爲什麼我通過肥皂標題中的證書獲得簽名

我需要與支持Soap1.1和WS Security 1.0的肥皂服務進行通信。我已經在C＃中提供了一些與此服務進行通信的代碼，但它返回了一個FaultException。從服務的要求之一是我簽署肥皂身體。我收回的錯誤似乎與他對郵件的簽署有關。爲什麼我通過肥皂標題中的證書獲得簽名

當我檢查發送到服務的消息時，我可以看到裏面有一個簽名，但是這個簽名有兩個引用。第一個（URI =＃_ 2）是正文，第二個（URI =＃uuid-67 ....）是用於簽署消息的證書。

我預計這會導致錯誤。請somebady請向我解釋爲什麼第二個參考被添加到簽名以及我如何擺脫它？

來源：

//start communication 
EndpointAddress address = new EndpointAddress(
new Uri("https://klac.procesinfrastructuur.nl:443/PIAanleverservices/services/AanleverService"), 
EndpointIdentity.CreateDnsIdentity("*.procesinfrastructuur.nl")); 

CustomBinding cbinding = new CustomBinding(); 
var sec = (AsymmetricSecurityBindingElement)SecurityBindingElement.CreateMutualCertificateBindingElement(MessageSecurityVersion.WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10); 
sec.EndpointSupportingTokenParameters.Signed.Add(new X509SecurityTokenParameters()); 
sec.MessageSecurityVersion = MessageSecurityVersion.WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10; 
sec.EnableUnsecuredResponse = true; 
sec.MessageProtectionOrder = MessageProtectionOrder.SignBeforeEncrypt; 
sec.IncludeTimestamp = false; 
cbinding.Elements.Add(sec); 

var tme = new TextMessageEncodingBindingElement(MessageVersion.Soap11, Encoding.UTF8); 
cbinding.Elements.Add(tme); 

var https = new HttpsTransportBindingElement(); 
https.RequireClientCertificate = true; 
cbinding.Elements.Add(https); 

ChannelFactory<AanleverService> factory = new ChannelFactory<AanleverService>(cbinding, address); 
factory.Endpoint.Behaviors.Add(new PaulsBehaviour()); 
factory.Credentials.ClientCertificate.SetCertificate(StoreLocation.CurrentUser, StoreName.My, 
    X509FindType.FindBySubjectName, "My Certificate"); 

factory.Credentials.ServiceCertificate.SetDefaultCertificate(StoreLocation.CurrentUser, 
               StoreName.My, 
               X509FindType.FindBySubjectName, 
               "*.procesinfrastructuur.nl"); 

AanleverService client = factory.CreateChannel(); 
try 
{ 
    leverAanRequest request = new leverAanRequest("", "KLogiO.OB20100305", "Omzetbelasting", "inhoud", //EncodeTo64(inhoudsigned), 
               DateTime.Now, "24140938B01", "http://geenausp.nl"); 
    leverAanResponse resultaat = client.leverAan(request); 
    Console.WriteLine("Resultaat: {0}/{1}", resultaat.leverAanReturn.PI_Kenmerk, resultaat.leverAanReturn.tijdstempelOntvangst); 
    Console.ReadKey(); 
}

消息：

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> 
    <s:Header> 
    <ActivityId CorrelationId="7b88bb7b-eb91-47c9-8163-8d0eb90e3adb" xmlns="http://schemas.microsoft.com/2004/09/ServiceModel/Diagnostics">412197d8-e97b-4e33-a988-1a5390b798a4</ActivityId> 
    <VsDebuggerCausalityData xmlns="http://schemas.microsoft.com/vstudio/diagnostics/servicemodelsink">uIDPo44bS9QvZcdJjhUDKzWRBs8AAAAAeNyqcH1zhkeOzSiaDD0CyM+e8mGeN1FCmpSR5zqYPf8ACQAA</VsDebuggerCausalityData> 
    <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> 
     <o:BinarySecurityToken u:Id="uuid-582a2846-2291-4c45-b788-2246af698cd8-3" 
     ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" 
     EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"> 
     MIIG.... 
     </o:BinarySecurityToken> 
     <o:BinarySecurityToken u:Id="uuid-582a2846-2291-4c45-b788-2246af698cd8-1" 
     ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" 
     EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"> 
     MIIG.... 
     </o:BinarySecurityToken> 
     <Signature xmlns="http://www.w3.org/2000/09/xmldsig#"> 
     <SignedInfo> 
      <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
      <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> 
      <Reference URI="#_2"> 
      <Transforms> 
       <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
      </Transforms> 
      <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
      <DigestValue>AosPkLHPJGku8gcL+toVX62fPpg=</DigestValue> 
      </Reference> 
      <Reference URI="#uuid-582a2846-2291-4c45-b788-2246af698cd8-1"> 
      <Transforms> 
       <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
      </Transforms> 
      <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
      <DigestValue>H5fqYFR6N3ryhcna8iXirRhG6w4=</DigestValue> 
      </Reference> 
     </SignedInfo> 
     <SignatureValue>C3oE37WKGthBLpwzN+q/qYJfMKllCnWItNInS1UY5FC4w74sZZh7OJeudS+cNciXNAvT6O+IslJAxdSwApjtuKFTtj0XzgoHqnyRoXbi8zaMT1Vinrw+QSzhhIigWlqXA+5MPUIOJWAWe2Anh6+1LtTyrJo7DpTiSvF8AkGD+sUSOiFcQ6PaA9DtaUDWUqb1rv1X3AqY4T19Twb4aT4sHc3GIi/51/3yALhY4e+jMvo9k3wreJHV/HBCK49sQUCOXHaIHdO7HFodytGRHV5qHaGiH9aJlocAqAKQuegW9O8+56AHt4v3q48zXiIrfQSnaCsSob5LQGudX1KJv7jYtQ==</SignatureValue> 
     <KeyInfo> 
      <o:SecurityTokenReference> 
      <o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-582a2846-2291-4c45-b788-2246af698cd8-3"/> 
      </o:SecurityTokenReference> 
     </KeyInfo> 
     </Signature> 
    </o:Security> 
    </s:Header> 
    <s:Body u:Id="_2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> 
    <leverAan xmlns="http://procesinfrastructuur.nl/service/aanleverservice/2007/01/"> 
     <betreftPI_Kenmerk xmlns=""/> 
     <aanleverKenmerk xmlns="">KLogiO.OB20100305</aanleverKenmerk> 
     <berichtsoort xmlns="">Omzetbelasting</berichtsoort> 
     <berichtInhoud xmlns="">inhoud</berichtInhoud> 
     <tijdstempelAangemaakt xmlns="">2011-06-22T15:45:18.457469+02:00</tijdstempelAangemaakt> 
     <bedrijfsnummer xmlns="">24140938B01</bedrijfsnummer> 
     <cspEndpoint xmlns="">http://geenausp.nl</cspEndpoint> 
    </leverAan> 
    </s:Body> 
</s:Envelope>

來源

2011-06-22 Paul Greefhorst

通過fiddler捕獲消息以查看整個內容。 –

完成後，請參閱修改後的內容 –

好，

最後我發現我爲什麼在證書上得到一個簽名爲好。這是因爲這一行代碼：

sec.EndpointSupportingTokenParameters.Signed.Add(new X509SecurityTokenParameters());

刪除此行導致正確的消息（只有1個引用元素，然後簽名）。

Paul

來源

2011-06-29 11:51:45

爲什麼我通過肥皂標題中的證書獲得簽名

回答

相關問題