“未找到证书（来自客户端）”当调用需要签名的Web服务时

发布于 2024-10-16 02:36:00 字数 2006 浏览 6 评论 0原文

当调用希望使用 WS-Security 对消息进行签名的 Web 服务时，我遇到了一个特殊问题。如果我使用客户端应用程序（使用 Apache CXF）进行调用，我会收到 HTTP 500 错误消息：

*未找到证书*（来自客户端）

而如果我使用 SoapUI 调用相同的服务，配置为使用相同的密钥和密钥存储进行签名，它会按预期工作。

我注意到 CXF 和 SoapUI 之间的调用的部分有所不同。对于 CXF（如下所示），KeyInfo 的部分等更加详细，而 SoapUI 调用仅包含一个简单的。我怀疑这种差异可能是服务器无法识别用于签名的证书的原因。

不幸的是，我无法控制服务器端，因此我无法在那里进行太多调查。很高兴知道这是否是一个已知问题以及是否有任何解决方法？

问候，Ola

CXF：

<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="KeyId-1007572087">
<wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="STRId-1355509614"><ds:X509Data xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509IssuerSerial xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:X509IssuerName xmlns:ds="http://www.w3.org/2000/09/xmldsig#">C=SE,O=Company,CN=Company Test Corporate CA 01,SERIALNUMBER=516406-0120</ds:X509IssuerName>
    <ds:X509SerialNumber xmlns:ds="http://www.w3.org/2000/09/xmldsig#">29382</ds:X509SerialNumber>
</ds:X509IssuerSerial></ds:X509Data></wsse:SecurityTokenReference></ds:KeyInfo>

SoapUI：

<ds:KeyInfo Id="KeyId-850CCDA383426C4A1E129683271974138"><wsse:SecurityTokenReference wsu:Id="STRId-850CCDA383426C4A1E129683271974139" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><wsse:Reference URI="#CertId-850CCDA383426C4A1E129683271974137" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509PKIPathv1"/></wsse:SecurityTokenReference></ds:KeyInfo>

原文

I have a peculiar problem when calling a web service that expects the message to be signed using WS-Security. If I call using my client application (using Apache CXF) I get a HTTP 500 error message:

*Certificate not found* (from client)

while if I call the same service using SoapUI, configured for signing with the same key and key-store, it works as expected.

I noticed that the <KeyInfo> part of the call differs between CXF and SoapUI. With CXF (as below) the KeyInfo is a lot more detailed with <X509Data> sections etc while the SoapUI call contains just a simple <SecurityTokenReference>. I suspect that this difference might be the cause of the server not being able to identify the certificate used for signing.

Unfortunately I'm not in control of the server side thus I cannot do much investigation there. It would be nice to know if this is a known problem and if there are any workarounds?

Regards, Ola

CXF:

<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="KeyId-1007572087">
<wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="STRId-1355509614"><ds:X509Data xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509IssuerSerial xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:X509IssuerName xmlns:ds="http://www.w3.org/2000/09/xmldsig#">C=SE,O=Company,CN=Company Test Corporate CA 01,SERIALNUMBER=516406-0120</ds:X509IssuerName>
    <ds:X509SerialNumber xmlns:ds="http://www.w3.org/2000/09/xmldsig#">29382</ds:X509SerialNumber>
</ds:X509IssuerSerial></ds:X509Data></wsse:SecurityTokenReference></ds:KeyInfo>

SoapUI:

<ds:KeyInfo Id="KeyId-850CCDA383426C4A1E129683271974138"><wsse:SecurityTokenReference wsu:Id="STRId-850CCDA383426C4A1E129683271974139" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><wsse:Reference URI="#CertId-850CCDA383426C4A1E129683271974137" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509PKIPathv1"/></wsse:SecurityTokenReference></ds:KeyInfo>

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

追我者格杀勿论 2024-10-23 02:36:00

显然，诀窍是将WSS4JOutInterceptor的signatureKeyIdentifier属性配置为“DirectReference”，这将创建一个类似于SoapUI的KeyInfo，即它被服务器接受。

            <spring:bean class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
            <spring:constructor-arg>
                <spring:map>
                    <spring:entry key="signatureKeyIdentifier" value="DirectReference"/>
                </spring:map>

Apparently the trick is to configure the WSS4JOutInterceptor's signatureKeyIdentifier property to "DirectReference" which creates a KeyInfo similar to SoapUI, i.e. it's accepted by the server.

            <spring:bean class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
            <spring:constructor-arg>
                <spring:map>
                    <spring:entry key="signatureKeyIdentifier" value="DirectReference"/>
                </spring:map>

回复收藏 0 原文