.net - WS 安全 header 无效 - IRS ACA SOAP 请求

Question

我正在向 IRS 提交 RequestSubmissionStatusDetail 请求。

这是我的问题。向 IRS 提交以下文档时，我总是收到“无效的 WS 安全 header ”。我不知道我的请求的哪一部分是导致这次提交不成功的原因。

我指的是 following PDF (example code starts on page 35) :

我已经用 VB 和 C# 编写了代码。我用 Fiddler 截获了请求，还使用 ​​Altova XMLSpy 将原始 XML 请求发送到 IRS 端点。

这是代码，几乎是从 PDF 中逐行提取的，减去 key 和 TCC。

    POST https://la.www4.irs.gov/airp/aca/a2a/1095BC_Status_Request_AATS2016 HTTP/1.1
    Content-Type: text/xml; charset=utf-8
    VsDebuggerCausalityData: uIDPo1urdU71mo5BnU/TZ/Ji3p0AAAAAddUwh6B4CU6+F/jOewcN7JE6Ql8n+R1PofxFBfDEEg4ACQAA
    SOAPAction: "RequestSubmissionStatusDetail"
    Host: la.www4.irs.gov
    Content-Length: 4044
    Expect: 100-continue
    Accept-Encoding: gzip, deflate
    Connection: Keep-Alive

    <soapenv:Envelope xmlns:oas1="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:us:gov:treasury:irs:msg:irstransmitterstatusrequest" xmlns:urn1="urn:us:gov:treasury:irs:ext:aca:air:7.0" xmlns:urn2="urn:us:gov:treasury:irs:common" xmlns:urn3="urn:us:gov:treasury:irs:msg:acasecurityheader">  
        <soapenv:Header xmlns:wsa="http://www.w3.org/2005/08/addressing">   
            <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">    
                <ds:Signature Id="SIG-82E7E6716E615C14D6144736030986660" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">     
                    <ds:SignedInfo>      
                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments" />      
                        <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />      
                        <ds:Reference URI="#TS-82E7E6716E615C14D6144736030986559">       
                            <ds:Transforms>        
                                <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> 
                                    <InclusiveNamespaces PrefixList="wsse wsa oas1 soapenv urn urn1 urn2 urn3" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" />                                       
                                </ds:Transform>       
                            </ds:Transforms>       
                            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />       
                            <ds:DigestValue>sgPiL73lIwOppVKHHUFkuWDEcLM=</ds:DigestValue>
                            <!-- DigestValue from Timestamp -->                 
                        </ds:Reference>      
                        <ds:Reference URI="#id-82E7E6716E615C14D6144736030986558">       
                            <ds:Transforms>        
                                <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> 
                                    <InclusiveNamespaces PrefixList="wsa oas1 soapenv urn1 urn2 urn3" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" />        
                                </ds:Transform>       
                            </ds:Transforms>       
                            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />       
                            <ds:DigestValue>S3OdSc3rZ8V1egoyPGzi31n8gq8=</ds:DigestValue>        
                            <!-- DigestValue from ACABusinessHeader -->                      
                        </ds:Reference>      
                        <ds:Reference URI="#id-82E7E6716E615C14D6144736030986559">       
                            <ds:Transforms>        
                                <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">         
                                    <InclusiveNamespaces PrefixList="oas1 soapenv urn1 urn2 urn3" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" />        
                                </ds:Transform>       
                            </ds:Transforms>       
                            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />       
                            <ds:DigestValue>wOSkrI5NmQ5i5/wgjNEIoNODy+A=</ds:DigestValue>       
                            <!-- DigestValue from ACABulkRequestTransmitterStatusDetailRequest -->      
                        </ds:Reference>     
                    </ds:SignedInfo>    
                    <ds:SignatureValue>ddLCWffcBk5/PxqnJLMUM9lWWYWX7ucKQ4vPvM/qEj9IkJ0SVDytcjn0Az9Cge0nxOHI0NWCtAzbWzcUjHtUgt8A4rnxTTShQbIP3hPIX5UghS/Y6OEvOq8RvXL1S3R8nhX/nPrQSoPq6SpEz2HKq/ST5OrsstMvSpM0hCCinEKeLmLqkjfZw5wZVEeNwQIjghcsqQe7Q9crYhgdDwuvtixcoLw0JCgCiMr9yCmFsV4X+CklPuu4/bMUcuipE5fnSpqoZ6Sxp+UFlF3yzMXH6hKFRO7LRsXtwStN1kBwPJW5iPZ6b+X0Zlrc7gYTg1dHi3kcm3gLCRQ9ou+fZa7jnQ==</ds:SignatureValue>    
                    <ds:KeyInfo Id="KI-82E7E6716E615C14D6144736030986456">    
                        <wsse:SecurityTokenReference wsu:Id="STR-82E7E6716E615C14D6144736030986457">    
                            <wsse:KeyIdentifier  EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile1.0#X509v3">
                                removed
                            </wsse:KeyIdentifier>      
                        </wsse:SecurityTokenReference>     
                    </ds:KeyInfo>    
                </ds:Signature>    
                <wsu:Timestamp wsu:Id="TS-82E7E6716E615C14D6144736030985954">     
                    <wsu:Created>2016-01-07T20:31:49.859Z</wsu:Created>     
                    <wsu:Expires>2016-01-07T23:01:49.859Z</wsu:Expires>    
                </wsu:Timestamp>    
            </wsse:Security>   
            <urn:ACABusinessHeader wsu:Id="id-82E7E6716E615C14D6144736030986558"    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">    
                <urn1:UniqueTransmissionId>d4121eb6-29e8-4ebe-a485-0b2bf55fcb67:SYS12:XXXXX::T</urn1:UniqueTransmissionId>    
                <urn2:Timestamp>2016-01-07T15:31:49Z</urn2:Timestamp>   
            </urn:ACABusinessHeader>   
            <urn3:ACASecurityHeader />   
            <wsa:Action>RequestSubmissionStatusDetail</wsa:Action>  
        </soapenv:Header>  
        <soapenv:Body>   
            <urn:ACABulkRequestTransmitterStatusDetailRequest    version="1.0" wsu:Id="id-82E7E6716E615C14D6144736030986559"    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">    
            <urn1:ACABulkReqTrnsmtStsReqGrpDtl>     
                <urn2:ReceiptId>1094B-15-99700283</urn2:ReceiptId>    
            </urn1:ACABulkReqTrnsmtStsReqGrpDtl>   
            </urn:ACABulkRequestTransmitterStatusDetailRequest>  
        </soapenv:Body> 
    </soapenv:Envelope>             

Answer 1

听起来我们走在同一条路上；也许我们可以互相帮助。

我最终通过配置来实现安全性:

<security 
    enableUnsecuredResponse="true" 
    authenticationMode="MutualCertificate" 
    messageSecurityVersion="WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10"
 />

您还需要使用您的证书颁发给谁来覆盖端点的身份 DNS 值。把它放进你的 <endpoint>标签

<identity>
  <dns value="[Issued To]" />
</identity>

最后，在创建客户端时，需要使用 ChannelFactory并设置适当的凭据。我的看起来像这样:

var factory = new ChannelFactory<BulkRequestTransmitterPortType>("BulkRequestTransmitterPort");
factory.Credentials.ClientCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.My, X509FindType.FindByThumbprint, "3164c4510490d2c0f16f1e4cffd76b708964fa7c");
factory.Credentials.ServiceCertificate.SetDefaultCertificate(StoreLocation.LocalMachine, StoreName.My, X509FindType.FindByThumbprint, "3164c4510490d2c0f16f1e4cffd76b708964fa7c");
var client = factory.CreateChannel();

如果您遇到其他问题，请告诉我。假设您的证书和应用程序状态正常，那么一旦您完成此操作，您可能会被我困在下一步(正确的 MTOM 编码)。如果你成功通过，请让我知道:)