Java 客户端与具有相互证书的 WCF 服务互操作 - 无法解析用于验证签名的 KeyInfo

Question

异常： MessageSecurityException: 无法解析用于验证签名的 KeyInfo: KeyInfo 'SecurityKeyIdentifier

我必须设置 WCF 服务来接收来自 Java 客户端的 SOAP 调用，该客户端发送带有以下标头的签名内容：

<soap:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soap:mustUnderstand="1">
  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="Signature-2">
    <ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
      <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
      <ds:Reference URI="#id-3" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:Transforms xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
          <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
        </ds:Transforms>
        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
        <ds:DigestValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#">…</ds:DigestValue>
      </ds:Reference>
      <ds:Reference URI="#Timestamp-1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:Transforms xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
          <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
        </ds:Transforms>
        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
        <ds:DigestValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#">…</ds:DigestValue>
      </ds:Reference>
    </ds:SignedInfo>
    <ds:SignatureValue xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      …
    </ds:SignatureValue>
    <ds:KeyInfo Id="KeyId-66FC0491F2BB65AFF813274134607712" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <wsse:SecurityTokenReference xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="...." xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
        <ds:X509Data xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
          <ds:X509IssuerSerial xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <ds:X509IssuerName xmlns:ds="http://www.w3.org/2000/09/xmldsig#">CN=XXXXXXXX</ds:X509IssuerName>
            <ds:X509SerialNumber xmlns:ds="http://www.w3.org/2000/09/xmldsig#">111122222</ds:X509SerialNumber>
          </ds:X509IssuerSerial>
        </ds:X509Data>
      </wsse:SecurityTokenReference>
    </ds:KeyInfo>
  </ds:Signature>
  <wsu:Timestamp xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Timestamp-1">
    <wsu:Created>xxxxx</wsu:Created>
    <wsu:Expires>xxxx</wsu:Expires>
  </wsu:Timestamp></wsse:Security></soap:Header>

我已尝试设置以下绑定和行为：

      <customBinding>
    <binding name="javaclientBinding">
      <security
        defaultAlgorithmSuite="Basic256Rsa15" messageSecurityVersion="WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10"
        allowSerializedSigningTokenOnReply="true"
        authenticationMode="MutualCertificateDuplex"
        requireDerivedKeys="false"
        securityHeaderLayout="LaxTimestampLast"
        allowInsecureTransport="true"
        requireSignatureConfirmation="false"
        requireSecurityContextCancellation="false">
      </security>
      <textMessageEncoding messageVersion="Soap11" />
      <httpTransport />
    </binding>
  </customBinding>



<behavior name="javaclientBehavior">
<serviceMetadata httpGetEnabled="True"/>
<serviceDebug includeExceptionDetailInFaults="False"/>
<serviceCredentials>
    <clientCertificate>
    <authentication certificateValidationMode="PeerTrust"/>
</clientCertificate>
<serviceCertificate
    findValue="applicationServer"
  storeLocation="CurrentUser"
  storeName="My"
  x509FindType="FindBySubjectName" />
</serviceCredentials>
   </behavior>

但是我在服务器事件日志中收到以下异常：

ClientIdentity: 
   ActivityId: <null>
   MessageSecurityException: Cannot resolve KeyInfo for verifying signature: KeyInfo
  'SecurityKeyIdentifier
   (
       IsReadOnly = False,
       Count = 1,
       Clause[0] = X509IssuerSerialKeyIdentifierClause(Issuer = 'CN=XXXXXX)
    )
   ', available tokens 'SecurityTokenResolver
(
TokenCount = 0,
)

'。

我们必须让签名验证正常工作，并且我们不可能更改 java 客户端发送的内容。

Answer 1

实际上我也遇到了同样的问题，我正在使用 Yaron Naveh 建议的方法。

我还没有完成，但我正在取得一些进展（完成后我会发布完整的答案）。

该请求使用 AsymmetricSecurityBindingElement，而不是 Yaron 建议的 SymmetricSecurityBindingElement。

X509SecurityTokenParameters 的包含模式应设置为 SecurityTokenInclusionMode.AlwaysToInitiator

绑定应如下所示

//Only the following MessageSecurityVersion are asimetric: 

//WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10
//WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10

AsymmetricSecurityBindingElement abe =(AsymmetricSecurityBindingElement)
SecurityBindingElement.CreateMutualCertificateBindingElement(    
  MessageSecurityVersion.WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10);

abe.SetKeyDerivation(false);

X509SecurityTokenParameters x509ProtectionParameters =
    new X509SecurityTokenParameters(X509KeyIdentifierClauseType.IssuerSerial);

x509ProtectionParameters.InclusionMode = SecurityTokenInclusionMode.AlwaysToInitiator;
x509ProtectionParameters.X509ReferenceStyle = X509KeyIdentifierClauseType.IssuerSerial;

abe.InitiatorTokenParameters = x509ProtectionParameters;
abe.SecurityHeaderLayout = SecurityHeaderLayout.Strict;
abe.DefaultAlgorithmSuite = SecurityAlgorithmSuite.TripleDesRsa15;

HttpTransportBindingElement httpBinding = new HttpTransportBindingElement();
System.ServiceModel.Channels.Binding binding = new CustomBinding(abe, httpBinding);
return binding;

我希望这会有所帮助

Answer 2

请在此处发布整个请求信封。

一般来说，在这种情况下，我建议首先构建一个 WCF 客户端并验证它是否有效。您可以构建一个发送序列号的 WCF 客户端，如下所示：

SymmetricSecurityBindingElement messageSecurity = new SymmetricSecurityBindingElement();
X509SecurityTokenParameters x509ProtectionParameters = 
                new X509SecurityTokenParameters( X509KeyIdentifierClauseType.IssuerSerial);
messageSecurity.ProtectionTokenParameters = x509ProtectionParameters;
HttpTransportBindingElement httpBinding = new HttpTransportBindingElement();
Binding binding = new  CustomBinding(messageSecurity, httpBinding);

注意 X509KeyIdentifierClauseType.IssuerSerial 的用法。可能通过使用此设置的自定义绑定创建服务器将解决整个问题，但我建议启动 wcf 到 wcf。