作为客户端，使用 WCF 将服务器的传输证书和消息签名证书分开
我目前正在将 WCF 客户端集成到 java Web 服务中。服务器要求客户端使用 SSL 通过证书进行身份验证并对消息进行签名。
我已通过 SSL、签名等方式成功将消息发送到服务器。但是，服务器响应消息也已签名，但使用的证书与用于验证服务器的证书不同。
WCF 客户端不喜欢这种行为。它失败并显示以下消息：“传入消息使用的令牌与用于加密正文的令牌不同。这不是预期的。”问题描述此处详细说明。
在 Google 上环顾四周，我发现可以通过实现 ClientCredentials 和其他安全相关类并添加新扩展来将客户端传输证书与歌唱证书解耦。您可以阅读有关它的所有详细信息 此处。然而，我在弄清楚我到底需要扩展哪里才能为客户端模式下的服务器证书提供相同的行为时遇到了一些麻烦。
任何有关该主题或参考的帮助将不胜感激。
提前致谢。
I am currently in the process of integrating a WCF client into a java web service. The server requires the client to authenticate via certificate using SSL and the message to be signed.
I have successfully sent the message to the server through SSL, Signed, etc. However, the server response message is also signed but with a different certificate than the one used to authenticate the server.
The WCF client doesn't like this behavior. It failed with the message: "The incoming message was signed with a token which was different from what used to encrypt the body. This was not expected." The problem is described here in detail.
Looking around on Google I found it is possible to decouple the clients transport certificate from the singing certificate by implementing ClientCredentials and other security related classes, and adding a new extension. You can read all the details about it here. However I'm having some trouble figuring out where exactly do i have to extend to provide this same behavior for the server's certificate on client mode.
Any help on the subject or reference would be appreciated.
Thanks in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
看看这里
这向您展示了如何创建一个自定义的ServiceCredentialsSecurityTokenManager，它允许您可以为服务器的请求和响应指定各种消息签名和加密证书。
我强调消息是因为您所描述的问题在我看来是消息安全验证。传输安全性与用于验证消息安全性的机制（即消息签名和消息解密）是分开的。
忽略传输安全性，因为它位于 WCF 管道的较低位置，并且从您的描述来看似乎工作正常。一个单独的问题是消息安全。看来您需要能够使用证书来解密响应和证书来验证签名。上面的文章展示了启用此类证书管理的示例，它详细介绍了如何创建行为和扩展以将其应用到您的客户端，这是一个单独的问题。这取决于您想要如何配置代理，即通过代码或通过配置。
示例文章< /a> 您链接的也不是您所需要的完整实现，它仅提供用于签名的证书和用于传输客户端凭据的证书。
您可以创建一个混合 ServiceCredentialsSecurityTokenManager 来提供传输证书以及签名和解密，通过查看 SecurityTokenRequirement 文档
Have a look here
This shows you how to create an custom ServiceCredentialsSecurityTokenManager that allows you to specify the various message signing and encryption certificates for requests and responses to and from the server.
I emphasise message because the problem as you describe it appears to me to be message security validation. The transport security is seaperate from the mechanism used to validate the message security, i.e. the message signature and message decryption.
Ignore the transport security as this is lower down in the WCF pipeline and appears to be working working correctly from your description. A seaperate concern is the message security. It appears that you need to be able to use a certificate for decrypting the response and a certificate for verifying the signature. The above article shows a example for enabling this type of certificate managment, it does detail how you could create behaviours and extensions to apply this to your client that is a seaperate concern. This depends on how you want to configure your proxies i.e. through code or through configuration.
The example article you linked too is not a complete implementation for what you require, it only provides for a certifiate for signing and a certificate for the transport client credentials.
You could create a hybrid ServiceCredentialsSecurityTokenManager that provides the transport certificate and the signing and decryption, this should be clear enough from looking at the SecurityTokenRequirement documentation