">
      <transactionFlow />
      <security authenticationMode="MutualCertificate"
          defaultAlgorithmSuite="Basic128"
          securityHeaderLayout="Lax"
          includeTimestamp="false"
          messageProtectionOrder="SignBeforeEncrypt"
          allowInsecureTransport="true"
          requireSignatureConfirmation="false"
          requireDerivedKeys="false"
          keyEntropyMode="ClientEntropy"
          requireSecurityContextCancellation="false"
          allowSerializedSigningTokenOnReply="true" 
          messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"
        >
      </security>
      <textMessageEncoding />
      <httpTransport />
    </binding>
  </customBinding>      

从soapUI 调用时,WCF 抛出以下异常:

算法套件 Basic128 不接受算法“ http://www.w3.org/2001/04/xmlenc#rsa-1_5 ”操作“AsymmetricKeyWrap”。

下面是 WSS 部分的配置方式,已经配置了 Keystores 和 Trueststores 在此处输入图像描述 在此处输入图像描述

这是原始传出请求的样子:

<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:tem="http://tempuri.org/">
    <soap:Header xmlns:wsa="http://www.w3.org/2005/08/addressing">
        <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
            <xenc:EncryptedKey Id="EK-37BB785632FD23967C136977675208948" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
                <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
                <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                    <wsse:SecurityTokenReference>
                        <ds:X509Data>
                            <ds:X509IssuerSerial>
                                <ds:X509IssuerName>CN=MyRootCA</ds:X509IssuerName>
                                <ds:X509SerialNumber>32788490101032957713662863797677002373</ds:X509SerialNumber>
                            </ds:X509IssuerSerial>
                        </ds:X509Data>
                    </wsse:SecurityTokenReference>
                </ds:KeyInfo>
                <xenc:CipherData>
                    <xenc:CipherValue>byVbBr2KbCGtit5qxukBt4kJncBRhSAlhwzQbEOJMB53nvSa2KyVEvOzqhW7cPPaSYQ9lusM/sUi6IIkPqYq6MK4PlAUDzCdRLDfi8czCIRd60lzzIoZDsgrP5Wb6KCueUfJqQa3KlMhixG5SVy24JnwFiga1OXFFMhVzQogAxU=</xenc:CipherValue>
                </xenc:CipherData>
                <xenc:ReferenceList>
                    <xenc:DataReference URI="#ED-36"/>
                </xenc:ReferenceList>
            </xenc:EncryptedKey>
            <ds:Signature Id="SIG-35" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:SignedInfo>
                    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments"/>
                    <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                    <ds:Reference URI="#id-34">
                        <ds:Transforms>
                            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                                <InclusiveNamespaces PrefixList="tem" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                            </ds:Transform>
                        </ds:Transforms>
                        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <ds:DigestValue>235Fv28ZEcq/dSboJJff39GP4qw=</ds:DigestValue>
                    </ds:Reference>
                </ds:SignedInfo>
                <ds:SignatureValue>pVCiebPEEhjFnNUyMqTzaTdi3+gAb3kvEmaNGeM16aq7gRoXqC6swMd8lc3wVJbYu99vey6/P/tG
h3DWNApSPdG2GepGU61v1tMvhQUoO50RMwPOCqcNh7sm2Ednd9+e/iz2swgXpW2snAjRtlXQLwG7
4hGH8/kRZVhkjw66fps=</ds:SignatureValue>
                <ds:KeyInfo Id="KI-37BB785632FD23967C136977675207146">
                    <wsse:SecurityTokenReference wsu:Id="STR-37BB785632FD23967C136977675207147">
                        <wsse:KeyIdentifier EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">MIIB+zCCAWigAwIBAgIQGKrVX7X9U4RCiiMNRKUOhTAJBgUrDgMCHQUAMBMxETAPBgNVBAMTCE15Um9vdENBMB4XDTEzMDUxNTE3MzMyMFoXDTM5MTIzMTIzNTk1OVowIzEhMB8GA1UEAxMYY2EtbC05d2Z2cm0xLmNlcmlkaWFuLmNhMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDL9eCKbDpBRXhNSHKAynHtGcbKV0ex6GINUmEsT7MVdfiV3Uo6uhPsSFkTXP94A1NjAoAPbnwqAngSNSy0pVp+tOJEMrAUVylr7ZTyWuuLeS0VjNr5uPa0g7DU0ql2lplX7YoUHvkukOWZZxXaW357xaRK8CaOhgOL46L5R01K7wIDAQABo0gwRjBEBgNVHQEEPTA7gBBCVjzLsGaGduGc3BI9ivDUoRUwEzERMA8GA1UEAxMITXlSb290Q0GCEG8TS3oSQretQKuGdksAAKkwCQYFKw4DAh0FAAOBgQAHy35qBBHWwLunZwIjpx/C4rCXINVbns0Bmb8GCAXqPRd9iFc/mHDgaYP9v8UC7arcAzRO4ZAVR6rHn61rOOk6MZf5xxiCcBwuFApcTg9jGlO+i4Y46k+qCbkHfVgayL//5zRe44bZOb1n4T770Qk2bANYmbkvEBIOx7N42frMPw==</wsse:KeyIdentifier>
                    </wsse:SecurityTokenReference>
                </ds:KeyInfo>
            </ds:Signature>
        </wsse:Security>
        <wsa:Action>http://tempuri.org/IMyService/GetData</wsa:Action>
    </soap:Header>
    <soap:Body wsu:Id="id-34" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
        <xenc:EncryptedData Id="ED-36" Type="http://www.w3.org/2001/04/xmlenc#Content" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
            <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <wsse:SecurityTokenReference wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd">
                    <wsse:Reference URI="#EK-37BB785632FD23967C136977675208948"/>
                </wsse:SecurityTokenReference>
            </ds:KeyInfo>
            <xenc:CipherData>
                <xenc:CipherValue>9ez6pmcUrPH2Riimre1Lbcz0UvFsun2uEMgxmwko7fzqEv+iOzjG5G4Iw4yH8RL5tapABcmGfykgqi7L/r4dLkEqulsjgGm8Zu6D0DcYj11Ft+2sM9C6kBaFd+gEX64gy6MXJSSmoCWnw8PaG8D/uwdZRtMJuDRUWlLU8tVv93vA0XtUwqZdaVa93bYX6xKwGI+JRUBkMadbXTGTswFT2Hc+zO9Tpo7eHIPmWwEBWfHegEy5/4TMy99lzzm30LQFDw/lpqqfdOeuCM9KL93Hg6eOyeKYx2d6/4bSIK1LP1uI0yhYbV+TEXP5iMjrwj6lcZjDBenKn1ayJ6QzW5k0yHiyfQeXHFYLPZNCWHnTD10FYoqCs0n8OXDvlmwaf7suZkbyAC6xblwV5Tqt/Mm8dQ==</xenc:CipherValue>
            </xenc:CipherData>
        </xenc:EncryptedData>
    </soap:Body>
</soap:Envelope>

如果我将用于在 WCF 中签名和加密消息的算法更改为defaultAlgorithmSuite="Basic128Rsa15",那么我会在 WCF 跟踪中得到一个不同的异常:

<Message>Message security verification failed.</Message> ..InnerException> <ExceptionType>System.Security.Cryptography.CryptographicException, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType> <Message>A mismatch occurred on the algorithm for the transform.</Message>

有人知道什么设置会起作用吗?任何帮助是极大的赞赏。我一直在关注@Yaron Naveh 博客和其他关于 SO 的建议,但到目前为止没有任何效果。

4

0 回答 0