c++ - 身份验证 header 在 ONVIF 请求中不起作用？

Question

我正在用 C 语言编写一个 API，用于使用 ONVIF 验证用户身份。我编写了一些代码来制作身份验证 header 。但是当我发送这些 header 时，他的服务器响应“安全 token 无法进行身份验证或授权”

unsigned int nonce_int = 0, i = 0;
  time_t utcTime = 0;
  struct tm *timeInfo = NULL;
  char sha1_input[100] = { 0 }, sha1_input1[100] = { 0 };
  SHA1Context sha = { 0 };

  nonce_int = GetRandomNumber();
  encode_base64(sizeof(nonce_int), (char*)&nonce_int, nonceLen, noncestr);

  utcTime = time(NULL);
  timeInfo = localtime(&utcTime);
  strftime(timestr, timeLen, "%Y-%m-%dT%H:%M:%SZ", timeInfo);
  printf("\nTime in String Format = %s", timestr);

  sprintf(sha1_input, "%d+%d+%s", nonce_int, utcTime, password);
  strcpy(sha1_input1, sha1_input);

  SHA1Reset(&sha);
  SHA1Input(&sha, (const unsigned char*)sha1_input, strlen(sha1_input));

  if(!SHA1Result(&sha))
  {
    printf("\nERROR-- could not compute message digest");
  }
  else
  {
    memset(sha1_input, 0x00, sizeof(sha1_input));
    /*sprintf(sha1_input, "%X%X%X%X%X", sha.Message_Digest[0], sha.Message_Digest[1],
      sha.Message_Digest[2], sha.Message_Digest[3], sha.Message_Digest[4]);*/

    sprintf(sha1_input, "%u%u%u%u%u", sha.Message_Digest[0], sha.Message_Digest[1],
      sha.Message_Digest[2], sha.Message_Digest[3], sha.Message_Digest[4]);

    printf("\nSHA1 Digest = %s", sha1_input);
    encode_base64(strlen(sha1_input), sha1_input, digestLen, digeststr);
    printf("\nSHA1 Digest Base64 Encoded = %s", digeststr);
  }

之后我使用 POST 方法在 HTTP 上发送了这个请求。

snprintf(postData, sizeof(postData),
      "<?xml version=\"1.0\" encoding=\"utf-8\"?>" 
      "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://www.w3.org/2003/05/soap-envelope\"" 
      "xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401"
      "-wss-wssecurity-secext-1.0.xsd\""  
      "xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-"
      "200401-wss-wssecurity-utility-1.0.xsd\""  
      "xmlns:tds=\"http://www.onvif.org/ver20/ptz/wsdl\">" 
      "<SOAP-ENV:Header><wsse:Security><wsse:UsernameToken>" 
      "<wsse:Username>%s</wsse:Username>" 
      "<wsse:Password Type=\"http://docs.oasis-open.org/wss/2004/01/oasis-"
      "200401-wss-username-token-profile-1.0#PasswordDigest\">"
          "%s</wsse:Password><wsse:Nonce>%s</wsse:Nonce>" 
      "<wsu:Created>%s</wsu:Created></wsse:UsernameToken>"
      "</wsse:Security></SOAP-ENV:Header><SOAP-ENV:Body>" 
      "<tds:GetNodes>" 
      "</SOAP-ENV:Body></SOAP-ENV:Envelope>", 
      username, base64EncDigest, nonce_char, time_char);

回应:

<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope  xmlns:SOAP-ENV="http://www.w3.org/2003/05/soap-envelope" 
                    xmlns:SOAP-ENC="http://www.w3.org/2003/05/soap-encoding" 
                    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
                    xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
                    xmlns:wsa5="http://www.w3.org/2005/08/addressing" 
                    xmlns:c14n="http://www.w3.org/2001/10/xml-exc-c14n#" 
                    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" 
                    xmlns:ds="http://www.w3.org/2000/09/xmldsig#" 
                    xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" 
                    xmlns:ptzimg2="http://www.onvif.org/ver10/schema" 
                    xmlns:ptzimg3="http://www.w3.org/2005/05/xmlmime" 
                    xmlns:ptzimg4="http://docs.oasis-open.org/wsn/b-2" 
                    xmlns:ptzimg5="http://docs.oasis-open.org/wsrf/bf-2" 
                    xmlns:ptzimg6="http://docs.oasis-open.org/wsn/t-1" 
                    xmlns:ptzimg1="http://www.onvif.org/ver20/ptz/wsdl" 
                    xmlns:ptzimg7="http://www.onvif.org/ver20/imaging/wsdl" 
                    xmlns:ter="http://www.onvif.org/ver10/error">

    <SOAP-ENV:Header></SOAP-ENV:Header>
    <SOAP-ENV:Body>
        <SOAP-ENV:Fault>
            <SOAP-ENV:Code>
                <SOAP-ENV:Value>
                    SOAP-ENV:Sender
                </SOAP-ENV:Value>
                <SOAP-ENV:Subcode>
                    <SOAP-ENV:Value>
                        wsse:FailedAuthentication
                    </SOAP-ENV:Value>
                </SOAP-ENV:Subcode>
            </SOAP-ENV:Code>
            <SOAP-ENV:Reason>
                <SOAP-ENV:Text xml:lang="en">
                    The security token could not be authenticated or authorized
                </SOAP-ENV:Text>
            </SOAP-ENV:Reason>
            <SOAP-ENV:Node>
                http://www.w3.org/2003/05/soap-envelope/node/ultimateReceiver
            </SOAP-ENV:Node>
            <SOAP-ENV:Role>
                http://www.w3.org/2003/05/soap-envelope/role/ultimateReceiver
            </SOAP-ENV:Role>
            <SOAP-ENV:Detail></SOAP-ENV:Detail>
        </SOAP-ENV:Fault>
    </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

我做错了什么吗？特别是在创建摘要时？谢谢

Answer 1

检查设备时间。假设您生成正确的密码摘要，则可能会出现问题，因为设备的时间与您用于签署请求的时间不同，然后密码摘要可能会表现得像已过期。