3

我尝试为 WSE 3.0 服务创建 WCF 客户端。我已经将 WSE3.0 客户端用于相同的服务。这是它的配置：

 <microsoft.web.services3>
  <security>
   <timeToleranceInSeconds value="10000"/>
   <x509 allowTestRoot="true" verifyTrust="true" storeLocation="CurrentUser"/>
   <binarySecurityTokenManager>
    <add valueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">
     <keyAlgorithm name="RSA15"/>
    </add>
   </binarySecurityTokenManager>
  </security>
 </microsoft.web.services3>

并且以这种方式创建的服务客户端的策略：

  MutualCertificate10Assertion assertion = new MutualCertificate10Assertion()
  {
    EstablishSecurityContext = false,
    RenewExpiredSecurityContext = true,
    RequireSignatureConfirmation = false,
    MessageProtectionOrder = MessageProtectionOrder.SignBeforeEncrypt,
    RequireDerivedKeys = false,
    TtlInSeconds = 300
  };

  assertion.ClientX509TokenProvider = new X509TokenProvider(StoreLocation.LocalMachine, StoreName.My, "ClientCerfiticateName", X509FindType.FindBySubjectName);
  assertion.ServiceX509TokenProvider = new X509TokenProvider(StoreLocation.LocalMachine, StoreName.My, "ServiceCerfiticateName", X509FindType.FindBySubjectName);

  //protection
    assertion.Protection.Request.SignatureOptions = SignatureOptions.IncludeAddressing | SignatureOptions.IncludeTimestamp | SignatureOptions.IncludeSoapBody;
    assertion.Protection.Request.EncryptBody = true;

    assertion.Protection.Response.SignatureOptions = SignatureOptions.IncludeAddressing | SignatureOptions.IncludeTimestamp | SignatureOptions.IncludeSoapBody;
    assertion.Protection.Response.EncryptBody = true;

    assertion.Protection.Fault.SignatureOptions = SignatureOptions.IncludeAddressing | SignatureOptions.IncludeTimestamp | SignatureOptions.IncludeSoapBody;
    assertion.Protection.Fault.EncryptBody = false;

  this.Policy = new Policy(new TraceAssertion(serviceUri), assertion, new RequireActionHeaderAssertion());

现在我尝试使用它来创建 WCF 客户端。我使用了这些建议 ( http://msdn.microsoft.com/en-us/library/ms730299.aspx )。我从服务和客户端合同生成类型，然后创建从 Binding 派生的 WseHttpBinding 类，之后我尝试创建此自定义绑定并初始化客户端和服务证书：

 string clientCertificateName = "ClientCertificateName";
 string serviceCertificateName = "ServiceCertificateName";

 Uri uri = new Uri("http://WantedService.asmx"));

  EndpointAddress address = new EndpointAddress(uri,
                         EndpointIdentity.CreateDnsIdentity(serviceCertificateName ));

  WseHttpBinding binding = new WseHttpBinding()
  {
    SecurityAssertion = WseSecurityAssertion.MutualCertificate10,
    EstablishSecurityContext = false,
    RequireSignatureConfirmation = false,
    MessageProtectionOrder = MessageProtectionOrder.SignBeforeEncrypt,
    RequireDerivedKeys = false
  };

  WantedServiceClient client = new CreativeGroupCurrencyServiceClient(binding, address);

// Set up certificates      
client.ClientCredentials.ServiceCertificate.SetScopedCertificate(
                             StoreLocation.LocalMachine,
                             StoreName.My,
                             X509FindType.FindBySubjectName,
                             serviceCertificateName , 
                            uri);

  client.ClientCredentials.ClientCertificate.SetCertificate(
                             StoreLocation.LocalMachine,
                             StoreName.My,
                             X509FindType.FindBySubjectName,
                             clientCertificateName);

  WantedMethodResponse response = client.WantedMethod(new GetCurrenciesRequest());

但是出现了异常：

System.Xml.XmlException：无法使用BinarySecretSecurityToken的“ http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd ”命名空间从“SignatureConfirmation”元素读取令牌，其中一个''值类型。如果预期此元素有效，请确保将安全性配置为使用具有指定名称、命名空间和值类型的令牌。

为什么它不起作用？为什么方案是 1.1？我应该在 MessageSecurityVersion 中使用 WS Secure 1.1 作为安全绑定元素吗？和哪一个？我试过这个：

  WseHttpBinding binding = new WseHttpBinding()
  {
    SecurityAssertion = WseSecurityAssertion.MutualCertificate11,
    ...
  };

哪一个使用 WS Security 1.1 - MessageSecurityVersion.WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11（在 WseHttpBinding 中配置时）但它也失败了：

System.ServiceModel.Security.MessageSecurityException：安全标头中不需要签名确认。

我不知道我现在还能做什么！看来我什么都试过了！

4

1 回答 1

0

根据这篇文章，关于 wcf wse 兼容性的 msdn文章中存在错误。特别是关于消息版本。这可能是导致您出现问题的原因。

于 2010-08-29T22:01:59.360 回答