1. 首頁
  2. 問答
  3. WCF - 如何調試「簽名驗證失敗」消息

WCF - 如何調試「簽名驗證失敗」消息

2013-01-21 82 views
1

我創建了一個調用Spring Web服務2.1.0 + Apache WSS4J 1.6.7（WS-Sec 1.1）服務器並返回響應的WCF客戶端。WCF - 如何調試「簽名驗證失敗」消息

WCF是抱怨「信息安全驗證失敗」與的InnerException「簽名驗證失敗」

問題是，我已經調試這沒有別的辦法，因爲它是在生產服務器。我已經得到了WCF記錄SOAP往返以及拋出的異常，並且運行服務器的人說他們可以在他們的最後處理罰款（即他們在驗證簽名時沒有問題）

任何想法如何進一步調試？我能否創建一個控制檯應用程序來驗證SOAP？

我已經能夠通過發送請求到他們的服務器好了，我正在得到響應，所以我一直在嘗試通過控制檯應用程序進行驗證，以便我可以看到響應出錯的地方，但無法獲得控制檯應用程序驗證XML - CheckSignature在我運行請求和響應時總是返回false。

注：我試過設置xmlDoc.PreserveWhitespace爲true和false

在所有的任何幫助表示讚賞

只是爲了還注意到 - 下面的代碼只是我放在一起測試簽名。實際的服務綁定/服務客戶端是一個單獨的應用程序。該結合是下面：

<customBinding> 
     <binding name="MY_BINDING"> 
      <transactionFlow/> 
      <security defaultAlgorithmSuite="Basic256Rsa15" authenticationMode="MutualCertificate" 
        messageSecurityVersion="WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10" 
        requireDerivedKeys="false" messageProtectionOrder="SignBeforeEncrypt" 
        allowSerializedSigningTokenOnReply="true" securityHeaderLayout="Lax" > 
      <secureConversationBootstrap authenticationMode="CertificateOverTransport" 
             messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10" 
             requireDerivedKeys="false" /> 
      </security> 
      <textMessageEncoding messageVersion="Soap11WSAddressing10"/> 
      <httpsTransport requireClientCertificate="true"/> 
     </binding> 
     </customBinding>

從代碼裝訂 - 配置XML綁定檢索與變形

public static CustomBinding GetServiceBinding() 
     {    
      //Get custom binding reference from app.config 
      CustomBinding binding = new CustomBinding(SettingsLookup.WcfCustomBindingName); 
      binding.ReceiveTimeout = new TimeSpan(0, 0, 15, 0); 
      binding.SendTimeout = new TimeSpan(0, 0, 15, 0); 

      // Get the x509ProtectionParams from the security element 
      X509SecurityTokenParameters tokenParameters = new X509SecurityTokenParameters(); 
      tokenParameters.X509ReferenceStyle = X509KeyIdentifierClauseType.IssuerSerial; 
      tokenParameters.RequireDerivedKeys = false; 
      tokenParameters.InclusionMode = SecurityTokenInclusionMode.AlwaysToRecipient; 

      // Reference the asymettric security element    
      AsymmetricSecurityBindingElement securityBindingElement = binding.Elements.Find<AsymmetricSecurityBindingElement>(); 
      // Set the X509SecurityTokenParameters to point to the one's just configured. This is for symetric encryption, for asymetric this line needs to change 
      //securityBindingElement.ProtectionTokenParameters = tokenParameters; 
      securityBindingElement.MessageSecurityVersion = MessageSecurityVersion.WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10; 
      securityBindingElement.InitiatorTokenParameters = tokenParameters; 
      securityBindingElement.LocalClientSettings.DetectReplays = false; 
      securityBindingElement.RequireSignatureConfirmation = true; 
      //Set timestamp to false as it's not in the VHI request 
      securityBindingElement.IncludeTimestamp = true; 
      securityBindingElement.LocalClientSettings.TimestampValidityDuration = new TimeSpan(12,0,0); 




      return binding; 
     }

此應用只是用於檢查簽名我在SOAP信封直接在供給希望調試簽名，看看發生了什麼故障

// TEST PROGRAM JUST FOR CHECKING SIGNATURE, CONSOLE APP SEPERATE FROM MAIN APP 
class Program 
     { 
      static void Main(string[] args) 
      { 
       XmlDocument xmlDoc = new XmlDocument(); 
       xmlDoc.PreserveWhitespace = true; 
       xmlDoc.LoadXml(Resource1.request); 

       X509Certificate2 cert = new X509Certificate2(@"D:\TEMP\certs\pub_and_private_key.pfx", "password"); 

       bool result = ValidateSoapBodySignature(xmlDoc, cert); 

      } 

     public static bool ValidateSoapBodySignature(XmlDocument doc, X509Certificate2 cert) 
     { 
      // *** Load the doc this time 
      SignedXmlWithId sdoc = new SignedXmlWithId(doc); 

      // *** Find the signature and load it into SignedXml 
      XmlNodeList nodeList = doc.GetElementsByTagName("Signature", "http://www.w3.org/2000/09/xmldsig#"); 
      sdoc.LoadXml((XmlElement)nodeList[0]); 

      // *** Now read the actual signature and validate 
      bool result = sdoc.CheckSignature(cert, true); 

      return result; 
     } 


    } 

    public class SignedXmlWithId : SignedXml 
    { 
     public SignedXmlWithId(XmlDocument xml) 
      : base(xml) 
     { 
     } 

     public SignedXmlWithId(XmlElement xmlElement) 
      : base(xmlElement) 
     { 
     } 

     public override XmlElement GetIdElement(XmlDocument doc, string id) 
     { 
      // check to see if it's a standard ID reference 
      XmlElement idElem = base.GetIdElement(doc, id); 

      if (idElem == null) 
      { 
       XmlNamespaceManager nsManager = new XmlNamespaceManager(doc.NameTable); 
       nsManager.AddNamespace("u", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"); 

       idElem = doc.SelectSingleNode("//*[@u:Id=\"" + id + "\"]", nsManager) as XmlElement; 
      } 

      return idElem; 
     } 
    }

例外

System.ServiceModel.Security.MessageSecurityException: Message security verification failed. 

---&amp;gt; System.Security.Cryptography.CryptographicException: The signature verification failed. 
    at System.IdentityModel.SignedXml.VerifySignature(HashAlgorithm hash, AsymmetricSignatureDeformatter deformatter, String signatureMethod) 
    at System.IdentityModel.SignedXml.StartSignatureVerification(SecurityKey verificationKey) 
    at System.ServiceModel.Security.WSSecurityOneDotZeroReceiveSecurityHeader.VerifySignature(SignedXml signedXml, Boolean isPrimarySignature, SecurityHeaderTokenResolver resolver, Object signatureTarget, String id) 
    at System.ServiceModel.Security.ReceiveSecurityHeader.ProcessPrimarySignature(SignedXml signedXml, Boolean isFromDecryptedSource) 
    at System.ServiceModel.Security.ReceiveSecurityHeader.ExecuteSignatureEncryptionProcessingPass() 
    at System.ServiceModel.Security.LaxModeSecurityHeaderElementInferenceEngine.ExecuteProcessingPasses(ReceiveSecurityHeader securityHeader, XmlDictionaryReader reader) 
    at System.ServiceModel.Security.ReceiveSecurityHeader.Process(TimeSpan timeout, ChannelBinding channelBinding, ExtendedProtectionPolicy extendedProtectionPolicy) 
    at System.ServiceModel.Security.MessageSecurityProtocol.ProcessSecurityHeader(ReceiveSecurityHeader securityHeader, Message&amp;amp; message, SecurityToken requiredSigningToken, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates) 
    at System.ServiceModel.Security.AsymmetricSecurityProtocol.VerifyIncomingMessageCore(Message&amp;amp; message, String actor, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates) 
    at System.ServiceModel.Security.MessageSecurityProtocol.VerifyIncomingMessage(Message&amp;amp; message, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates) 
    --- End of inner exception stack trace ---</ExceptionString><InnerException><ExceptionType>System.Security.Cryptography.CryptographicException, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType><Message>The signature verification failed.</Message><StackTrace> at System.IdentityModel.SignedXml.VerifySignature(HashAlgorithm hash, AsymmetricSignatureDeformatter deformatter, String signatureMethod) 
    at System.IdentityModel.SignedXml.StartSignatureVerification(SecurityKey verificationKey) 
    at System.ServiceModel.Security.WSSecurityOneDotZeroReceiveSecurityHeader.VerifySignature(SignedXml signedXml, Boolean isPrimarySignature, SecurityHeaderTokenResolver resolver, Object signatureTarget, String id) 
    at System.ServiceModel.Security.ReceiveSecurityHeader.ProcessPrimarySignature(SignedXml signedXml, Boolean isFromDecryptedSource) 
    at System.ServiceModel.Security.ReceiveSecurityHeader.ExecuteSignatureEncryptionProcessingPass() 
    at System.ServiceModel.Security.LaxModeSecurityHeaderElementInferenceEngine.ExecuteProcessingPasses(ReceiveSecurityHeader securityHeader, XmlDictionaryReader reader) 
    at System.ServiceModel.Security.ReceiveSecurityHeader.Process(TimeSpan timeout, ChannelBinding channelBinding, ExtendedProtectionPolicy extendedProtectionPolicy) 
    at System.ServiceModel.Security.MessageSecurityProtocol.ProcessSecurityHeader(ReceiveSecurityHeader securityHeader, Message&amp;amp; message, SecurityToken requiredSigningToken, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates) 
    at System.ServiceModel.Security.AsymmetricSecurityProtocol.VerifyIncomingMessageCore(Message&amp;amp; message, String actor, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates) 
    at System.ServiceModel.Security.MessageSecurityProtocol.VerifyIncomingMessage(Message&amp;amp; message, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates)</StackTrace><ExceptionString>System.Security.Cryptography.CryptographicException: The signature verification failed. 
    at System.IdentityModel.SignedXml.VerifySignature(HashAlgorithm hash, AsymmetricSignatureDeformatter deformatter, String signatureMethod) 
    at System.IdentityModel.SignedXml.StartSignatureVerification(SecurityKey verificationKey) 
    at System.ServiceModel.Security.WSSecurityOneDotZeroReceiveSecurityHeader.VerifySignature(SignedXml signedXml, Boolean isPrimarySignature, SecurityHeaderTokenResolver resolver, Object signatureTarget, String id) 
    at System.ServiceModel.Security.ReceiveSecurityHeader.ProcessPrimarySignature(SignedXml signedXml, Boolean isFromDecryptedSource) 
    at System.ServiceModel.Security.ReceiveSecurityHeader.ExecuteSignatureEncryptionProcessingPass() 
    at System.ServiceModel.Security.LaxModeSecurityHeaderElementInferenceEngine.ExecuteProcessingPasses(ReceiveSecurityHeader securityHeader, XmlDictionaryReader reader) 
    at System.ServiceModel.Security.ReceiveSecurityHeader.Process(TimeSpan timeout, ChannelBinding channelBinding, ExtendedProtectionPolicy extendedProtectionPolicy) 
    at System.ServiceModel.Security.MessageSecurityProtocol.ProcessSecurityHeader(ReceiveSecurityHeader securityHeader, Message&amp;amp; message, SecurityToken requiredSigningToken, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates) 
    at System.ServiceModel.Security.AsymmetricSecurityProtocol.VerifyIncomingMessageCore(Message&amp;amp; message, String actor, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates) 
    at System.ServiceModel.Security.MessageSecurityProtocol.VerifyIncomingMessage(Message&amp;amp; message, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates)

SOAP

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> 
    <s:Header> 
    <a:Action s:mustUnderstand="1" u:Id="_3">http://www.xxx.com/xxx/v1/submitRequest</a:Action> 
    <a:MessageID u:Id="_4">urn:uuid:d9d6ae53-4e63-4e2d-86bf-954684d26fd8</a:MessageID> 
    <a:To s:mustUnderstand="1" u:Id="_5">https://urigoeshere.com/</a:To> 
    <a:From u:Id="_6"> 
     <a:Address>http://ourcompany.com/</a:Address> 
    </a:From> 
    <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> 
     <u:Timestamp u:Id="uuid-01f867d2-f5c2-4587-a83d-0878a2342bd9-1"> 
     <u:Created>2013-01-21T17:12:31.213Z</u:Created> 
     <u:Expires>2013-01-22T05:12:31.213Z</u:Expires> 
     </u:Timestamp> 
     <o:BinarySecurityToken u:Id="uuid-81deba4d-1a68-4f53-bb59-3c618914d683-2" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">OMITTED</o:BinarySecurityToken> 
     <e:EncryptedKey Id="_0" xmlns:e="http://www.w3.org/2001/04/xmlenc#"> 
     <e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/> 
     <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"> 
      <o:SecurityTokenReference> 
      <o:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">oNEIRj8uPIkIP4+BfAo/CmYDwzk=</o:KeyIdentifier> 
      </o:SecurityTokenReference> 
     </KeyInfo> 
     <e:CipherData> 
      <e:CipherValue>OMITTED</e:CipherValue> 
     </e:CipherData> 
     <e:ReferenceList> 
      <e:DataReference URI="#_2"/> 
     </e:ReferenceList> 
     </e:EncryptedKey> 
     <Signature xmlns="http://www.w3.org/2000/09/xmldsig#"> 
     <SignedInfo> 
      <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
      <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> 
      <Reference URI="#_1"> 
      <Transforms> 
       <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
      </Transforms> 
      <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
      <DigestValue>17c5Wuh9MNl4i/ytgwm9flLkAnY=</DigestValue> 
      </Reference> 
      <Reference URI="#_3"> 
      <Transforms> 
       <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
      </Transforms> 
      <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
      <DigestValue>2YgeR5vFw0ICk8r+wiaVYknO4E8=</DigestValue> 
      </Reference> 
      <Reference URI="#_4"> 
      <Transforms> 
       <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
      </Transforms> 
      <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
      <DigestValue>NepAQ8htbWWBy0ghljlVfMw5lr0=</DigestValue> 
      </Reference> 
      <Reference URI="#_5"> 
      <Transforms> 
       <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
      </Transforms> 
      <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
      <DigestValue>ynr1icJszUi4OG5vt0usO0419As=</DigestValue> 
      </Reference> 
      <Reference URI="#_6"> 
      <Transforms> 
       <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
      </Transforms> 
      <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
      <DigestValue>y8jXxE1bLmeg6vJi9iqKczNvEDo=</DigestValue> 
      </Reference> 
      <Reference URI="#uuid-01f867d2-f5c2-4587-a83d-0878a2342bd9-1"> 
      <Transforms> 
       <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
      </Transforms> 
      <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
      <DigestValue>qlv+YHU/bxsWvEo/HYVZY9RfqQY=</DigestValue> 
      </Reference> 
     </SignedInfo> 
     <SignatureValue>O6MK3Etk/OIXkSTngGaN+W1JPTrbV2/K0ulnTS69o1/NvmDfpdlkb67TR+UNnCBwVEiV0ILZfQkl9zVhMMpB0lOeM3zzJ5f97dh1WLkGeQm7U2G+ZTN0QFA/O4HZ2yADhzRlPLp29hNdjGBdky99b0oeFyU2hq8qdpIWwKMCDkHlGyftKb4t51yZSc+6uJKYhv3uXSmFMJAYZ6tlTfYa5Cc0jLileNx6I9+tyg73oJZsTEyc+cDZZqdxEmXLrAyt0kz0fcpGWrNKCrKuQlaMsV/KkJYVHSohPpJYWUrrtGmOfiWWhQuwlCIUIxCwR8HBpspFOK8IHEuu+kBQgKrx3g==</SignatureValue> 
     <KeyInfo> 
      <o:SecurityTokenReference> 
      <o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-81deba4d-1a68-4f53-bb59-3c618914d683-2"/> 
      </o:SecurityTokenReference> 
     </KeyInfo> 
     </Signature> 
    </o:Security> 
    </s:Header> 
    <s:Body u:Id="_1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> 
    <e:EncryptedData Id="_2" Type="http://www.w3.org/2001/04/xmlenc#Content" xmlns:e="http://www.w3.org/2001/04/xmlenc#"> 
     <e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/> 
     <e:CipherData> 
     <e:CipherValue>OMITTED</e:CipherValue> 
     </e:CipherData> 
    </e:EncryptedData> 
    </s:Body> 
</s:Envelope>

來源

2013-01-21 StickyMcGinty

+0

你有沒有用過像fiddler這樣的東西來幫助你調試？有了這個，你可以看到發送和接收的確切數據。只是一個建議。 – user959729

+2

您可以啓用WCF安全跟蹤來記錄服務器上安全/系統事件日誌中的所有信息 – sll

+0

您可以發佈WCF綁定嗎？另外，我無法找到正在撥打電話的代碼 – Dhawalk

回答

0

除了使WCF安全的痕跡，我可以推薦你調試.NET框架代碼。 要做到這一點，你必須配置VS如下所述：

http://referencesource.microsoft.com/setup.html

您也可以下載框架源代碼和基於WCF痕跡檢驗究竟是在部分代碼從那裏拋出異常發生。

來源

2014-06-03 20:00:28 PrzemekG

相關問題

 相關問題