WCF服务异常：{“无法解析主题密钥标识符”}

Question

我正尝试使用WCF框架与服务进行通信。我唯一可用的安全信息是：

• 密钥标识符类型：二进制安全令牌/ X.509证书
• 签名算法：http://www.w3.org/2000/09/xmldsig#rsa-sha1
• 签名的规范化：http://www.w3.org/2001/10/xml-exc-c14n#
• 摘要算法：http://www.w3.org/2000/09/xmldsig#sha1

该证书是一个带有私钥的P12证书，该私钥在localComputer根密钥存储中导入。

我有一个成功的交易在了SoapUI的工作，我设法让肥皂XML消息：

了SoapUI消息：

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="*removed*"> 
    <soapenv:Header> 
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> 
     <wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="X509-*removed*">*removed*</wsse:BinarySecurityToken> 
     <ds:Signature Id="SIG-37" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> 
     <ds:SignedInfo> 
      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> 
      <ec:InclusiveNamespaces PrefixList="soapenv urn" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
      </ds:CanonicalizationMethod> 
      <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> 
      <ds:Reference URI="#id-36"> 
      <ds:Transforms> 
       <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"> 
       <ec:InclusiveNamespaces PrefixList="urn" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
       </ds:Transform> 
      </ds:Transforms> 
      <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
      <ds:DigestValue>*removed*</ds:DigestValue> 
      </ds:Reference> 
     </ds:SignedInfo> 
     <ds:SignatureValue> 
      *removed* 
     </ds:SignatureValue> 
     <ds:KeyInfo Id="KI-*removed*"> 
      <wsse:SecurityTokenReference wsu:Id="STR-*removed*"> 
      <wsse:Reference URI="#X509-*removed*" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/> 
      </wsse:SecurityTokenReference> 
     </ds:KeyInfo> 
     </ds:Signature> 
    </wsse:Security> 
    </soapenv:Header> 
    <soapenv:Body wsu:Id="id-36" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> 
    <!--Not important--> 
    </soapenv:Body> 
</soapenv:Envelope> 

我经历过许多例外和安全设置，并现在我已经到达带有AsymmetricSecurityBindingElement的CustomBinding。这是最接近我能到成功的了SoapUI消息在WCF：

WCF消息：

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> 
    <s:Header> 
    <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> 
     <Signature xmlns="http://www.w3.org/2000/09/xmldsig#"> 
     <SignedInfo> 
      <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></CanonicalizationMethod> 
      <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"></SignatureMethod> 
      <Reference URI="#_2"> 
      <Transforms> 
       <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></Transform> 
      </Transforms> 
      <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></DigestMethod> 
      <DigestValue>*removed*</DigestValue> 
      </Reference> 
     </SignedInfo> 
     <SignatureValue>*removed*</SignatureValue> 
     <KeyInfo> 
      <o:SecurityTokenReference> 
      <o:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier">*removed*</o:KeyIdentifier> 
      </o:SecurityTokenReference> 
     </KeyInfo> 
     </Signature> 
    </o:Security> 
    </s:Header> 
    <s:Body u:Id="_2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> 
    <!--Not important--> 
    </s:Body> 
</s:Envelope> 

了SoapUI具有的，而不是X509证书是二进制安全令牌，该令牌需要一些安全设置。 我也是在App.config改变端点的DNS值，所以它不会抱怨证书在不同的DNS要求：S

<identity> 
    <dns value="*IPv4-address*" /> 
</identity> 

我的终结点行为是这样的：

<behavior name="CustomBehavior"> 
    <clientCredentials> 
    <clientCertificate findValue="*IPv4-address*" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="Root"/> 
    <serviceCertificate> 
     <defaultCertificate findValue="*IPv4-address*" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="Root"/> 
    </serviceCertificate> 
    </clientCredentials> 
</behavior> 

C＃中的customBinding：

var asymmetricSecurityBindingElement = new AsymmetricSecurityBindingElement(); 
asymmetricSecurityBindingElement.InitiatorTokenParameters = new X509SecurityTokenParameters { InclusionMode = SecurityTokenInclusionMode.Never }; 
asymmetricSecurityBindingElement.RecipientTokenParameters = new X509SecurityTokenParameters { InclusionMode = SecurityTokenInclusionMode.Never }; 
asymmetricSecurityBindingElement.IncludeTimestamp = false; 

CustomBinding customBinding = new CustomBinding(); 
customBinding.Elements.Add(asymmetricSecurityBindingElement); 
customBinding.Elements.Add(new TextMessageEncodingBindingElement(MessageVersion.Soap11, Encoding.UTF8)); 

HttpsTransportBindingElement httpsBindingElement = new HttpsTransportBindingElement(); 
httpsBindingElement.RequireClientCertificate = true; 
customBinding.Elements.Add(httpsBindingElement); 

远程服务抛出执行WSDL方法时的异常：{“无法解析对象密钥标识符”}（在nerException）http://docs.oracle.com/html/E13983_01/troubleshooting.htm表示远程服务密钥库中可能缺少公钥证书，但SoapUI事务可以工作。它还提到了一个别名，我不确定这意味着什么。

我似乎没有线索来解决我的问题。谁能帮我吗？

Answer 1

尝试this binding：

<customBinding> 
     <binding name="NewBinding0"> 
      <textMessageEncoding messageVersion="Soap11" /> 
      <security authenticationMode="MutualCertificate" includeTimestamp="false" 
       messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"> 
       <secureConversationBootstrap /> 
      </security> 
      <httpTransport /> 
     </binding> 
</customBinding> 

确保装饰你的合同只签：

[System.ServiceModel.ServiceContractAttribute(ConfigurationName=..., ProtectionLevel=System.Net.Security.ProtectionLevel.Sign)] 

更多信息here。