WCF客戶端使用帶有消息保護客戶端策略的username_token將消息加密到JAVA WS

我正嘗試創建一個使用帶有消息保護客戶端策略的username_token的JAVA WS的WCF客戶端應用程序。有一個私鑰安裝在服務器上，公鑰證書文件從JKS密鑰庫文件中導出。我已通過MMC在個人證書下將公鑰安裝到證書存儲區。WCF客戶端使用帶有消息保護客戶端策略的username_token將消息加密到JAVA WS

我想創建一個綁定，將加密消息並傳遞用戶名作爲有效負載的一部分。我一直在研究和嘗試大約一天的不同配置。我發現在MSDN論壇上類似的情況：

http://social.msdn.microsoft.com/Forums/en/wcf/thread/ce4b1bf5-8357-4e15-beb7-2e71b27d7415

這是我用我的app.config

<customBinding> 
    <binding name="certbinding"> 
       <security authenticationMode="UserNameOverTransport"> 
        <secureConversationBootstrap /> 
       </security> 
       <httpsTransport requireClientCertificate="true" /> 
       </binding> 
    </customBinding> 

    <endpoint address="https://localhost:8443/ZZZService?wsdl" 
       binding="customBinding" bindingConfiguration="cbinding" contract="XXX.YYYPortType" 
       name="ServiceEndPointCfg" />

的配置和這是我使用的客戶端代碼，這是我在哪裏設置客戶端證書：

  EndpointAddress endpointAddress = new EndpointAddress(url + "?wsdl"); 
      P6.WCF.Project.ProjectPortTypeClient proxy = new P6.WCF.Project.ProjectPortTypeClient("ServiceEndPointCfg", endpointAddress); 
      proxy.ClientCredentials.UserName.UserName = UserName; 

    proxy.ClientCredentials.ClientCertificate.SetCertificate(StoreLocation.CurrentUser, StoreName.My, X509FindType.FindByThumbprint, "67 87 ba 28 80 a6 27 f8 01 a6 53 2f 4a 43 3b 47 3e 88 5a c1"); 

      var projects = proxy.ReadProjects(readProjects);

這是.NET客戶端錯誤我得到：錯誤日誌：安全信息無效。

在Java WS側我跟蹤日誌：

重度：加密已啓用，但沒有在請求沒有加密的密鑰。

我跟蹤了SOAP頭和有效負載，並確認加密密鑰不存在。

Headers: {expect=[100-continue], content-type=[text/xml; charset=utf-8], connection=[Keep-Alive], host=[localhost:8443], Content-Length=[731], vsdebuggercausalitydata=[uIDPo6hC1kng3ehImoceZNpAjXsAAAAAUBpXWdHrtkSTXPWB7oOvGZwi7MLEYUZKuRTz1XkJ3soACQAA], SOAPAction=[""], Content-Type=[text/xml; charset=utf-8]} 


Payload: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><s:Header><o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><o:UsernameToken u:Id="uuid-5809743b-d6e1-41a3-bc7c-66eba0a00998-1"><o:Username>admin</o:Username><o:Password>admin</o:Password></o:UsernameToken></o:Security></s:Header><s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><ReadProjects xmlns="http://xmlns.dev.com/WS/Project/V1"><Field>ObjectId</Field><Filter>Id='WS-Demo'</Filter></ReadProjects></s:Body></s:Envelope>

我也tryed其他一些綁定，但沒有成功：

<basicHttpBinding> 
    <binding name="basicHttp"> 
     <security mode="TransportWithMessageCredential"> 
     <message clientCredentialType="Certificate"/> 
     </security> 
    </binding>    
    </basicHttpBinding> 

     <wsHttpBinding> 
     <binding name="wsBinding"> 
      <security mode="Message"> 
      <message clientCredentialType="UserName" negotiateServiceCredential="false" /> 
      </security> 

     </binding> 
     </wsHttpBinding>

您的幫助將不勝aprreciatted！謝謝！

UPDATE2：

更多的信息，我能得到進一步的，但仍然沒有雪茄:(

我修改的app.config結合部分authenticationMode到UserNameForCertificate並指定使用textMessageEncoding Soap1.1

<binding name="certbinding"> 
    <security authenticationMode="UserNameForCertificate" includeTimestamp="false"> 
    <secureConversationBootstrap /> 
    </security> 
    <textMessageEncoding messageVersion="Soap11" /> 
    <httpsTransport requireClientCertificate="true" /> 
    </binding>

修改了端點條目以包含標識以避開某些證書由於不匹配導致的警告h的dns條目，這讓我進一步。

<client> 
<endpoint address="https://localhost:8443/p6ws/services/ProjectService?wsdl" 
    binding="customBinding" bindingConfiguration="certbinding" contract="P6.WCF.Project.ProjectPortType" 
    name="ProjectServiceEndPointCfg"> 
    <identity> 
    <dns value="localhost"/> 
    </identity> 
</endpoint>

在客戶端代碼ServiceCertificate指定

P6.WCF.Project.ProjectPortTypeClient proxy = new P6.WCF.Project.ProjectPortTypeClient("ProjectServiceEndPointCfg"); 
    proxy.ClientCredentials.UserName.UserName = UserName; 

    proxy.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.PeerOrChainTrust; 
    proxy.ClientCredentials.ServiceCertificate.Authentication.TrustedStoreLocation = System.Security.Cryptography.X509Certificates.StoreLocation.LocalMachine; 

    proxy.ClientCredentials.ClientCertificate.SetCertificate(StoreLocation.CurrentUser, StoreName.My, X509FindType.FindByThumbprint, "67 87 ba 28 80 a6 27 f8 01 a6 53 2f 4a 43 3b 47 3e 88 5a c1"); 
    proxy.ClientCredentials.ServiceCertificate.SetDefaultCertificate(StoreLocation.CurrentUser, StoreName.My, X509FindType.FindByThumbprint, "67 87 ba 28 80 a6 27 f8 01 a6 53 2f 4a 43 3b 47 3e 88 5a c1");

現在跟蹤SOAP我得到一個加密的消息：

有效載荷：

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><s:Header><o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><u:Timestamp u:Id="uuid-c011a1a6-3878-4bbd-b6d1-84c7bf1539fe-2"><u:Created>2010-06-07T22:22:52.250Z</u:Created><u:Expires>2010-06-07T22:27:52.250Z</u:Expires></u:Timestamp><e:EncryptedKey Id="uuid-c011a1a6-3878-4bbd-b6d1-84c7bf1539fe-1" xmlns:e="http://www.w3.org/2001/04/xmlenc#"><e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns="http://www.w3.org/2000/09/xmldsig#"/></e:EncryptionMethod><KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"><o:SecurityTokenReference><o:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1">Z4e6KICmJ/gBplMvSkM7Rz6IWsE=</o:KeyIdentifier></o:SecurityTokenReference></KeyInfo><e:CipherData><e:CipherValue>Ddoi36zRBd+82HQ5rPFxhNXu1nCI8qxRiMtTIm2ldE69AgVbdRtXsHiLKXN6Tsk96U4NjVG/OkCELn7PLHX2CGY/+MH7fDro667RMdOyjlLBzjefO1m/JLTrdGPaHEQmVub/UtriIvwCm4sY8YE35g6Ej8FhABgqQlsvwBi6f3g=</e:CipherValue></e:CipherData></e:EncryptedKey><c:DerivedKeyToken u:Id="_0" xmlns:c="http://schemas.xmlsoap.org/ws/2005/02/sc"><o:SecurityTokenReference><o:Reference URI="#uuid-c011a1a6-3878-4bbd-b6d1-84c7bf1539fe-1"/></o:SecurityTokenReference><c:Offset>0</c:Offset><c:Length>24</c:Length><c:Nonce>kA1uT+jG8DCnw4PWLCpBJA==</c:Nonce></c:DerivedKeyToken><c:DerivedKeyToken u:Id="_1" xmlns:c="http://schemas.xmlsoap.org/ws/2005/02/sc"><o:SecurityTokenReference><o:Reference URI="#uuid-c011a1a6-3878-4bbd-b6d1-84c7bf1539fe-1"/></o:SecurityTokenReference><c:Nonce>9Y5iCPnq9mKvRzE91EbecA==</c:Nonce></c:DerivedKeyToken><e:ReferenceList xmlns:e="http://www.w3.org/2001/04/xmlenc#"><e:DataReference URI="#_3"/><e:DataReference URI="#_4"/><e:DataReference URI="#_5"/></e:ReferenceList><e:EncryptedData Id="_5" Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:e="http://www.w3.org/2001/04/xmlenc#"><e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/><KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"><o:SecurityTokenReference><o:Reference URI="#_1"/></o:SecurityTokenReference></KeyInfo><e:CipherData><e:CipherValue>UE2UhcjwBsETg0Ndu26Gwdvp1UQk6sLJTT8KtSO7B5oykoBGazhrzu5XAQMCQfnlnZM+u8Gq3BLiEtIHb3SWue3i18yr20z8ZwVoHwI/TSNBjdOcfvyD7PF2YxFg/wYMKgY8dnRi8XVO/zWmVLbyd2GT7N1GoaaknkdECjWjVrkdsKlP8/AyprxgRnNJmqTcXUUoamwEeMeU0Y8qfKj3sUreVmPEXOe646JP2SF6pTyVnKSEjL1+TDbhiwOemienKZyNFj+C+JuUQLp/89Cb3hYedb6jWm7JZ1YO8bUy6CqI9Ux6mFxR2n12sDDZ1o1RoxEbR7jHsJJTP0MU2O6TmU4AquJgcldHS60joZy8iCXg24NHoERVI6BnQrEN4WT19E/HkInsUVQSBYTYpRTI1ZyimOX6Y9dgGDxH7tKY4fY=</e:CipherValue></e:CipherData></e:EncryptedData><e:EncryptedData Id="_4" Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:e="http://www.w3.org/2001/04/xmlenc#"><e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/><KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"><o:SecurityTokenReference><o:Reference URI="#_1"/></o:SecurityTokenReference></KeyInfo><e:CipherData><e:CipherValue>qxX35B+cNLG64jgBkmop3+G1rVaQuJnkEyzENod9BvRzXAyqApPX7d3hW3KicJYdk077Ks+AXZE26HO85BqwsdxeNfx1ECXM6YdpxZzHtgqMMfGhaEZI3fh4dgxw3XLnEPa+D2N2lG4qPpxKk/s1M19acAKkaCcgu3NRZbuSHx+jXt3+oZjhITSz5ij5n7FlvKLzyI78/TOWJSrrIOuDBn9mBg1M4TL24USzt1iCGOWQjESSLkQR4u047t5TOZ14SHpdyyr9ZRc+f0QiDZi6Eg2nf+zP5dwSBuqO6KDf0Ws+4jr/g3Y8fczKcbl/gBm0TS/vrMq+uMNSYjLz85CxBZh0xqCJLcTbVKUlqjVHtq+lstSITR1R/mw/j2e1ReHzIGFAfyTS12V7Vygf2tDNbq4fxyafMHPibSDrvQ2brvS6Na04FChyIU2QAoC7Dh9e+gs1IAnLrUCyhmv05kkCxMduN1WAAysRzaghQzn8GzgkmjaiHeqtdI2XOGA6PiAvEcJqBlvL9Z/sxSPiz5K4e4j7TK/yM8ACvKD4O1nAhsSeuX+eW6rrjEW8AfrTJDVV13XHtD/E7o8jqwVUD/rZZaYQJBJGp9axgDhHTGtBDG/sKL+GWEg3/iGnLv+l/NSRMEh3m8tSCBhzePmwJy6iUq2dWYbRUsBL1yeRjutSG+HsZHQjpjmwk2+akYTEk6FoI4MEZEplE3ksNzZUxmdN8cmjNndvYZ1jXKEvzO9loGFzE+77pQyld5IRN6l06BwE7cPc9McXRu84JRvqmEXj+bpwNMGAdM4/NOOinsDDguObue6A3hrbSHZ0dnFmNzaw9qfv+PHWPHB/pWiAmJ3ZY/jBpjucZq4hczIkBlzV5QKbeatIw11ej+1Tluc5maF/FXeuvvrQCrfxVuXF2n+1x+1jXqRQfmRCVdoW5kuokLdCG0cGYt0EZeiuo8rzwNa81fgcjFX7jbcNBTIKZUhWvEXdG6pqryhz2qrpO791XGd/wIkNzUMbCfbDgKtq+zQJLoF102kzFV153h6c0r3jfZS87NBzAVQZ87aYzw1BkQubYhe8tgMtkQAQ0FR25MxzG9i4w8IoT7B3o/Y9YXDIpMY6b1dFhMp0ExUfiHYHl5MypG2hPuzHWf/Ko3yjIiHYd+d6o/9wZCyAK5Uz8/XVgM1OK+94Swkx5LeLQXtjfNu7nC2HXVeGBDypMH+/1IIxwG97We3h2JHU9J9I88l9Xk2Q8gF5TR/1K61umgMscZDWG/g+zwat0mUQtaP8L5yYxTaSCyfP/oxkjBlqyIbEoXs40nyZMnMgAnSDXMznAogPRhueKvJ1u+TzEeqMZntdYNRqL6iY/eMhZJbiwaCh74+V3ccg79R1c6L0/CIMHX0cdxpteUJbMVk8Ocegkp51efkHPd/ZVck0hX7l+u5aqGONngBd/ylYbv2+TMzCV7bJAvD/Khlvs2vLUN8KYyT8jmuBF1PygiyEJ9bXhf6B3xCnc6REtVwZa76l5MiyOQ+8pBPOHbmiFUD0CdbsiBjlQVwh+G/bAkCvV1qXOCK89MKHiaMro7CTrdplTJi5z7X/Pm2/Cfbe14ieXfm8SZ0Bnb+hVW17x+EgXOyxTywBW6sJlQqZAXtg55RlIvds3whZnD8btOQcwy71oZx7r+lscjjQjBL1OucJ05b525iJMIF41EI1iJ7sc1x39Vm0dNAtGh9fubWpUnyRimGMiLV3MNtjws7OzQsun/aLLHqqSy4lAQ0drDc4OCvOeBsCUgI=</e:CipherValue></e:CipherData></e:EncryptedData></o:Security></s:Header><s:Body u:Id="_2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><e:EncryptedData Id="_3" Type="http://www.w3.org/2001/04/xmlenc#Content" xmlns:e="http://www.w3.org/2001/04/xmlenc#"><e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/><KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"><o:SecurityTokenReference xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><o:Reference URI="#_1"/></o:SecurityTokenReference></KeyInfo><e:CipherData><e:CipherValue>07kyxqZy7AXCol4rmwkY9wDC4LVTFqVlGMD7smF5F68L00ndc6yEvuvTKJlb9wN1u0gPfgpIpvMBL2+aio8r2e/uHiseFSEGJhiOtWjpZutmaRkZyJ8xkph2sOO1EUxWUb3X+c32PMTs2RxCGncMBQczf/zXCv9IzWCxZymv8mcIkY2F95N2/6aqWCAqOQxnbOHAH6H13hHv/RCw6kHBNV7abtoY3q9xIFfh98nkf4a5u+jfl8KzMtsSI86kiLCVgMSfS8wSHVdhimkfwT+WSk1PJAqw47WR5ZsbGdHWofbS4fc59djSIwkaWZaJ5Z4biS3rbqSuPzk76F3ItLMWXQ==</e:CipherValue></e:CipherData></e:EncryptedData></s:Body></s:Envelope>

但是在JAVA WS側我得到這個錯誤信息：

org.apache.cxf.binding.soap.SoapFault：未找到用戶名令牌，而嘗試使用來執行驗證。

並且JAVA Ws使用的規範期望加密消息並通過用戶名作爲有效負載的一部分。

關於如何確保用戶名也被傳遞的任何建議？當你在上面的客戶端代碼中設置UserName。

  proxy.ClientCredentials.UserName.UserName = UserName;

來源

2010-06-07 Sasha

你有沒有得到它的工作。我一直在嘗試各種事情在同一行。沒有成功。如果您有任何解決方案，請更新。順便說一句，我在JAVA WS上得到了不同的例外，它似乎抱怨缺少keystore.jks文件。 – Rajiv 2014-08-08 17:09:41

僅僅發送用戶名就夠了嗎？當我們使用clientCredentialType =「UserName」時，我們也設置了密碼。

來源

2010-06-08 21:32:05

WS要求是加密有效負載，並且必須傳遞用戶名。 – Sasha 2010-06-09 12:09:13

WCF客戶端使用帶有消息保護客戶端策略的username_token將消息加密到JAVA WS

回答

相關問題