＆＃39;行动＆＃39; http：//www.w3.org/2005/08/addressing'所需的消息部分未签名

Question

我正在访问一个基于java的外部Web服务，我无法从WCF客户端控制，使用双证书进行加密和签名以及自定义绑定。我从服务器获得了成功的响应，但是WCF正在抛出MessageSecurityException：＆＃39; Action＆＃39;，＆＃39; http://www.w3.org/2005/08/addressing＆＃39;必填邮件部分未签名。

我的自定义绑定：

private CustomBinding GetCustomBinding()
{
    CustomBinding binding = new CustomBinding();
    binding.OpenTimeout = new TimeSpan(0, 0, 20);
    binding.CloseTimeout = new TimeSpan(0, 0, 20);
    binding.SendTimeout = new TimeSpan(0, 5, 0);
    binding.ReceiveTimeout = new TimeSpan(0, 5, 0);

    var userNameToken = new UserNameSecurityTokenParameters();
    userNameToken.InclusionMode = SecurityTokenInclusionMode.AlwaysToRecipient;

    var securityElement = new AsymmetricSecurityBindingElement();
    securityElement.EnableUnsecuredResponse = true;
    securityElement.IncludeTimestamp = true;
    securityElement.RecipientTokenParameters = new X509SecurityTokenParameters(X509KeyIdentifierClauseType.IssuerSerial, SecurityTokenInclusionMode.Never);
    securityElement.InitiatorTokenParameters = new X509SecurityTokenParameters(X509KeyIdentifierClauseType.IssuerSerial, SecurityTokenInclusionMode.AlwaysToRecipient);
    securityElement.DefaultAlgorithmSuite = SecurityAlgorithmSuite.Basic128Rsa15;
    securityElement.SecurityHeaderLayout = SecurityHeaderLayout.Strict;
    securityElement.SetKeyDerivation(false);
    securityElement.EndpointSupportingTokenParameters.Signed.Add(userNameToken);
    securityElement.MessageProtectionOrder = System.ServiceModel.Security.MessageProtectionOrder.SignBeforeEncrypt;
    securityElement.MessageSecurityVersion = MessageSecurityVersion.WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10;
    binding.Elements.Add(securityElement);

    var encodingElement = new TextMessageEncodingBindingElement();
    encodingElement.MessageVersion = MessageVersion.Soap11WSAddressing10;
    encodingElement.WriteEncoding = Encoding.UTF8;
    encodingElement.ReaderQuotas.MaxArrayLength = 50000000;
    encodingElement.ReaderQuotas.MaxStringContentLength = 50000000;
    binding.Elements.Add(encodingElement);

    var httpsElement = new HttpsTransportBindingElement();
    httpsElement.MaxBufferSize = 50000000;
    httpsElement.MaxReceivedMessageSize = 50000000;
    httpsElement.MaxBufferPoolSize = 50000000;
    httpsElement.UseDefaultWebProxy = true;
    binding.Elements.Add(httpsElement);

    return binding;
}

现在我不在乎是否签署了Action元素，或者即使它根本不存在，但是攻击删除标记的响应会导致一个＆＃39;否签名消息部分是为＆＃39;＆＃39; 。动作＆＃39;例外。

如何配置我的客户端以接受响应消息中的Action和其他寻址元素？或者，我可以将它们更改为什么，以便WCF让它们通过？

Answer 1

要覆盖用于身份验证的远程安全套接字层（SSL）证书的默认检查，请在客户端上指定：

ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(delegate { return true; }); 

要调查证书错误，请检查 RemoteCertificateValidationCallback 委托的 sslPolicyErrors 参数（Link到MSDN手册页）。