2

I have a WCF SOAP service that responds with licensing information. The client will save the SOAP response and load it every time the program loads, verifying the user is not passed the expiration date etc. Because of this, one of the requirements of the response is to have a signature such that the client can run the data through some encryption algorithm and check the result against the signature that was sent over to verify nothing has been changed about the file. This is nothing new, this is XML signing. However, the service is written with DataContractSerializer, so I can't just take the data, create an XML signature, and inject that straight into the SOAP response.

I know WsHttpBinding has some security features, the WS-Security page on MSDN describes the Ws binding protocol WRT to SOAP as having the ability to...

Identify the entity or entities involved with the message.

Prove that the entities have the correct group memberships.

Prove that the entities have the correct set of access rights.

Prove that the message has not changed.

but I can't find exactly how it does that last part. Looking at the SOAP response I get with WsHttpBinding on, I see CipherData and CipherValue, but researching that leads me to believe that's more to do with the actual message encryption, not content validation. I see something like ValidateResponse and ValidateResult, but those look like spaces for another endpoint to validate the information, and this product needs to work on devices not connected to the internet once the file is gotten from this service.

I know I could theoretically just put all the data into a variable and SHA256 it and tell my client to do the same process but that's dirty and very unstandardized. I feel like there should be an equivalent to XML Signatures for SOAP responses but I can't find anything through searching.

4

1 回答 1

3

wsHttpBinding 支持 WS-Security，它在 SOAP 消息中包含数字签名。要启用它，您需要在服务合同定义上使用ServiceContractAttribute.ProtectionLevelor OperationContractAttribute.ProtectionLevel，而不是像您期望的那样在服务配置中执行它

因此，在您的服务合同上：

  [ServiceContract(ProtectionLevel=ProtectionLevel.EncryptAndSign)]
  public interface IMyServiceThatIWantToEncyptAndSign
  {
    ...
  }

或者

  [ServiceContract(ProtectionLevel=ProtectionLevel.Sign)]
  public interface IMyServiceThatIWantToSign
  {
    ...
  }

或者

[OperationContract(ProtectionLevel=ProtectionLevel.EncryptAndSign)]
string MyOperationThatIWantToEncryptAndSignSign(string msg);

或者

[OperationContract(ProtectionLevel=ProtectionLevel.Sign)]
string MyOperationThatIWantToSign(string msg);

ProtectionLevel.None这就是为什么我认为您没有看到任何签名的默认值。

服务合同的相关 MSDN 链接在这里：

http://msdn.microsoft.com/en-us/library/system.servicemodel.servicecontractattribute.aspx

这里是运营合同：

http://msdn.microsoft.com/en-us/library/system.servicemodel.operationcontractattribute.aspx

于 2013-10-09T17:35:38.090 回答