WCF 客户端到 WSE 3.0 服务

Question

我尝试为 WSE 3.0 服务创建 WCF 客户端。我已经将 WSE3.0 客户端用于相同的服务。这是它的配置:

 <microsoft.web.services3>
  <security>
   <timeToleranceInSeconds value="10000"/>
   <x509 allowTestRoot="true" verifyTrust="true" storeLocation="CurrentUser"/>
   <binarySecurityTokenManager>
    <add valueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">
     <keyAlgorithm name="RSA15"/>
    </add>
   </binarySecurityTokenManager>
  </security>
 </microsoft.web.services3>

服务客户端的策略是这样创建的:

  MutualCertificate10Assertion assertion = new MutualCertificate10Assertion()
  {
    EstablishSecurityContext = false,
    RenewExpiredSecurityContext = true,
    RequireSignatureConfirmation = false,
    MessageProtectionOrder = MessageProtectionOrder.SignBeforeEncrypt,
    RequireDerivedKeys = false,
    TtlInSeconds = 300
  };

  assertion.ClientX509TokenProvider = new X509TokenProvider(StoreLocation.LocalMachine, StoreName.My, "ClientCerfiticateName", X509FindType.FindBySubjectName);
  assertion.ServiceX509TokenProvider = new X509TokenProvider(StoreLocation.LocalMachine, StoreName.My, "ServiceCerfiticateName", X509FindType.FindBySubjectName);

  //protection
    assertion.Protection.Request.SignatureOptions = SignatureOptions.IncludeAddressing | SignatureOptions.IncludeTimestamp | SignatureOptions.IncludeSoapBody;
    assertion.Protection.Request.EncryptBody = true;

    assertion.Protection.Response.SignatureOptions = SignatureOptions.IncludeAddressing | SignatureOptions.IncludeTimestamp | SignatureOptions.IncludeSoapBody;
    assertion.Protection.Response.EncryptBody = true;

    assertion.Protection.Fault.SignatureOptions = SignatureOptions.IncludeAddressing | SignatureOptions.IncludeTimestamp | SignatureOptions.IncludeSoapBody;
    assertion.Protection.Fault.EncryptBody = false;

  this.Policy = new Policy(new TraceAssertion(serviceUri), assertion, new RequireActionHeaderAssertion()); 

现在我尝试用它来创建 WCF 客户端。我使用了这些建议 ( http://msdn.microsoft.com/en-us/library/ms730299.aspx )。我从服务和客户端契约生成类型，然后创建从 Binding 派生的 WseHttpBinding 类，之后我尝试创建此自定义绑定(bind)并初始化客户端和服务证书:

 string clientCertificateName = "ClientCertificateName";
 string serviceCertificateName = "ServiceCertificateName";

 Uri uri = new Uri("http://WantedService.asmx"));

  EndpointAddress address = new EndpointAddress(uri,
                         EndpointIdentity.CreateDnsIdentity(serviceCertificateName ));

  WseHttpBinding binding = new WseHttpBinding()
  {
    SecurityAssertion = WseSecurityAssertion.MutualCertificate10,
    EstablishSecurityContext = false,
    RequireSignatureConfirmation = false,
    MessageProtectionOrder = MessageProtectionOrder.SignBeforeEncrypt,
    RequireDerivedKeys = false
  };

  WantedServiceClient client = new CreativeGroupCurrencyServiceClient(binding, address);

// Set up certificates      
client.ClientCredentials.ServiceCertificate.SetScopedCertificate(
                             StoreLocation.LocalMachine,
                             StoreName.My,
                             X509FindType.FindBySubjectName,
                             serviceCertificateName , 
                            uri);

  client.ClientCredentials.ClientCertificate.SetCertificate(
                             StoreLocation.LocalMachine,
                             StoreName.My,
                             X509FindType.FindBySubjectName,
                             clientCertificateName);

  WantedMethodResponse response = client.WantedMethod(new GetCurrenciesRequest());

但是出现异常:

System.Xml.XmlException: Cannot read the token from the 'SignatureConfirmation' element with the 'http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd' namespace for BinarySecretSecurityToken, with a '' ValueType. If this element is expected to be valid, ensure that security is configured to consume tokens with the name, namespace and value type specified.

为什么不起作用？为什么方案是1.1？我应该在 MessageSecurityVersion 中使用 WS Secure 1.1 作为安全绑定(bind)元素吗？哪一个？我试过这个:

  WseHttpBinding binding = new WseHttpBinding()
  {
    SecurityAssertion = WseSecurityAssertion.MutualCertificate11,
    ...
  };

哪个使用 WS Security 1.1 - MessageSecurityVersion.WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11(在 WseHttpBinding 中配置时)但它也失败了:

System.ServiceModel.Security.MessageSecurityException: Signature confirmation is not expected in the security header.

我不知道我现在还能做什么!看来我什么都试过了!

Answer 1

根据 this文章msdn有错误article关于 wcf wse 兼容性。特别是关于消息版本。这可能是导致您出现问题的原因。