java - WCF\.Net\C# 中的 WSSE(带摘要)- 一种简单的方法？

Question

免责声明:.Net N00b

几天来，我一直在用头撞墙，试图让这个外部供应商网络服务的安全工作无济于事。事实证明，他们使用 WSSE 摘要安全性，简而言之，它向 SOAP header 添加了如下内容:

<wsse:UsernameToken wsu:Id="Example-1"> 
   <wsse:Username> ... </wsse:Username> 
   <wsse:Password Type="..."> ... </wsse:Password> 
   <wsse:Nonce EncodingType="..."> ... </wsse:Nonce> 
   <wsu:Created> ... </wsu:Created> 
</wsse:UsernameToken> 

我从添加服务引用开始，通过很多很多博客文章，stackoverflow 问题摆弄了 app.config 和代码。我似乎无法做到正确。也许这不容易？也许我只是不太了解 Visual Studio 2010 和 .Net，我不确定。

这是我在 app.config 中停止的内容:

<system.serviceModel>
    <bindings>
        <basicHttpBinding>
            <binding name="ServiceHttpBinding" closeTimeout="00:01:00"
                openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
                allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
                useDefaultWebProxy="true">
                <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                    maxBytesPerRead="4096" maxNameTableCharCount="16384" />
              <security mode="TransportWithMessageCredential" />
            </binding>
        </basicHttpBinding>
    </bindings>
    <client>
      <endpoint address="https://vendorurl"
          binding="basicHttpBinding" bindingConfiguration="ServiceHttpBinding"
          contract="ContractName"
          name="ServiceHttpPort">
      </endpoint>
    </client>
</system.serviceModel>

还有 C#:

    var someService = new ServiceClient();

    someService.ClientCredentials.UserName.UserName = "username";
    someService.ClientCredentials.UserName.Password = "passwordgobbletygook/somemorebase64stuff=";

    #region Begin Magic
    var elements = someService.Endpoint.Binding.CreateBindingElements();

    var securityBindingElement = elements.Find<SecurityBindingElement>();
    securityBindingElement.IncludeTimestamp = false;

    someService.Endpoint.Binding = new CustomBinding(elements);
    #endregion

    var response = someService.webMethod(param1, param2, param3, param4);

    Console.WriteLine(response);

有趣的是，在供应商规范中，我发现他们鼓励使用 WSSJ，所以我尝试了(在 Java 中)并我在 2 小时内让它工作

这是它的样子:

public class Test implements CallbackHandler {

    /**
     * @param args
     */
    public static void main( final String[] args ) throws Throwable {
        SomeService_Service someService_Service = new SomeService_Service();
        SomeService someService = someService_Service.getSomeServiceHttpPort();

        BindingProvider bindingProvider = (BindingProvider)someService;
        Map< String, Object > requestContext = bindingProvider.getRequestContext();
        requestContext.put( BindingProvider.ENDPOINT_ADDRESS_PROPERTY, "https://vendorurl" );

        Client client = ClientProxy.getClient( someService );
        Endpoint endpoint = client.getEndpoint();

        Map< String, Object > outProps = new HashMap< String, Object >();
        outProps.put( WSHandlerConstants.ACTION, WSHandlerConstants.USERNAME_TOKEN );
        outProps.put( WSHandlerConstants.USER, "username" );
        outProps.put( WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_DIGEST );
        outProps.put( WSHandlerConstants.PW_CALLBACK_REF, new Test() );

        WSS4JOutInterceptor wssOut = new WSS4JOutInterceptor( outProps );
        endpoint.getOutInterceptors().add( wssOut );

        System.out.println( someService.webMethod(param1, param2, param3, param4) );
    }

    public void handle( final Callback[] callbacks ) throws IOException, UnsupportedCallbackException {
        WSPasswordCallback pc = (WSPasswordCallback)callbacks[ 0 ];

        // set the password for our message.
        pc.setPassword( "passwordgobbletygook/somemorebase64stuff=" );
    }
}

在 stackoverflow 领域有没有人让它在 .Net\C# 中工作？我在这里明显遗漏了什么吗？

Answer 1

我们以前在尝试将基于 .NET 的组件连接到基于 JAVA 的 SOAP 服务时遇到过这个问题。我们的解决方案不涉及任何 XML 构造，恕我直言，它比我见过的任何其他解决方案都要干净一些。

缺点是您需要下载并包含一个较旧的可选 .NET DLL 才能使其正常工作。好处是代码非常干净并且很自然地适合 WCF。

基本实现看起来像这样:

using (OperationContextScope scope = new OperationContextScope(client.InnerChannel))
{
    //Class from WSE 3.0
    UsernameToken token = new UsernameToken("MY_USERNAME", "MY_PASSWORD", PasswordOption.SendHashed);

    //Add Auth to SOAP Header
    MessageHeader header
      = MessageHeader.CreateHeader(
      "Security",
      "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd",
      token.GetXml(new XmlDocument())
    );

    OperationContext.Current.OutgoingMessageHeaders.Add(header);

    //Build Request
    OrgWS.OrganizationDetailsRequest request = new OrgWS.OrganizationDetailsRequest()
    {
        ID = 1
    };

    //Send Request
    OrgWS.OrganizationDetail[] response = client.getOrganizationDetail(request);

    //Do something with response
}

可以在这里找到完整的解释:http://cxdeveloper.com/article/implementing-ws-security-digest-password-nonce-net-40-wcf