正確的WCF服務綁定以進行簽名驗證

Question

Java客戶端想要將SOAP請求發送到我的WCF服務。 SOAP頭包含簽名和證書信息，例如：

<soapenv:Header> 
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> 
    <ds:Signature Id="SIG-3767FCEC48BA3FC46A141268453194033" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> 
    <ds:SignedInfo> 
    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> 
    <ec:InclusiveNamespaces PrefixList="myg soapenv" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
    </ds:CanonicalizationMethod> 
    <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> 
    <ds:Reference URI="#id-3767FCEC48BA3FC46A14126804973444"> 
    <ds:Transforms> 
     <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> 
     <ec:InclusiveNamespaces PrefixList="myg" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
     </ds:Transform> 
    </ds:Transforms> 
    <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/> 
    <ds:DigestValue>fsN0Bl7FcJhPTZFFOCvyIrLkcg/Oo9JhOpbv23VnnDI=</ds:DigestValue> 
    </ds:Reference> 
    </ds:SignedInfo> 
    <ds:SignatureValue>gVdpmh...0b/1FHPatVA==</ds:SignatureValue> 
    <ds:KeyInfo Id="KI-3767FCEC48BA3FC46A141268453193931"> 
    <wsse:SecurityTokenReference wsu:Id="STR-3767FCEC48BA3FC46A141268453193932"> 
    <wsse:KeyIdentifier EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">MIIDnjCCA...7Of</wsse:KeyIdentifier> 
    </wsse:SecurityTokenReference> 
    </ds:KeyInfo> 
    </ds:Signature> 
</wsse:Security> 
</soapenv:Header> 

應該如何看的web.config我的WCF服務的結合，使SOAP體將針對簽名的SOAP頭進行驗證？

謝謝

Answer 1

試試這個：

<customBinding> 
     <binding name="NewBinding0"> 
      <textMessageEncoding messageVersion="Soap11" /> 
      <security authenticationMode="MutualCertificate" includeTimestamp="false" 
       messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"> 
       <secureConversationBootstrap /> 
      </security> 
      <httpTransport /> 
     </binding> 
</customBinding> 

確保來裝飾你的合同只籤：

[System.ServiceModel.ServiceContractAttribute(ConfigurationName=..., ProtectionLevel=System.Net.Security.ProtectionLevel.Sign)]