请帮忙: 供应商需要一个签名的 xml，并且没有提供太多帮助来描述如何正确地对 xml 进行签名。我正在发送以下 xml:

<SOAP-ENV:Envelope xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/03/addressing" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Header><wsse:Security SOAP-ENV:mustUnderstand="1" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><wsse:SecurityTokenReference Id="_2"><wsse:Reference URI="#binarytoken" /></wsse:SecurityTokenReference></ds:KeyInfo><wsse:BinarySecurityToken EncodingType="wsse:Base64Binary" ValueType="wsse:X509v3" wsu:Id="binarytoken">removed for security</wsse:BinarySecurityToken><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><Reference URI="#_2"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><DigestValue>b3U301pqu017IPMBNIZ04dybZ+A=</DigestValue></Reference><Reference URI="#_1"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><DigestValue>NLpGjn8jJ7RI/R4rVdiwZPRRyMU=</DigestValue></Reference></SignedInfo><SignatureValue>some signed value here</SignatureValue></Signature></wsse:Security></SOAP-ENV:Header><SOAP-ENV:Body wsu:Id="_1"><msg:CompanyMessage xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/03/addressing" xmlns:msg="companyNameSpace"><msg:Header><msg:Verb>get</msg:Verb><msg:Noun>CompanyFunction</msg:Noun><msg:Revision>1</msg:Revision><msg:Source>COMPANY</msg:Source><msg:UserID>USER</msg:UserID><msg:MessageID>123456789</msg:MessageID><msg:ReplayDetection><wsu:Created>2018-07-27T02:20:39-05:00</wsu:Created><wsse:Nonce>65b9a415-19d9-4090-8520-e1de12cc9721</wsse:Nonce></msg:ReplayDetection></msg:Header></msg:CompanyMessage></SOAP-ENV:Body></SOAP-ENV:Envelope>

并且我收到一条错误消息，指出存在肥皂故障 SECU3504:数字签名验证失败。 ds:Signed Info 签名的有效性:java.lang.NullPointerException。签名引用的有效性:#_2:正确。 #_1:错误。

看起来我引用信封正文 Id="_1"的方式有问题。

这是我在 header 中创建正文和安全 token 引用后用于对 xml 进行签名的 C# 代码。

        SignedXmlWithId signedXml = new SignedXmlWithId(doc);

        signedXml.SignedInfo.SignatureMethod = "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
        RSACryptoServiceProvider rsaKey = (RSACryptoServiceProvider)cert.PrivateKey;
        signedXml.SigningKey = rsaKey;
        signedXml.SignedInfo.CanonicalizationMethod = SignedXml.XmlDsigExcC14NTransformUrl;

        Reference CertRefSign = new Reference { Uri = "#" + SecurityTokenReference };
        CertRefSign.DigestMethod = "http://www.w3.org/2000/09/xmldsig#sha1";
        CertRefSign.AddTransform(new XmlDsigExcC14NTransform());
        signedXml.AddReference(CertRefSign);

        Reference BodySign = new Reference { Uri = "#" + EnvelopeBodyId };
        BodySign.DigestMethod = "http://www.w3.org/2000/09/xmldsig#sha1";
        BodySign.AddTransform(new XmlDsigExcC14NTransform());
        signedXml.AddReference(BodySign);

        signedXml.ComputeSignature();

        XmlElement signedElement = signedXml.GetXml();
        ErcotHeaderSecurityXml.AppendChild(signedElement);

非常感谢任何帮助。

最佳答案

当我在一家电信运营商工作时，我们有类似的服务使用需要签名的 WS-Security。当我需要测试这些服务时，我遇到了同样的问题。当然，我们的合作伙伴也对使用这些服务感到痛苦。

最后，我通过使用 WCF(您至少需要 .NET Framework 4.0)让它工作:

第一步，您需要从提供的 WSDL 中导入 Web 服务描述，并对生成的代码进行以下更改:

您必须将 ProtectionLevel = System.Net.Security.ProtectionLevel.Sign 添加到 ServiceContratAttribute 以告知 WCF 您需要对其进行签名:

[System.ServiceModel.ServiceContractAttribute(ProtectionLevel = System.Net.Security.ProtectionLevel.Sign, Namespace="http://ServiceProvider.someTelecom.fr/Services/Payment "
public interface GetPaymentPortType
{
…
}

然后你应该在 app.config 中使用以下 customBinding

   <customBinding>
    <binding name="HTTPBinding_WSSecurity">
     <security enableUnsecuredResponse="true" authenticationMode="MutualCertificate"
      messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"
      requireSignatureConfirmation="false">
      <localClientSettings maxClockSkew="00:10:00" />
      <localServiceSettings maxClockSkew="00:10:00" />
      <secureConversationBootstrap />
     </security>
     <textMessageEncoding messageVersion="Soap11" />
     <httpTransport />
    </binding>
    </customBinding>

最后，在调用网络服务之前，您还需要加载您的客户端证书(遵循 .pfx 格式的代码)以便对 soap 消息进行签名。

//Load the signature certificate
X509Certificate2 mycertificate = new X509Certificate2("SignatureCertificate.pfx", "[pfx protection password]");

//Create the wcf client from the given binding
MyServicePortTypeClient client = new MyServicePortTypeClient("HTTPBinding_WSSecurity");
client.Endpoint.Address = new System.ServiceModel.EndpointAddress(new Uri("http://xxxxxx/myService"), EndpointIdentity.CreateDnsIdentity("dns_name"));
//set the client ceritificate
client.ClientCredentials.ClientCertificate.Certificate = mycertificate;
//Call the service
client.Payment(xxx);

奖励: 如果您使用的是自签名证书，请确保该证书可以在您的服务提供商的服务器上进行验证。否则，您应该使用提供商提供的证书。

关于c# - 签名 XML 疑难解答，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/51564855/