WCF 客户端 - 指定 WS-Security Timestamp 签名的签名算法

Posted

技术标签:

【中文标题】WCF 客户端 - 指定 WS-Security Timestamp 签名的签名算法【英文标题】:WCF Client - Specifying the signature algorithm for WS-Security Timestamp signature 【发布时间】:2012-03-11 02:30:33 【问题描述】:

我有一个 WCF 客户端正在向非 WCF 服务发送消息,并且该服务在处理用于签署 WS-Security Timestamp 元素的 HMAC-SHA1 签名方法时遇到问题。理想情况下,我们希望使用 RSA-SHA1 签名方法,但我无法让 WCF 使用该签名方法。

我使用的绑定是自定义绑定,它允许我通过 HTTPS 发送 SAML 2.0 令牌:

<customBinding>
    <!-- This binding is a WS2007FederationHttpBinding without Secure Sessions that uses Text message encoding. -->
    <binding
        name="WS2007FederationHttpBinding_NoSecureSession_Text"
        closeTimeout="00:01:00"
        openTimeout="00:01:00"
        receiveTimeout="00:10:00"
        sendTimeout="00:01:00">
        <security
            authenticationMode="IssuedTokenOverTransport"
            requireSignatureConfirmation="true"
            securityHeaderLayout="Lax"
            messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"
            keyEntropyMode="CombinedEntropy"
            includeTimestamp="true">
            <issuedTokenParameters
                tokenType="urn:oasis:names:tc:SAML:2.0:assertion">
                <!-- This describes the STS. That is, the URL, the binding to use, and its Identity -->
                <issuer
                    address="http://hostname//STS.svc"
                    binding="ws2007HttpBinding"
                    bindingConfiguration="StsUserNameBindingConfiguration">
                    <identity>
                        <!-- This is the certificate used for signing on the STS. -->
                        <!-- Replace "sts-signing-certificate-thumbprint" with the actual thumbprint of the STS's signing certificate -->
                        <certificateReference
                            findValue="sts-signing-certificate-thumbprint"
                            storeLocation="LocalMachine"
                                storeName="My"
                                x509FindType="FindByThumbprint"/>
                    </identity>
                </issuer>
            </issuedTokenParameters>

            <!-- This basically says "Don't use Secure Conversation" -->
            <secureConversationBootstrap/>
        </security>

        <!-- Use Text Encoding -->
        <textMessageEncoding/>

        <!-- This says to use HTTPS when communicating with the remote service -->
        <httpsTransport
            requireClientCertificate="true"
            maxBufferPoolSize="134217728"
            maxReceivedMessageSize="134217728"
            maxBufferSize="134217728"/>
    </binding>
</customBinding>

传出请求中的签名如下所示:

<Signature
    xmlns="http://www.w3.org/2000/09/xmldsig#">
    <SignedInfo>
        <CanonicalizationMethod
            Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
        <SignatureMethod
            Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/>
        <Reference
            URI="#_0">
            <Transforms>
                <Transform
                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            </Transforms>
            <DigestMethod
                Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
            <DigestValue>GZfW1RkyS4DHYFPHRnRuqNSo+qE=</DigestValue>
        </Reference>
    </SignedInfo>
    <SignatureValue>rMzQ/kEV7AXcO3wm9hfQXNoX5r4=</SignatureValue>
    <KeyInfo>
        <o:SecurityTokenReference
            b:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"
            xmlns:b="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd">
            <o:KeyIdentifier
                ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID">_9f79359e-63dc-4e38-888c-6567dac4b41b</o:KeyIdentifier>
        </o:SecurityTokenReference>
    </KeyInfo>
</Signature>

注意&lt;SignatureMethod&gt; 是http://www.w3.org/2000/09/xmldsig#hmac-sha1

一个有趣的事情是 HMAC-SHA1 算法是对称的(一个密钥来加密和解密),而 RSA-SHA1 是不对称的(需要一个密钥来加密和一个解密)。我认为 WCF 使用 HMAC-SHA1 算法,因为它是对称的,并且正在交换的 SAML 令牌是共享密钥(密钥)。使用 SAML 令牌作为对称算法的共享密钥是有意义的,但是否有可用选项强制 WCF 使用 RSA-SHA1 等非对称算法?

我已经能够通过更改 binding/security/defaultAlgorithmSuite 属性对签名方法进行一些细微的修改,但是各种选项无法让我在此处指定 RSA-SHA1:

defaultAlgorithm = 默认值:

&lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/&gt; &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;

defaultAlgorithm = Basic256:

&lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/&gt; &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;

defaultAlgorithm = Basic256Rsa15:

&lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/&gt; &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;

defaultAlgorithm = Basic256Sha256:

&lt;SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#hmac-sha256"/&gt; &lt;DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/&gt;

defaultAlgorithm = Basic256Sha256Rsa15:

&lt;SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#hmac-sha256"/&gt; &lt;DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/&gt;

有没有办法强制 WCF 在时间戳签名上使用 RSA-SHA1?

【问题讨论】:

【参考方案1】:

我认为这是一个互操作性问题。下面的链接也有类似的问题。

http://www.fokkog.com/2011/01/ws-security-interoperability-issue.html

您可以手动创建和签署令牌。检查这个帖子:

How to make WCF Client conform to specific WS-Security - sign UsernameToken and SecurityTokenReference

【讨论】:

以上是关于WCF 客户端 - 指定 WS-Security Timestamp 签名的签名算法的主要内容,如果未能解决你的问题,请参考以下文章

WCF 客户端使用 WS-Security UsernameToken PasswordDigest 身份验证方案使用 Axis 2 Web 服务时出错

WCF SOAP 1.1 和 WS-Security 1.0、客户端证书传输身份验证、消息正文签名的服务证书、用户名令牌、密码摘要、随机数

WCF客户端 - EncryptedKey子句未包含所需的加密令牌

SSL/TLS原理详解与WCF中的WS-Security

WCF系列 - WCF安全系列 - basicHttpBinding

WCF 消息安全证书