WCF服务-SOAP标头中的安全性

Question

我正在尝试将wcf服务与UserNameOverTransport绑定一起使用。我希望我的Soap标头看起来像这样：

<soap:Header xmlns:wsa="http://www.w3.org/2005/08/addressing"> 
<wsse:Security soap:mustUnderstand="true" xmlns:wsse="http://docs.oasis-        
open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken wsu:Id="UsernameToken-14430313" xmlns:wsu="http://docs.oasis-   
open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> 
<wsse:Username>USERNAME</wsse:Username> 
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-    token-profile-1.0#PasswordText">PASSWORD</wsse:Password> 
<wsse:Nonce>OquGazmuMMHFrdeRQZGpkA==</wsse:Nonce> 
<wsu:Created>2009-08-25T19:17:07.369Z</wsu:Created> 
</wsse:UsernameToken> 
</wsse:Security>

我的SOAP如下所示：

<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-    200401-wss-wssecurity-secext-1.0.xsd"><u:Timestamp u:Id="_0"><u:Created>2011-07-  
29T10:38:58.452Z</u:Created><u:Expires>2011-07-
29T10:43:58.452Z</u:Expires></u:Timestamp><o:UsernameToken u:Id="uuid-63332174-a7b4-  
4833-bd2e-32d0c0820f42-1"><o:Username>USERNAME</o:Username><o:Password 
Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile- 
1.0#PasswordText">PASSWORD</o:Password></o:UsernameToken></o:Security>

我用过

proxyclient.ClientCredentials.UserName.UserName =“ USERNAME” proxyclient.ClientCredentials.UserName.Password =“ PASSWORD”

在SOAP标头中插入用户名和密码，但是我还需要插入wsse：Nonce和wsu：Created，我该怎么做？使用.ClientCredentials.UserName.UserName和ChannelFactory.Credentials.UserName.UserName之间的区别是什么？

我怎样才能正确地用wsse而不是o标记？

我正在使用VS 2010和VB.NET，以及UserNameOverTransport绑定。我必须安装wse 3.0吗？

我的app.config文件如下所示：

<customBinding>
            <binding name="CustomBinding_IIntermediaryInboundExternal">
              <security defaultAlgorithmSuite="Default" authenticationMode="UserNameOverTransport" 
                  requireDerivedKeys="true" securityHeaderLayout="Strict" includeTimestamp="true"
                  keyEntropyMode="CombinedEntropy" messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">
                <localClientSettings cacheCookies="true" detectReplays="false"
                        replayCacheSize="900000" maxClockSkew="00:05:00" maxCookieCachingTime="Infinite"
                        replayWindow="00:05:00" sessionKeyRenewalInterval="10:00:00"
                        sessionKeyRolloverInterval="00:05:00" reconnectTransportOnFailure="true"
                        timestampValidityDuration="00:05:00" cookieRenewalThresholdPercentage="60" />
                    <localServiceSettings detectReplays="false" issuedCookieLifetime="10:00:00"
                        maxStatefulNegotiations="128" replayCacheSize="900000" maxClockSkew="00:05:00"
                        negotiationTimeout="00:01:00" replayWindow="00:05:00" inactivityTimeout="00:02:00"
                        sessionKeyRenewalInterval="15:00:00" sessionKeyRolloverInterval="00:05:00"
                        reconnectTransportOnFailure="true" maxPendingSessions="128"
                        maxCachedCookies="1000" timestampValidityDuration="00:05:00" />
                    <secureConversationBootstrap />
                </security>
                <textMessageEncoding maxReadPoolSize="64" maxWritePoolSize="16"
                    messageVersion="Default" writeEncoding="utf-8">
                    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />
                </textMessageEncoding>
                <httpsTransport manualAddressing="false" maxBufferPoolSize="524288"
                    maxReceivedMessageSize="65536" allowCookies="false" authenticationScheme="Anonymous"
                    bypassProxyOnLocal="false" decompressionEnabled="true" hostNameComparisonMode="StrongWildcard"
                    keepAliveEnabled="true" maxBufferSize="65536" proxyAuthenticationScheme="Anonymous"
                    realm="" transferMode="Buffered" unsafeConnectionNtlmAuthentication="false"
                    useDefaultWebProxy="true" />
            </binding>


<endpoint address="https://myendpointadress.svc"
            binding="customBinding" bindingConfiguration="CustomBinding_mysevice"
            contract="myendpoint"
            name="CustomBinding_myendpoint" />

我希望有人可以帮助我！非常感谢！！

Answer 1

WCF中的标准WCF UserNameToken配置文件实现未使用，Nonce并且Created=无法强制WCF将其包括在内。前缀并不重要，只是在wrapper元素中定义的符号名，所有正确的XML解析实现都应同时使用wsse或o。

WCF不使用Nonce和Created元素的原因是因为这些元素应与#PasswordDigest类型一起使用（WCF不支持）。与它们一起使用#PasswordText没有太大意义。

如果您的服务需要Nonce并且Created必须实现自己的令牌，而不是使用标准WCF的用户名实现。这是构建要支持的全新UserNameToken配置文件实现的示例#PasswordDigest。它也添加了Nonce和Created元素。