java - wcf 互操作 : No timestamp is available in security header to do replay detection

Question

我正在尝试使用 WCF 调用 Java 服务。该服务发回一条消息，但不会返回我的程序。 WCF 生成:安全 header 中没有可用的时间戳来进行重播检测。

我在Fiddler中抓取了返回的消息，消息体中有一个Timestamp字段。

<?xml version="1.0" encoding="UTF-8"?>

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Header>
<wsse:Security SOAP-ENV:mustUnderstand="1" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="SecurityToken-</wsse:BinarySecurityToken>
<dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
<dsig:SignedInfo>
<dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<dsig:Reference URI="#Id-649325bc-661f-ede4-9ba7-6366c9de792e"><dsig:Transforms>
<dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<dsig:DigestValue>Pm0bbVqKJfz05tPpphXtBJjDyew=</dsig:DigestValue>
</dsig:Reference></dsig:SignedInfo>
<dsig:SignatureValue> *snip*</dsig:SignatureValue>
<dsig:KeyInfo>
<SecurityTokenReference xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:Reference URI="#SecurityToken-65e3d200-a1e1-b453-03f6-dd800869423d" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
</SecurityTokenReference>
</dsig:KeyInfo>
</dsig:Signature>
</wsse:Security>
</SOAP-ENV:Header>

<SOAP-ENV:Body wsu:Id="Id-649325bc-661f-ede4-9ba7-6366c9de792e" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><ns0:ResponseMessage xmlns:ns0="http://www.ercot.com/schema/2007-06/nodal/ews/message"><ns0:Header><ns0:Verb>reply</ns0:Verb><ns0:Noun>BidSet</ns0:Noun><ns0:ReplayDetection><ns0:Nonce>09f359b4ddb89f0a23dd6d05508cc372</ns0:Nonce><ns0:Created>2012-03-08T09:44:16.865-06:00</ns0:Created></ns0:ReplayDetection><ns0:Revision>001</ns0:Revision><ns0:Source>ERCOT</ns0:Source><ns0:UserID>API_EMP327</ns0:UserID><ns0:MessageID>temp</ns0:MessageID>

</ns0:Header><ns0:Reply><ns0:ReplyCode>OK</ns0:ReplyCode><ns0:Timestamp>2012-03-08T09:44:16.865-06:00</ns0:Timestamp></ns0:Reply>

<ns0:Payload>*snip*</ns0:Payload>

我看过: http://social.msdn.microsoft.com/forums/en-US/wcf/thread/3be779e7-1d73-455c-8aa0-cb90026e8993/

并适本地修改了我的配置。添加 securityHeaderLayout="Lax"和

<customBinding>
        <binding name="NodalCustomBinding" closeTimeout="00:01:00" openTimeout="00:01:00"
            receiveTimeout="00:10:00" sendTimeout="00:10:00">
          <textMessageEncoding messageVersion="Soap11" />
          <security
            authenticationMode="MutualCertificate"
            requireDerivedKeys="false"
            includeTimestamp="true"
            securityHeaderLayout="Lax"
             keyEntropyMode="ClientEntropy"
            messageProtectionOrder="SignBeforeEncrypt"
            messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"
            requireSecurityContextCancellation="false"
            allowSerializedSigningTokenOnReply="true"
            enableUnsecuredResponse="true" >
            <secureConversationBootstrap />
            <localClientSettings detectReplays="false"/>
          <localServiceSettings detectReplays="false"/>
          </security>

          <httpsTransport />

我仍然遇到同样的错误。

如有任何帮助，我们将不胜感激!

基思

Answer 1

错误是说 soap 信封 header 中的 wsse:Security 元素中没有时间戳。我看到的 timestamp 元素在 body 元素中，对 ws-security 配置没有适用性。此外，includeTimestamp 属性设置为 true。只是猜测，但您是否尝试过将其设置为 false？