如何传递消息凭据 - TransportWithMessageCredential - SOAP 请求中没有凭据答案

【问题标题】：How to pass message credentials - TransportWithMessageCredential - No credentials in the SOAP request如何传递消息凭据 - TransportWithMessageCredential - SOAP 请求中没有凭据
【发布时间】：2014-04-25 10:13:53
【问题描述】：

我正在使用带有“TransportWithMessageCredential”的 WSBinding 来保护我的 WCF Web 服务，我在使用 .NET 客户端时使用它没有任何问题。

但是当尝试从 Android 或非 .Net 客户端使用它时，我不知道在哪里提供消息凭据！！

我已经截获了 .NET 客户端发送的 SOAP 消息，它不包含任何与凭据相关的内容，但它运行良好，但是当对来自 Android 客户端的 SOAP 请求使用相同的语法时，我们正面临这个错误：

无法处理该消息。这很可能是因为操作“http://tempuri.org/XXX/YYY”不正确或因为消息包含无效或过期的安全上下文令牌或因为绑定之间存在不匹配。安全上下文如果服务因以下原因中止通道，则令牌将无效不活动。防止服务中止空闲会话过早地增加服务端点的接收超时绑定。

.NET 客户端发送的 SOAP 请求被拦截：

<s:Envelope xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:s="http://www.w3.org/2003/05/soap-envelope">
  <s:Header>
    <a:Action s:mustUnderstand="1">http://tempuri.org/XXX/YYY</a:Action>
    <a:MessageID>urn:uuid:XX-XX-XX-XX-XX</a:MessageID>
    <a:ReplyTo>
      <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
    </a:ReplyTo>
  </s:Header>
  <s:Body>
    <XXXXXX xmlns="http://tempuri.org/">
      <request xmlns:d4p1="http://schemas.datacontract.org/2004/07/XXX.XXX.XXX" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
        <d4p1:Prop1 i:nil="true" />
        <d4p1:Prop2 i:nil="true" />
        <d4p1:Prop3 i:nil="true" />
      </request>
    </XXXXXX >
  </s:Body>
</s:Envelope>

我对服务的 WCF 配置：

  <wsHttpBinding>
    <binding name="wsHttpBindingExt" maxReceivedMessageSize="4096000">
      <readerQuotas maxDepth="32" maxStringContentLength="409600" maxArrayLength="4096000" maxBytesPerRead="4096000" />
      <security mode="TransportWithMessageCredential" >
        <message clientCredentialType="UserName"/>
      </security>
    </binding>
  </wsHttpBinding>

对于正常工作的 .NET 客户端：

从 .NET 调用服务并正常工作的客户端代码：

XXXXXServiceClient client = new XXXXXServiceClient ();
client.ClientCredentials.UserName.UserName = "XXXX";
client.ClientCredentials.UserName.Password = "YYYY";
var res = client.DoXXXXX(a,b,c);

编辑

确实存在，拦截器没有给我整个请求，但我还有另一个问题。

使用fiddler，我发现有两个请求，第一个是请求安全令牌：

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <s:Header>
        <a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT</a:Action>
        <a:MessageID>urn:uuid:b7c8d134-ec01-48cd-abb6-81988e7270b1</a:MessageID>
        <a:ReplyTo>
            <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
        </a:ReplyTo>
        <a:To s:mustUnderstand="1">https://XXX.XXX.com/XXX.svc</a:To>
        <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <u:Timestamp u:Id="_0">
                <u:Created>2014-04-25T10:31:13.686Z</u:Created>
                <u:Expires>2014-04-25T10:36:13.686Z</u:Expires>
            </u:Timestamp>
            <o:UsernameToken u:Id="uuid-4d51d9cc-f621-48af-96a7-1fa541c18ea1-1">
                <o:Username>XXX</o:Username>
                <o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">YYY</o:Password>
            </o:UsernameToken>
        </o:Security>
    </s:Header>
    <s:Body>
        <t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
            <t:TokenType>http://schemas.xmlsoap.org/ws/2005/02/sc/sct</t:TokenType>
            <t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType>
            <t:Entropy>
                <t:BinarySecret u:Id="uuid-c32043fe-d4fb-4802-b15a-ba2691c2b3d8-1" Type="http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce">XXXXXXXXXXXXXXXXXXXXXXXXX</t:BinarySecret>
            </t:Entropy>
            <t:KeySize>256</t:KeySize>
        </t:RequestSecurityToken>
    </s:Body>
</s:Envelope>

而这个请求的响应是：

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <s:Header>
        <a:Action s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT</a:Action>
        <a:RelatesTo>urn:uuid:b7c8d134-ec01-48cd-abb6-81988e7270b1</a:RelatesTo>
        <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <u:Timestamp u:Id="_0">
                <u:Created>2014-04-25T10:31:02.106Z</u:Created>
                <u:Expires>2014-04-25T10:36:02.106Z</u:Expires>
            </u:Timestamp>
        </o:Security>
    </s:Header>
    <s:Body>
        <t:RequestSecurityTokenResponse xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
            <t:TokenType>http://schemas.xmlsoap.org/ws/2005/02/sc/sct</t:TokenType>
            <t:RequestedSecurityToken>
                <c:SecurityContextToken u:Id="uuid-67a62dc5-2ce5-45d2-af88-371d06243652-8" xmlns:c="http://schemas.xmlsoap.org/ws/2005/02/sc">
                    <c:Identifier>urn:uuid:e2562052-1de3-496d-b455-e36958692176</c:Identifier>
                </c:SecurityContextToken>
            </t:RequestedSecurityToken>
            <t:RequestedAttachedReference>
                <o:SecurityTokenReference xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
                    <o:Reference ValueType="http://schemas.xmlsoap.org/ws/2005/02/sc/sct" URI="#uuid-67a62dc5-2ce5-45d2-af88-371d06243652-8"/>
                </o:SecurityTokenReference>
            </t:RequestedAttachedReference>
            <t:RequestedUnattachedReference>
                <o:SecurityTokenReference xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
                    <o:Reference URI="urn:uuid:e2562052-1de3-496d-b455-e36958692176" ValueType="http://schemas.xmlsoap.org/ws/2005/02/sc/sct"/>
                </o:SecurityTokenReference>
            </t:RequestedUnattachedReference>
            <t:RequestedProofToken>
                <t:ComputedKey>http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1</t:ComputedKey>
            </t:RequestedProofToken>
            <t:Entropy>
                <t:BinarySecret u:Id="uuid-67a62dc5-2ce5-45d2-af88-371d06243652-9" Type="http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce">JrVuueyiE55P172GX97vM3KM/oo26pN71wQ4B4C5dbo=</t:BinarySecret>
            </t:Entropy>
            <t:Lifetime>
                <u:Created>2014-04-25T10:31:02.106Z</u:Created>
                <u:Expires>2014-04-26T01:31:02.106Z</u:Expires>
            </t:Lifetime>
            <t:KeySize>256</t:KeySize>
        </t:RequestSecurityTokenResponse>
    </s:Body>
</s:Envelope>

然后，我可以在第二个主要请求的响应中使用这些信息：

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <s:Header>
        <a:Action s:mustUnderstand="1">http://tempuri.org/XXX/YYY</a:Action>
        <a:MessageID>urn:uuid:e2ec7944-a6b8-46f1-b021-270cea67c205</a:MessageID>
        <a:ReplyTo>
            <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
        </a:ReplyTo>
        <a:To s:mustUnderstand="1">https://XXXX.YYYY.com/ZZZZ.svc</a:To>
        <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <u:Timestamp u:Id="_0">
                <u:Created>2014-04-25T10:31:14.905Z</u:Created>
                <u:Expires>2014-04-25T10:36:14.905Z</u:Expires>
            </u:Timestamp>
            <c:SecurityContextToken u:Id="uuid-67a62dc5-2ce5-45d2-af88-371d06243652-8" xmlns:c="http://schemas.xmlsoap.org/ws/2005/02/sc">
                <c:Identifier>urn:uuid:e2562052-1de3-496d-b455-e36958692176</c:Identifier>
            </c:SecurityContextToken>
            <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
                <SignedInfo>
                    <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/>
                    <Reference URI="#_0">
                        <Transforms>
                            <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </Transforms>
                        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                        <DigestValue>YYYYYYYYYYYYYYYYYYYYYY=</DigestValue>
                    </Reference>
                </SignedInfo>
                <SignatureValue>XXXXXXXXXXXXXXXXXXXXX=</SignatureValue>
                <KeyInfo>
                    <o:SecurityTokenReference>
                        <o:Reference ValueType="http://schemas.xmlsoap.org/ws/2005/02/sc/sct" URI="#uuid-67a62dc5-2ce5-45d2-af88-371d06243652-8"/>
                    </o:SecurityTokenReference>
                </KeyInfo>
            </Signature>
        </o:Security>
    </s:Header>
    <s:Body>
    <XXXXXX xmlns="http://tempuri.org/">
      <request xmlns:d4p1="http://schemas.datacontract.org/2004/07/XXX.XXX.XXX" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
        <d4p1:Prop1 i:nil="true" />
        <d4p1:Prop2 i:nil="true" />
        <d4p1:Prop3 i:nil="true" />
      </request>
    </XXXXXX >
    </s:Body>
</s:Envelope>

这里最大的问题是，在哪里可以找到： BinarySecret、DigestValue、SignatureValue！！！以及其他大量的值和 ID！！！

【问题讨论】：

标签： c# android .net wcf ksoap2

【解决方案1】：

您看到的消息交换是 Ws-SecureConversation。在这里您可以找到这些消息的完整规范：http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/ws-secureconversation-1.3-os.html

您很可能不想在 Android 客户端中实现或使用它，因此您可以通过在消息元素中将建立安全上下文设置为 false 在绑定中禁用它。

【讨论】：