WCF客戶端 - 爲WS-Security時間戳簽名指定簽名算法

我有一個WCF客戶端向非WCF服務發送消息，並且該服務在處理用於簽署WS的HMAC-SHA1簽名方法時遇到問題 - 安全時間戳元素。理想情況下，我們想使用RSA-SHA1簽名方法，但是我無法讓WCF使用該簽名方法。WCF客戶端 - 爲WS-Security時間戳簽名指定簽名算法

我使用的結合是一個自定義綁定這讓我通過HTTPS發送SAML 2.0令牌：

<customBinding> 
    <!-- This binding is a WS2007FederationHttpBinding without Secure Sessions that uses Text message encoding. --> 
    <binding 
     name="WS2007FederationHttpBinding_NoSecureSession_Text" 
     closeTimeout="00:01:00" 
     openTimeout="00:01:00" 
     receiveTimeout="00:10:00" 
     sendTimeout="00:01:00"> 
     <security 
      authenticationMode="IssuedTokenOverTransport" 
      requireSignatureConfirmation="true" 
      securityHeaderLayout="Lax" 
      messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10" 
      keyEntropyMode="CombinedEntropy" 
      includeTimestamp="true"> 
      <issuedTokenParameters 
       tokenType="urn:oasis:names:tc:SAML:2.0:assertion"> 
       <!-- This describes the STS. That is, the URL, the binding to use, and its Identity --> 
       <issuer 
        address="http://hostname//STS.svc" 
        binding="ws2007HttpBinding" 
        bindingConfiguration="StsUserNameBindingConfiguration"> 
        <identity> 
         <!-- This is the certificate used for signing on the STS. --> 
         <!-- Replace "sts-signing-certificate-thumbprint" with the actual thumbprint of the STS's signing certificate --> 
         <certificateReference 
          findValue="sts-signing-certificate-thumbprint" 
          storeLocation="LocalMachine" 
           storeName="My" 
           x509FindType="FindByThumbprint"/> 
        </identity> 
       </issuer> 
      </issuedTokenParameters> 

      <!-- This basically says "Don't use Secure Conversation" --> 
      <secureConversationBootstrap/> 
     </security> 

     <!-- Use Text Encoding --> 
     <textMessageEncoding/> 

     <!-- This says to use HTTPS when communicating with the remote service --> 
     <httpsTransport 
      requireClientCertificate="true" 
      maxBufferPoolSize="134217728" 
      maxReceivedMessageSize="134217728" 
      maxBufferSize="134217728"/> 
    </binding> 
</customBinding>

在傳出請求籤名是這樣的：

<Signature 
    xmlns="http://www.w3.org/2000/09/xmldsig#"> 
    <SignedInfo> 
     <CanonicalizationMethod 
      Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
     <SignatureMethod 
      Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/> 
     <Reference 
      URI="#_0"> 
      <Transforms> 
       <Transform 
        Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
      </Transforms> 
      <DigestMethod 
       Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
      <DigestValue>GZfW1RkyS4DHYFPHRnRuqNSo+qE=</DigestValue> 
     </Reference> 
    </SignedInfo> 
    <SignatureValue>rMzQ/kEV7AXcO3wm9hfQXNoX5r4=</SignatureValue> 
    <KeyInfo> 
     <o:SecurityTokenReference 
      b:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0" 
      xmlns:b="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"> 
      <o:KeyIdentifier 
       ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID">_9f79359e-63dc-4e38-888c-6567dac4b41b</o:KeyIdentifier> 
     </o:SecurityTokenReference> 
    </KeyInfo> 
</Signature>

注意<SignatureMethod>是http://www.w3.org/2000/09/xmldsig#hmac-sha1

一個有趣的事情是HMAC-SHA1算法是對稱的（一個加密和解密密鑰），而RSA-SHA 1是不對稱的（需要一個密鑰加密，一個解密）。我認爲WCF使用HMAC-SHA1算法，因爲它是對稱的，所交換的SAML令牌是共享密鑰（密鑰）。使用SAML令牌作爲對稱算法的共享密鑰是有道理的，但是有沒有可用的選項來強制WCF使用RSA-SHA1等非對稱算法？

我已經能夠通過更改綁定/安全/ defaultAlgorithmSuite屬性，但不同的選項不給我指定RSA-SHA1這裏的能力，以獲得簽名方法的一些輕微的修改：

defaultAlgorithm =默認：

<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/> <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>

defaultAlgorithm = Basic256：

<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/> <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>

defaultAlgorithm = Basic256Rsa15：

<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/> <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>

defaultAlgorithm = Basic256Sha256：

<SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#hmac-sha256"/> <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>

defaultAlgorithm = Basic256Sha256Rsa15：

<SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#hmac-sha256"/> <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>

有沒有一種方法，我可以強制WCF對時間戳簽名使用RSA-SHA1？

來源

2012-02-20 js80

WCF客戶端 - 爲WS-Security時間戳簽名指定簽名算法

回答

相關問題