如何传递消息凭据 - TransportWithMessageCredential - SOAP请求中没有凭据

时间：2014-04-25 10:13:54

标签： c# android .net wcf ksoap2

我正在使用WSBinding和＃34; TransportWithMessageCredential＆＃34;为了保护我的WCF Web服务，我使用.NET客户端没有任何问题。

但是当尝试从Android或非.Net客户端使用它时，我无法告诉在哪里提供消息凭据!!

我拦截了.NET客户端发送的SOAP消息，它没有包含与凭据相关的任何内容，但它运行正常，但是当使用相同的语法来处理来自和Android的SOAP请求时客户，我们正面临这个错误：

  

无法处理邮件。这很可能是因为   行动＆＃39; http://tempuri.org/XXX/YYY＆＃39;不正确或因为   message包含无效或过期的安全上下文令牌或   因为绑定之间存在不匹配。安全上下文   如果服务中止了该通道，则令牌将无效   闲置。防止服务中止空闲会话   过早增加服务端点上的接收超时   结合。

.NET客户端发送并作为截获的SOAP请求：

<s:Envelope xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:s="http://www.w3.org/2003/05/soap-envelope">
  <s:Header>
    <a:Action s:mustUnderstand="1">http://tempuri.org/XXX/YYY</a:Action>
    <a:MessageID>urn:uuid:XX-XX-XX-XX-XX</a:MessageID>
    <a:ReplyTo>
      <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
    </a:ReplyTo>
  </s:Header>
  <s:Body>
    <XXXXXX xmlns="http://tempuri.org/">
      <request xmlns:d4p1="http://schemas.datacontract.org/2004/07/XXX.XXX.XXX" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
        <d4p1:Prop1 i:nil="true" />
        <d4p1:Prop2 i:nil="true" />
        <d4p1:Prop3 i:nil="true" />
      </request>
    </XXXXXX >
  </s:Body>
</s:Envelope>

我的WCF对该服务的担忧：

  <wsHttpBinding>
    <binding name="wsHttpBindingExt" maxReceivedMessageSize="4096000">
      <readerQuotas maxDepth="32" maxStringContentLength="409600" maxArrayLength="4096000" maxBytesPerRead="4096000" />
      <security mode="TransportWithMessageCredential" >
        <message clientCredentialType="UserName"/>
      </security>
    </binding>
  </wsHttpBinding>

对于正常运行的.NET客户端：                                                                                                                                                        

从.NET调用服务并正常工作的客户端代码：

XXXXXServiceClient client = new XXXXXServiceClient ();
client.ClientCredentials.UserName.UserName = "XXXX";
client.ClientCredentials.UserName.Password = "YYYY";
var res = client.DoXXXXX(a,b,c);

修改

存在，拦截器没有给我整个请求，但我有另一个问题。

使用fiddler，我发现有两个请求，第一个是请求安全令牌：

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <s:Header>
        <a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT</a:Action>
        <a:MessageID>urn:uuid:b7c8d134-ec01-48cd-abb6-81988e7270b1</a:MessageID>
        <a:ReplyTo>
            <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
        </a:ReplyTo>
        <a:To s:mustUnderstand="1">https://XXX.XXX.com/XXX.svc</a:To>
        <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <u:Timestamp u:Id="_0">
                <u:Created>2014-04-25T10:31:13.686Z</u:Created>
                <u:Expires>2014-04-25T10:36:13.686Z</u:Expires>
            </u:Timestamp>
            <o:UsernameToken u:Id="uuid-4d51d9cc-f621-48af-96a7-1fa541c18ea1-1">
                <o:Username>XXX</o:Username>
                <o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">YYY</o:Password>
            </o:UsernameToken>
        </o:Security>
    </s:Header>
    <s:Body>
        <t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
            <t:TokenType>http://schemas.xmlsoap.org/ws/2005/02/sc/sct</t:TokenType>
            <t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType>
            <t:Entropy>
                <t:BinarySecret u:Id="uuid-c32043fe-d4fb-4802-b15a-ba2691c2b3d8-1" Type="http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce">XXXXXXXXXXXXXXXXXXXXXXXXX</t:BinarySecret>
            </t:Entropy>
            <t:KeySize>256</t:KeySize>
        </t:RequestSecurityToken>
    </s:Body>
</s:Envelope>

此请求的回复是：

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <s:Header>
        <a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT</a:Action>
        <a:RelatesTo>urn:uuid:b7c8d134-ec01-48cd-abb6-81988e7270b1</a:RelatesTo>
        <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <u:Timestamp u:Id="_0">
                <u:Created>2014-04-25T10:31:02.106Z</u:Created>
                <u:Expires>2014-04-25T10:36:02.106Z</u:Expires>
            </u:Timestamp>
        </o:Security>
    </s:Header>
    <s:Body>
        <t:RequestSecurityTokenResponse xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
            <t:TokenType>http://schemas.xmlsoap.org/ws/2005/02/sc/sct</t:TokenType>
            <t:RequestedSecurityToken>
                <c:SecurityContextToken u:Id="uuid-67a62dc5-2ce5-45d2-af88-371d06243652-8" xmlns:c="http://schemas.xmlsoap.org/ws/2005/02/sc">
                    <c:Identifier>urn:uuid:e2562052-1de3-496d-b455-e36958692176</c:Identifier>
                </c:SecurityContextToken>
            </t:RequestedSecurityToken>
            <t:RequestedAttachedReference>
                <o:SecurityTokenReference xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
                    <o:Reference ValueType="http://schemas.xmlsoap.org/ws/2005/02/sc/sct" URI="#uuid-67a62dc5-2ce5-45d2-af88-371d06243652-8"/>
                </o:SecurityTokenReference>
            </t:RequestedAttachedReference>
            <t:RequestedUnattachedReference>
                <o:SecurityTokenReference xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
                    <o:Reference URI="urn:uuid:e2562052-1de3-496d-b455-e36958692176" ValueType="http://schemas.xmlsoap.org/ws/2005/02/sc/sct"/>
                </o:SecurityTokenReference>
            </t:RequestedUnattachedReference>
            <t:RequestedProofToken>
                <t:ComputedKey>http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1</t:ComputedKey>
            </t:RequestedProofToken>
            <t:Entropy>
                <t:BinarySecret u:Id="uuid-67a62dc5-2ce5-45d2-af88-371d06243652-9" Type="http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce">JrVuueyiE55P172GX97vM3KM/oo26pN71wQ4B4C5dbo=</t:BinarySecret>
            </t:Entropy>
            <t:Lifetime>
                <u:Created>2014-04-25T10:31:02.106Z</u:Created>
                <u:Expires>2014-04-26T01:31:02.106Z</u:Expires>
            </t:Lifetime>
            <t:KeySize>256</t:KeySize>
        </t:RequestSecurityTokenResponse>
    </s:Body>
</s:Envelope>

然后，我可以在主要的第二个请求中使用这些信息：

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <s:Header>
        <a:Action s:mustUnderstand="1">http://tempuri.org/XXX/YYY</a:Action>
        <a:MessageID>urn:uuid:e2ec7944-a6b8-46f1-b021-270cea67c205</a:MessageID>
        <a:ReplyTo>
            <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
        </a:ReplyTo>
        <a:To s:mustUnderstand="1">https://XXXX.YYYY.com/ZZZZ.svc</a:To>
        <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <u:Timestamp u:Id="_0">
                <u:Created>2014-04-25T10:31:14.905Z</u:Created>
                <u:Expires>2014-04-25T10:36:14.905Z</u:Expires>
            </u:Timestamp>
            <c:SecurityContextToken u:Id="uuid-67a62dc5-2ce5-45d2-af88-371d06243652-8" xmlns:c="http://schemas.xmlsoap.org/ws/2005/02/sc">
                <c:Identifier>urn:uuid:e2562052-1de3-496d-b455-e36958692176</c:Identifier>
            </c:SecurityContextToken>
            <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
                <SignedInfo>
                    <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/>
                    <Reference URI="#_0">
                        <Transforms>
                            <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>YYYYYYYYYYYYYYYYYYYYYY=</DigestValue>
                    </Reference>
                </SignedInfo>
                <SignatureValue>XXXXXXXXXXXXXXXXXXXXX=</SignatureValue>
                <KeyInfo>
                    <o:SecurityTokenReference>
                        <o:Reference ValueType="http://schemas.xmlsoap.org/ws/2005/02/sc/sct" URI="#uuid-67a62dc5-2ce5-45d2-af88-371d06243652-8"/>
                    </o:SecurityTokenReference>
                </KeyInfo>
            </Signature>
        </o:Security>
    </s:Header>
    <s:Body>
    <XXXXXX xmlns="http://tempuri.org/">
      <request xmlns:d4p1="http://schemas.datacontract.org/2004/07/XXX.XXX.XXX" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
        <d4p1:Prop1 i:nil="true" />
        <d4p1:Prop2 i:nil="true" />
        <d4p1:Prop3 i:nil="true" />
      </request>
    </XXXXXX >
    </s:Body>
</s:Envelope>

这里最大的问题是，在哪里找到： BinarySecret，DigestValue，SignatureValue !!!和其他大量的价值观和ID !!!

1 个答案:

答案 0 :(得分：0)

您看到的消息exchanage是Ws-SecureConversation。您可以在此处找到这些消息的完整规范：http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/ws-secureconversation-1.3-os.html

您很可能不希望在Android客户端中实现或使用它，因此您可以通过在message元素中将establishSecurityContext设置为false来禁用绑定。

更多信息： What are the impacts of setting establishSecurityContext="False" if i use https?

相关问题
最新问题