通过"服务参考"连接到SSL SOAP主机并通过安全标头

Question

我正在尝试使用服务引用通过C#连接到SSL SOAP服务主机.这是我的要求信息:

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <s:Header>
        <VsDebuggerCausalityData xmlns="http://schemas.microsoft.com/vstudio/diagnostics/servicemodelsink">uIDPo/zwMmtdsVhFsAVDkQbiV/4AAAAA1zXtnc72UEm+4tlKzvCxsvN6OC2prvRIljIX4XzHKEYACQAA</VsDebuggerCausalityData>
        <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <u:Timestamp u:Id="_0">
                <u:Created>2016-03-18T12:45:27.558Z</u:Created>
                <u:Expires>2016-03-18T12:50:27.558Z</u:Expires>
            </u:Timestamp>
            <o:UsernameToken u:Id="uuid-2c7986ba-eee5-4411-90a9-a02b625c55ff-1">
                <o:Username>MyUserName</o:Username>
                <o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">MyPlainPassword</o:Password>
            </o:UsernameToken>
        </o:Security>
    </s:Header>
    <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
        <generateId xmlns="http://com.vedaadvantage/dp3/Enterprise/StandardTradeCreditCommercial/IndividualCommercialService"/>
    </s:Body>
</s:Envelope>

这是我的服务发送给主机的消息.但主机返回如下:

安全处理器无法在消息中找到安全标头.这可能是因为消息是不安全的故障,或者因为通信方之间存在绑定不匹配.如果为安全性配置服务且客户端未使用安全性,则会发生这种情况.

这是我的配置文件:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>

  <system.serviceModel>

    <bindings>
      <customBinding>
        <binding name="myBinding">
          <textMessageEncoding messageVersion="Soap11" />
          <security  authenticationMode="UserNameOverTransport"
                     messageSecurityVersion="WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10" >
          </security>

          <httpsTransport />
        </binding>
      </customBinding>
    </bindings>
    <client>
      <endpoint address="https://{URL}"
        binding="customBinding"
                bindingConfiguration="myBinding"
        contract="ServiceReference2.MyService"
                name="IndividualCommercialService" />
    </client>
  </system.serviceModel>
</configuration>

虽然当我通过SOAPUI或其他HTTP Post方法发送相同的XML时,它工作正常.

我还提取并附上证书和用户/通行证如下:

private static X509Certificate2 DownloadSslCertificate(string strDNSEntry)
        {

            X509Certificate2 cert = null;
            using (TcpClient client = new TcpClient())
            {
                //ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3;           
                client.Connect(strDNSEntry, 443);

                SslStream ssl = new SslStream(client.GetStream(), false, new RemoteCertificateValidationCallback(ValidateServerCertificate), null);
                try
                {
                    ssl.AuthenticateAsClient(strDNSEntry);
                }
                catch (AuthenticationException e)
                {
                    //log.Debug(e.Message);
                    ssl.Close();
                    client.Close();
                    return cert;
                }
                catch (Exception e)
                {
                    //log.Debug(e.Message);
                    ssl.Close();
                    client.Close();
                    return cert;
                }
                cert = new X509Certificate2(ssl.RemoteCertificate);
                ssl.Close();
                client.Close();
                return cert;
            }
        }

        private static void Main(string[] args){
                var proxy = new MyService();

                var uri = proxy.Endpoint.Address.Uri;
                var cer = DownloadSslCertificate(uri.DnsSafeHost);

                EndpointIdentity identity = EndpointIdentity.CreateDnsIdentity(cer.Subject.Replace("CN=", ""));
                EndpointAddress address = new EndpointAddress(proxy.Endpoint.Address.Uri, identity);

                proxy.Endpoint.Address = address;

                proxy.ClientCredentials.UserName.UserName = "MyUserName";
                proxy.ClientCredentials.UserName.Password = "MyPlainPassword";
                proxy.ClientCredentials.ServiceCertificate.DefaultCertificate = cer;

                proxy.HellowWorld();
          }

我不确定我获得证书的方法是否正确,以及为什么HTTP Post工作但我的服务参考调用没有.

在此先感谢您的帮助.

干杯

Answer 1

尝试查看 WSDL（服务引用）内部以便查看隐藏文件，首先选择“在解决方案资源管理器中显示所有文件”。您将在服务引用 Reference.svcmap -> Reference.cs 中看到，并在此文件中添加ProtectionLevel = System.Net.Security.ProtectionLevel.Sign ，如下所示

[System.ServiceModel.ServiceContractAttribute(Namespace = "http://www.your.url/Service/", ConfigurationName = "Service.Service", ProtectionLevel = System.Net.Security.ProtectionLevel.Sign)]

那应该对你有帮助。通常修改自动生成的代理确实是个坏主意，但似乎这是唯一的选择。