当前位置： 文江博客话题详情

在 WCF 客户端中，如何将 SAML 2.0 断言添加到 SOAP 标头？

发布于 2024-09-05 09:32:11 字数 14951 浏览 5 评论 0原文

我正在尝试从下面的肥皂头示例添加 saml 2.0 断言节点 - 我遇到了 samlassertion 在 .net 框架中键入，但看起来它仅适用于 saml 1.1。

<S:Header>
    <To xmlns="http://www.w3.org/2005/08/addressing">https://rs1.greenwaymedical.com:8181/CONNECTGateway/EntityService/NhincProxyXDRRequestSecured</To>
    <Action xmlns="http://www.w3.org/2005/08/addressing">tns:ProvideAndRegisterDocumentSet-bRequest_Request</Action>
    <ReplyTo xmlns="http://www.w3.org/2005/08/addressing">
        <Address>http://www.w3.org/2005/08/addressing/anonymous</Address>
    </ReplyTo>
    <MessageID xmlns="http://www.w3.org/2005/08/addressing">uuid:662ee047-3437-4781-a8d2-ee91bc940ef0</MessageID>
    <wsse:Security S:mustUnderstand="1">
        <wsu:Timestamp xmlns:ns17="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512"
                       xmlns:ns16="http://www.w3.org/2003/05/soap-envelope"
                       wsu:Id="_1">
            <wsu:Created>2010-05-26T03:51:57Z</wsu:Created>
            <wsu:Expires>2010-05-26T03:56:57Z</wsu:Expires>
        </wsu:Timestamp>
        <saml2:Assertion xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
                         xmlns:exc14n="http://www.w3.org/2001/10/xml-exc-c14n#"
                         xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                         xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                         xmlns:xs="http://www.w3.org/2001/XMLSchema"
                         ID="bd1ecf8d-a6d8-488d-9183-a11227c6a219"
                         IssueInstant="2010-05-26T03:51:57.959Z"
                         Version="2.0">
            <saml2:Issuer Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">CN=SAML User,OU=SU,O=SAML User,L=Los Angeles,ST=CA,C=US</saml2:Issuer>
            <saml2:Subject>
                <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">UID=kskagerb</saml2:NameID>
                <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key">
                    <saml2:SubjectConfirmationData>
                        <ds:KeyInfo>
                            <ds:KeyValue>
                                <ds:RSAKeyValue>
                                    <ds:Modulus>p4jUkEUg..gwO7U=</ds:Modulus>
                                    <ds:Exponent>AQAB</ds:Exponent>
                                </ds:RSAKeyValue>
                            </ds:KeyValue>
                        </ds:KeyInfo>
                    </saml2:SubjectConfirmationData>
                </saml2:SubjectConfirmation>
            </saml2:Subject>
            <saml2:AuthnStatement AuthnInstant="2009-04-16T13:15:39.000Z"
                                  SessionIndex="987">
                <saml2:SubjectLocality Address="158.147.185.168"
                                       DNSName="cs.myharris.net"/>
                <saml2:AuthnContext>
                    <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:X509</saml2:AuthnContextClassRef>
                </saml2:AuthnContext>
            </saml2:AuthnStatement>
            <saml2:AttributeStatement>
                <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:subject-id">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">Karl S Skagerberg</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:organization">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">InternalTest2</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:organization-id">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">2.2</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:nhin:names:saml:homeCommunityId">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">2.16.840.1.113883.3.441</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xacml:2.0:subject:role">
                    <saml2:AttributeValue>
                        <hl7:Role xmlns:hl7="urn:hl7-org:v3"
                                  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                  code="307969004"
                                  codeSystem="2.16.840.1.113883.6.96"
                                  codeSystemName="SNOMED_CT"
                                  displayName="Public Health"
                                  xsi:type="hl7:CE"/>
                    </saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:purposeofuse">
                    <saml2:AttributeValue>
                        <hl7:PurposeForUse xmlns:hl7="urn:hl7-org:v3"
                                           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                           code="PUBLICHEALTH"
                                           codeSystem="2.16.840.1.113883.3.18.7.1"
                                           codeSystemName="nhin-purpose"
                                           displayName="Use or disclosure of Psychotherapy Notes"
                                           xsi:type="hl7:CE"/>
                    </saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xacml:2.0:resource:resource-id">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">500000000^^^&amp;1.1&amp;ISO</saml2:AttributeValue>
                </saml2:Attribute>
            </saml2:AttributeStatement>
            <saml2:AuthzDecisionStatement Decision="Permit"
                                          Resource="https://158.147.185.168:8181/SamlReceiveService/SamlProcessWS">
                <saml2:Action Namespace="urn:oasis:names:tc:SAML:1.0:action:rwedc">Execute</saml2:Action>
                <saml2:Evidence>
                    <saml2:Assertion ID="40df7c0a-ff3e-4b26-baeb-f2910f6d05a9"
                                     IssueInstant="2009-04-16T13:10:39.093Z"
                                     Version="2.0">
                        <saml2:Issuer Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">CN=SAML User,OU=Harris,O=HITS,L=Melbourne,ST=FL,C=US</saml2:Issuer>
                        <saml2:Conditions NotBefore="2009-04-16T13:10:39.093Z"
                                          NotOnOrAfter="2009-12-31T12:00:00.000Z"/>
                        <saml2:AttributeStatement>
                            <saml2:Attribute Name="AccessConsentPolicy"
                                             NameFormat="http://www.hhs.gov/healthit/nhin">
                                <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                                      xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                                      ns6:type="ns7:string">Claim-Ref-1234</saml2:AttributeValue>
                            </saml2:Attribute>
                            <saml2:Attribute Name="InstanceAccessConsentPolicy"
                                             NameFormat="http://www.hhs.gov/healthit/nhin">
                                <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                                      xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                                      ns6:type="ns7:string">Claim-Instance-1</saml2:AttributeValue>
                            </saml2:Attribute>
                        </saml2:AttributeStatement>
                    </saml2:Assertion>
                </saml2:Evidence>
            </saml2:AuthzDecisionStatement>
            <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:SignedInfo>
                    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                    <ds:Reference URI="#bd1ecf8d-a6d8-488d-9183-a11227c6a219">
                        <ds:Transforms>
                            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </ds:Transforms>
                        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <ds:DigestValue>ONbZqPUyFVPMx4v9vvpJGNB4cao=</ds:DigestValue>
                    </ds:Reference>
                </ds:SignedInfo>
                <ds:SignatureValue>Dm/aW5bB..pF93s=</ds:SignatureValue>
                <ds:KeyInfo>
                    <ds:KeyValue>
                        <ds:RSAKeyValue>
                            <ds:Modulus>p4jUkEU..bzqgwO7U=</ds:Modulus>
                            <ds:Exponent>AQAB</ds:Exponent>
                        </ds:RSAKeyValue>
                    </ds:KeyValue>
                </ds:KeyInfo>
            </ds:Signature>
        </saml2:Assertion>
        <ds:Signature xmlns:ns17="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512"
                      xmlns:ns16="http://www.w3.org/2003/05/soap-envelope"
                      Id="_2">
            <ds:SignedInfo>
                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                    <exc14n:InclusiveNamespaces PrefixList="wsse S"/>
                </ds:CanonicalizationMethod>
                <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                <ds:Reference URI="#_1">
                    <ds:Transforms>
                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                            <exc14n:InclusiveNamespaces PrefixList="wsu wsse S"/>
                        </ds:Transform>
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                    <ds:DigestValue>
                        <Include xmlns="http://www.w3.org/2004/08/xop/include"
                                 href="cid:[email protected]"/>
                    </ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue>
                <Include xmlns="http://www.w3.org/2004/08/xop/include"
                         href="cid:[email protected]"/>
            </ds:SignatureValue>
            <ds:KeyInfo>
                <wsse:SecurityTokenReference wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0">
                    <wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID">bd1ecf8d-a6d8-488d-9183-a11227c6a219</wsse:KeyIdentifier>
                </wsse:SecurityTokenReference>
            </ds:KeyInfo>
        </ds:Signature>
    </wsse:Security>
</S:Header>

我已经研究了好几天，似乎无法想出在 WCF 中执行此操作的直接方法。 Web 服务在 Glassfish 上运行，并且是 Soap 1.1，我已尝试使用所有打包的 wcf 绑定，但无法让它们工作。我开始使用 MessageInspector，并编写了一个，但随后意识到必须有更好的方法，当然 WCF 提供了某种插入 saml 2.0 断言的方法。我在编写自定义绑定方面取得了最大的进展 - 我已经能够在肥皂头中获取时间戳和签名节点，但我一生都无法弄清楚 saml 断言。有什么想法吗？

public static System.ServiceModel.Channels.Binding BuildCONNECTCustomBinding()
{
    TransportSecurityBindingElement transportSecurityBindingElement = SecurityBindingElement.CreateCertificateOverTransportBindingElement(MessageSecurityVersion.WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10);
    TextMessageEncodingBindingElement textMessageEncodingBindingElement = new TextMessageEncodingBindingElement(MessageVersion.Soap11WSAddressing10, System.Text.Encoding.UTF8);
    HttpsTransportBindingElement httpsTransportBindingElement = new HttpsTransportBindingElement();
    SecurityTokenReferenceType securityTokenReference = new SecurityTokenReferenceType();

    BindingElementCollection bindingElementCollection = new BindingElementCollection();
    bindingElementCollection.Add(transportSecurityBindingElement);
    bindingElementCollection.Add(textMessageEncodingBindingElement);
    bindingElementCollection.Add(httpsTransportBindingElement); 

    CustomBinding cb = new CustomBinding(bindingElementCollection);
    cb.CreateBindingElements();

    return cb;
}
原文

I'm trying to add the saml 2.0 assertion node from the soap header example below - I came across the samlassertion type in the .net framework but that looks like it is only for saml 1.1.

<S:Header>
    <To xmlns="http://www.w3.org/2005/08/addressing">https://rs1.greenwaymedical.com:8181/CONNECTGateway/EntityService/NhincProxyXDRRequestSecured</To>
    <Action xmlns="http://www.w3.org/2005/08/addressing">tns:ProvideAndRegisterDocumentSet-bRequest_Request</Action>
    <ReplyTo xmlns="http://www.w3.org/2005/08/addressing">
        <Address>http://www.w3.org/2005/08/addressing/anonymous</Address>
    </ReplyTo>
    <MessageID xmlns="http://www.w3.org/2005/08/addressing">uuid:662ee047-3437-4781-a8d2-ee91bc940ef0</MessageID>
    <wsse:Security S:mustUnderstand="1">
        <wsu:Timestamp xmlns:ns17="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512"
                       xmlns:ns16="http://www.w3.org/2003/05/soap-envelope"
                       wsu:Id="_1">
            <wsu:Created>2010-05-26T03:51:57Z</wsu:Created>
            <wsu:Expires>2010-05-26T03:56:57Z</wsu:Expires>
        </wsu:Timestamp>
        <saml2:Assertion xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
                         xmlns:exc14n="http://www.w3.org/2001/10/xml-exc-c14n#"
                         xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                         xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                         xmlns:xs="http://www.w3.org/2001/XMLSchema"
                         ID="bd1ecf8d-a6d8-488d-9183-a11227c6a219"
                         IssueInstant="2010-05-26T03:51:57.959Z"
                         Version="2.0">
            <saml2:Issuer Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">CN=SAML User,OU=SU,O=SAML User,L=Los Angeles,ST=CA,C=US</saml2:Issuer>
            <saml2:Subject>
                <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">UID=kskagerb</saml2:NameID>
                <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key">
                    <saml2:SubjectConfirmationData>
                        <ds:KeyInfo>
                            <ds:KeyValue>
                                <ds:RSAKeyValue>
                                    <ds:Modulus>p4jUkEUg..gwO7U=</ds:Modulus>
                                    <ds:Exponent>AQAB</ds:Exponent>
                                </ds:RSAKeyValue>
                            </ds:KeyValue>
                        </ds:KeyInfo>
                    </saml2:SubjectConfirmationData>
                </saml2:SubjectConfirmation>
            </saml2:Subject>
            <saml2:AuthnStatement AuthnInstant="2009-04-16T13:15:39.000Z"
                                  SessionIndex="987">
                <saml2:SubjectLocality Address="158.147.185.168"
                                       DNSName="cs.myharris.net"/>
                <saml2:AuthnContext>
                    <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:X509</saml2:AuthnContextClassRef>
                </saml2:AuthnContext>
            </saml2:AuthnStatement>
            <saml2:AttributeStatement>
                <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:subject-id">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">Karl S Skagerberg</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:organization">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">InternalTest2</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:organization-id">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">2.2</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:nhin:names:saml:homeCommunityId">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">2.16.840.1.113883.3.441</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xacml:2.0:subject:role">
                    <saml2:AttributeValue>
                        <hl7:Role xmlns:hl7="urn:hl7-org:v3"
                                  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                  code="307969004"
                                  codeSystem="2.16.840.1.113883.6.96"
                                  codeSystemName="SNOMED_CT"
                                  displayName="Public Health"
                                  xsi:type="hl7:CE"/>
                    </saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:purposeofuse">
                    <saml2:AttributeValue>
                        <hl7:PurposeForUse xmlns:hl7="urn:hl7-org:v3"
                                           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                           code="PUBLICHEALTH"
                                           codeSystem="2.16.840.1.113883.3.18.7.1"
                                           codeSystemName="nhin-purpose"
                                           displayName="Use or disclosure of Psychotherapy Notes"
                                           xsi:type="hl7:CE"/>
                    </saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xacml:2.0:resource:resource-id">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">500000000^^^&1.1&ISO</saml2:AttributeValue>
                </saml2:Attribute>
            </saml2:AttributeStatement>
            <saml2:AuthzDecisionStatement Decision="Permit"
                                          Resource="https://158.147.185.168:8181/SamlReceiveService/SamlProcessWS">
                <saml2:Action Namespace="urn:oasis:names:tc:SAML:1.0:action:rwedc">Execute</saml2:Action>
                <saml2:Evidence>
                    <saml2:Assertion ID="40df7c0a-ff3e-4b26-baeb-f2910f6d05a9"
                                     IssueInstant="2009-04-16T13:10:39.093Z"
                                     Version="2.0">
                        <saml2:Issuer Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">CN=SAML User,OU=Harris,O=HITS,L=Melbourne,ST=FL,C=US</saml2:Issuer>
                        <saml2:Conditions NotBefore="2009-04-16T13:10:39.093Z"
                                          NotOnOrAfter="2009-12-31T12:00:00.000Z"/>
                        <saml2:AttributeStatement>
                            <saml2:Attribute Name="AccessConsentPolicy"
                                             NameFormat="http://www.hhs.gov/healthit/nhin">
                                <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                                      xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                                      ns6:type="ns7:string">Claim-Ref-1234</saml2:AttributeValue>
                            </saml2:Attribute>
                            <saml2:Attribute Name="InstanceAccessConsentPolicy"
                                             NameFormat="http://www.hhs.gov/healthit/nhin">
                                <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                                      xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                                      ns6:type="ns7:string">Claim-Instance-1</saml2:AttributeValue>
                            </saml2:Attribute>
                        </saml2:AttributeStatement>
                    </saml2:Assertion>
                </saml2:Evidence>
            </saml2:AuthzDecisionStatement>
            <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:SignedInfo>
                    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                    <ds:Reference URI="#bd1ecf8d-a6d8-488d-9183-a11227c6a219">
                        <ds:Transforms>
                            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </ds:Transforms>
                        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <ds:DigestValue>ONbZqPUyFVPMx4v9vvpJGNB4cao=</ds:DigestValue>
                    </ds:Reference>
                </ds:SignedInfo>
                <ds:SignatureValue>Dm/aW5bB..pF93s=</ds:SignatureValue>
                <ds:KeyInfo>
                    <ds:KeyValue>
                        <ds:RSAKeyValue>
                            <ds:Modulus>p4jUkEU..bzqgwO7U=</ds:Modulus>
                            <ds:Exponent>AQAB</ds:Exponent>
                        </ds:RSAKeyValue>
                    </ds:KeyValue>
                </ds:KeyInfo>
            </ds:Signature>
        </saml2:Assertion>
        <ds:Signature xmlns:ns17="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512"
                      xmlns:ns16="http://www.w3.org/2003/05/soap-envelope"
                      Id="_2">
            <ds:SignedInfo>
                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                    <exc14n:InclusiveNamespaces PrefixList="wsse S"/>
                </ds:CanonicalizationMethod>
                <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                <ds:Reference URI="#_1">
                    <ds:Transforms>
                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                            <exc14n:InclusiveNamespaces PrefixList="wsu wsse S"/>
                        </ds:Transform>
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                    <ds:DigestValue>
                        <Include xmlns="http://www.w3.org/2004/08/xop/include"
                                 href="cid:[email protected]"/>
                    </ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue>
                <Include xmlns="http://www.w3.org/2004/08/xop/include"
                         href="cid:[email protected]"/>
            </ds:SignatureValue>
            <ds:KeyInfo>
                <wsse:SecurityTokenReference wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0">
                    <wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID">bd1ecf8d-a6d8-488d-9183-a11227c6a219</wsse:KeyIdentifier>
                </wsse:SecurityTokenReference>
            </ds:KeyInfo>
        </ds:Signature>
    </wsse:Security>
</S:Header>

I've been researching for days and cannot seem to come up with a straightforward way of doing this in WCF. The web service is running on Glassfish and is soap 1.1, I've tried using all the packaged wcf bindings but have not been able to get them to work. I started down the path of using a MessageInspector, and wrote one but then realized there must be a better way, surely WCF provides some way to insert saml 2.0 assertions. I've made the most progress writing a custom binding - i've been able to get the timestamp and signature nodes in the soap header, but cannot for the life of me figure out the saml assertion. Any ideas?

public static System.ServiceModel.Channels.Binding BuildCONNECTCustomBinding()
{
    TransportSecurityBindingElement transportSecurityBindingElement = SecurityBindingElement.CreateCertificateOverTransportBindingElement(MessageSecurityVersion.WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10);
    TextMessageEncodingBindingElement textMessageEncodingBindingElement = new TextMessageEncodingBindingElement(MessageVersion.Soap11WSAddressing10, System.Text.Encoding.UTF8);
    HttpsTransportBindingElement httpsTransportBindingElement = new HttpsTransportBindingElement();
    SecurityTokenReferenceType securityTokenReference = new SecurityTokenReferenceType();

    BindingElementCollection bindingElementCollection = new BindingElementCollection();
    bindingElementCollection.Add(transportSecurityBindingElement);
    bindingElementCollection.Add(textMessageEncodingBindingElement);
    bindingElementCollection.Add(httpsTransportBindingElement); 

    CustomBinding cb = new CustomBinding(bindingElementCollection);
    cb.CreateBindingElements();

    return cb;
}

如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论， 你可以免费 注册 一个本站的账号。

评论（2）

夏の忆 2024-09-12 09:32:13

尽管我还没有找到完整的解决方案，但我相信我已经找到了正确的道路。我需要按照 此 Microsoft 文档创建自定义安全令牌。我在下面开始列出一些我认为有用的链接，希望它们能为面临同样挑战的其他人提供指导。

参考链接：

  • .NET SAML 2.0 实施。
  • 如何将 SAML 2.0 断言与 WS2007HttpBinding 结合使用（即不依赖安全令牌服务来提供令牌）？
  • 使用自定义 ClientCredentials 进行 WCF 身份验证：要使用什么 clientCredentialType？< /a>
  • 需要有关如何签名的建议使用 WCF 请求的肥皂体

    • Although I'm not at the full solution yet I believe I have found the right path to take. I need to create a custom security token by following this Microsoft documentation. I'm starting a list of links below that I have found helpful in hopes they provide guidance to others facing the same challenge.

    Reference Links:

  • .NET SAML 2.0 implementation.
  • How to use SAML 2.0 Assertions with WS2007HttpBinding (i.e. without relying on a Security Token Service to provide tokens)?
  • WCF Authentication with custom ClientCredentials: What is the clientCredentialType to use?
  • Need advise on how to sign request's soap body using WCF

    • 回复 原文
    自在安然 2024-09-12 09:32:13

    检查 WIF（Windows 身份基础）。它支持 SAML 2.0 令牌，并且应该能够与 WCF 集成 。

    Check WIF (Windows identity foundation). It supports SAML 2.0 tokens and it should be able to integrate with WCF.

    回复 原文
    ~没有更多了~

    关于作者

    ゛时过境迁

    暂无简介

    0 文章
    0 评论
    21 人气
    发私信

    相关话题

    更多

    热门标签

    操作系统 程序设计 IT运维 Linux系统管理 JavaScript 服务器应用 solaris C/C++ PHP Shell BSD Vue.js aix Oracle Python HTML 系统管理 HTML5 CSS 前端
    更多

    推荐作者

    烙印

    文章 0 评论 0

    singlesman

    文章 0 评论 0

    给自己一个微笑

    文章 0 评论 0

    独孤求败

    文章 0 评论 0

    晨钟暮鼓

    文章 0 评论 0

    我是自愿种绣球花的

    文章 0 评论 0

    更多

    友情链接

    文江博客
      我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站，即表示您同意使用 Cookies 和您的相关数据。
      原文