wcf - 在 WCF 客户端中，如何将 SAML 2.0 断言添加到 SOAP header ？

Question

我正在尝试从下面的 soap header 示例中添加 saml 2.0 断言节点 - 我遇到了 samlassertion在 .net 框架中输入，但看起来它仅适用于 saml 1.1。

<S:Header>
    <To xmlns="http://www.w3.org/2005/08/addressing">https://rs1.greenwaymedical.com:8181/CONNECTGateway/EntityService/NhincProxyXDRRequestSecured</To>
    <Action xmlns="http://www.w3.org/2005/08/addressing">tns:ProvideAndRegisterDocumentSet-bRequest_Request</Action>
    <ReplyTo xmlns="http://www.w3.org/2005/08/addressing">
        <Address>http://www.w3.org/2005/08/addressing/anonymous</Address>
    </ReplyTo>
    <MessageID xmlns="http://www.w3.org/2005/08/addressing">uuid:662ee047-3437-4781-a8d2-ee91bc940ef0</MessageID>
    <wsse:Security S:mustUnderstand="1">
        <wsu:Timestamp xmlns:ns17="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512"
                       xmlns:ns16="http://www.w3.org/2003/05/soap-envelope"
                       wsu:Id="_1">
            <wsu:Created>2010-05-26T03:51:57Z</wsu:Created>
            <wsu:Expires>2010-05-26T03:56:57Z</wsu:Expires>
        </wsu:Timestamp>
        <saml2:Assertion xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
                         xmlns:exc14n="http://www.w3.org/2001/10/xml-exc-c14n#"
                         xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                         xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                         xmlns:xs="http://www.w3.org/2001/XMLSchema"
                         ID="bd1ecf8d-a6d8-488d-9183-a11227c6a219"
                         IssueInstant="2010-05-26T03:51:57.959Z"
                         Version="2.0">
            <saml2:Issuer Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">CN=SAML User,OU=SU,O=SAML User,L=Los Angeles,ST=CA,C=US</saml2:Issuer>
            <saml2:Subject>
                <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">UID=kskagerb</saml2:NameID>
                <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key">
                    <saml2:SubjectConfirmationData>
                        <ds:KeyInfo>
                            <ds:KeyValue>
                                <ds:RSAKeyValue>
                                    <ds:Modulus>p4jUkEUg..gwO7U=</ds:Modulus>
                                    <ds:Exponent>AQAB</ds:Exponent>
                                </ds:RSAKeyValue>
                            </ds:KeyValue>
                        </ds:KeyInfo>
                    </saml2:SubjectConfirmationData>
                </saml2:SubjectConfirmation>
            </saml2:Subject>
            <saml2:AuthnStatement AuthnInstant="2009-04-16T13:15:39.000Z"
                                  SessionIndex="987">
                <saml2:SubjectLocality Address="158.147.185.168"
                                       DNSName="cs.myharris.net"/>
                <saml2:AuthnContext>
                    <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:X509</saml2:AuthnContextClassRef>
                </saml2:AuthnContext>
            </saml2:AuthnStatement>
            <saml2:AttributeStatement>
                <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:subject-id">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">Karl S Skagerberg</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:organization">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">InternalTest2</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:organization-id">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">2.2</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:nhin:names:saml:homeCommunityId">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">2.16.840.1.113883.3.441</saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xacml:2.0:subject:role">
                    <saml2:AttributeValue>
                        <hl7:Role xmlns:hl7="urn:hl7-org:v3"
                                  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                  code="307969004"
                                  codeSystem="2.16.840.1.113883.6.96"
                                  codeSystemName="SNOMED_CT"
                                  displayName="Public Health"
                                  xsi:type="hl7:CE"/>
                    </saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xspa:1.0:subject:purposeofuse">
                    <saml2:AttributeValue>
                        <hl7:PurposeForUse xmlns:hl7="urn:hl7-org:v3"
                                           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                           code="PUBLICHEALTH"
                                           codeSystem="2.16.840.1.113883.3.18.7.1"
                                           codeSystemName="nhin-purpose"
                                           displayName="Use or disclosure of Psychotherapy Notes"
                                           xsi:type="hl7:CE"/>
                    </saml2:AttributeValue>
                </saml2:Attribute>
                <saml2:Attribute Name="urn:oasis:names:tc:xacml:2.0:resource:resource-id">
                    <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                          xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                          ns6:type="ns7:string">500000000^^^&amp;1.1&amp;ISO</saml2:AttributeValue>
                </saml2:Attribute>
            </saml2:AttributeStatement>
            <saml2:AuthzDecisionStatement Decision="Permit"
                                          Resource="https://158.147.185.168:8181/SamlReceiveService/SamlProcessWS">
                <saml2:Action Namespace="urn:oasis:names:tc:SAML:1.0:action:rwedc">Execute</saml2:Action>
                <saml2:Evidence>
                    <saml2:Assertion ID="40df7c0a-ff3e-4b26-baeb-f2910f6d05a9"
                                     IssueInstant="2009-04-16T13:10:39.093Z"
                                     Version="2.0">
                        <saml2:Issuer Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">CN=SAML User,OU=Harris,O=HITS,L=Melbourne,ST=FL,C=US</saml2:Issuer>
                        <saml2:Conditions NotBefore="2009-04-16T13:10:39.093Z"
                                          NotOnOrAfter="2009-12-31T12:00:00.000Z"/>
                        <saml2:AttributeStatement>
                            <saml2:Attribute Name="AccessConsentPolicy"
                                             NameFormat="http://www.hhs.gov/healthit/nhin">
                                <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                                      xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                                      ns6:type="ns7:string">Claim-Ref-1234</saml2:AttributeValue>
                            </saml2:Attribute>
                            <saml2:Attribute Name="InstanceAccessConsentPolicy"
                                             NameFormat="http://www.hhs.gov/healthit/nhin">
                                <saml2:AttributeValue xmlns:ns6="http://www.w3.org/2001/XMLSchema-instance"
                                                      xmlns:ns7="http://www.w3.org/2001/XMLSchema"
                                                      ns6:type="ns7:string">Claim-Instance-1</saml2:AttributeValue>
                            </saml2:Attribute>
                        </saml2:AttributeStatement>
                    </saml2:Assertion>
                </saml2:Evidence>
            </saml2:AuthzDecisionStatement>
            <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:SignedInfo>
                    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                    <ds:Reference URI="#bd1ecf8d-a6d8-488d-9183-a11227c6a219">
                        <ds:Transforms>
                            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </ds:Transforms>
                        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <ds:DigestValue>ONbZqPUyFVPMx4v9vvpJGNB4cao=</ds:DigestValue>
                    </ds:Reference>
                </ds:SignedInfo>
                <ds:SignatureValue>Dm/aW5bB..pF93s=</ds:SignatureValue>
                <ds:KeyInfo>
                    <ds:KeyValue>
                        <ds:RSAKeyValue>
                            <ds:Modulus>p4jUkEU..bzqgwO7U=</ds:Modulus>
                            <ds:Exponent>AQAB</ds:Exponent>
                        </ds:RSAKeyValue>
                    </ds:KeyValue>
                </ds:KeyInfo>
            </ds:Signature>
        </saml2:Assertion>
        <ds:Signature xmlns:ns17="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512"
                      xmlns:ns16="http://www.w3.org/2003/05/soap-envelope"
                      Id="_2">
            <ds:SignedInfo>
                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                    <exc14n:InclusiveNamespaces PrefixList="wsse S"/>
                </ds:CanonicalizationMethod>
                <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
                <ds:Reference URI="#_1">
                    <ds:Transforms>
                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                            <exc14n:InclusiveNamespaces PrefixList="wsu wsse S"/>
                        </ds:Transform>
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                    <ds:DigestValue>
                        <Include xmlns="http://www.w3.org/2004/08/xop/include"
                                 href="cid:67585ea9-1bec-46d3-a49f-95c8d0334ead@example.jaxws.sun.com"/>
                    </ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue>
                <Include xmlns="http://www.w3.org/2004/08/xop/include"
                         href="cid:cc7fbcca-b325-4265-a10e-76982b2c7bf7@example.jaxws.sun.com"/>
            </ds:SignatureValue>
            <ds:KeyInfo>
                <wsse:SecurityTokenReference wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0">
                    <wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID">bd1ecf8d-a6d8-488d-9183-a11227c6a219</wsse:KeyIdentifier>
                </wsse:SecurityTokenReference>
            </ds:KeyInfo>
        </ds:Signature>
    </wsse:Security>
</S:Header>

我已经研究了好几天，似乎无法在 WCF 中找到一种直接的方法。 Web 服务在 Glassfish 上运行，并且是 soap 1.1，我尝试使用所有打包的 wcf 绑定(bind)，但无法让它们工作。我开始使用 MessageInspector，并写了一个，但后来意识到必须有更好的方法，WCF 确实提供了一些插入 saml 2.0 断言的方法。我在编写自定义绑定(bind)方面取得了最大的进展——我已经能够在soap header 中获取时间戳和签名节点，但我一生都无法弄清楚 saml 断言。有任何想法吗？

public static System.ServiceModel.Channels.Binding BuildCONNECTCustomBinding()
{
    TransportSecurityBindingElement transportSecurityBindingElement = SecurityBindingElement.CreateCertificateOverTransportBindingElement(MessageSecurityVersion.WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10);
    TextMessageEncodingBindingElement textMessageEncodingBindingElement = new TextMessageEncodingBindingElement(MessageVersion.Soap11WSAddressing10, System.Text.Encoding.UTF8);
    HttpsTransportBindingElement httpsTransportBindingElement = new HttpsTransportBindingElement();
    SecurityTokenReferenceType securityTokenReference = new SecurityTokenReferenceType();

    BindingElementCollection bindingElementCollection = new BindingElementCollection();
    bindingElementCollection.Add(transportSecurityBindingElement);
    bindingElementCollection.Add(textMessageEncodingBindingElement);
    bindingElementCollection.Add(httpsTransportBindingElement); 

    CustomBinding cb = new CustomBinding(bindingElementCollection);
    cb.CreateBindingElements();

    return cb;
}

Answer 1

虽然我还没有找到完整的解决方案，但我相信我已经找到了正确的道路。我需要按照 this Microsoft documentation 创建自定义安全 token .我开始列出下面的链接列表，这些链接对我很有帮助，希望它们为面临同样挑战的其他人提供指导。

引用链接:

.NET SAML 2.0 implementation .

How to use SAML 2.0 Assertions with WS2007HttpBinding (i.e. without relying on a Security Token Service to provide tokens)?

WCF Authentication with custom ClientCredentials: What is the clientCredentialType to use?

Need advise on how to sign request's soap body using WCF