Question

我正在尝试签署肥皂请求。文档的其余部分是有效的，但我最终得到的SignatureValue并不是预期的。我在过去的几天里学习了Soap和签名，所以最可能的情况是我误解了这个算法的输入或操作顺序。

这里是请求，显然减去了用户名/密码。对不起代码块。肥皂请求需要很多元素才能全面了解：

<soapenv:Envelope xmlns:real="http://realtime.cbapi.clarabridge.com/" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
  <soapenv:Header>
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <ds:Signature>
        <ds:SignedInfo>
          <ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
          <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
          <ds:Reference URI="#id-65BB4C5D722C51E896140612427983429">
            <ds:Transforms>
              <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                <ds:InclusiveNamespaces PrefixList="real soapenv wsu" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#"/>
              </ds:Transform>
            </ds:Transforms>
            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
            <ds:DigestValue>YIjV+XTiwlkXLG4yMhwuxXeHGYE=</ds:DigestValue>
          </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>OplmHJ6fpJNEcCwm58BIkM8r+sU6bsYS6DiRN+wtHkf4Aw0JFwHvbM/0noEFcVNWwVcfMMeHoidkCGVERNnWtt5e43ifIIyI1XxBaV/w3jastS8jgCxM9AXdfJKUm8Q+3pqFuaNnOAQnQPZ1FWUJh8hMWMtQNW5XRwP/+xpfSvI0lFUygy9VOZcjbYHLqadftkvmObDvN9Kg59oKYVuIRrwBeTquP/oJsdV/ni9Bu1deLSNxON4YtNU1JdGGnIkaZWbaMXVY+w9W6LBgLKoAZrKW6zi8NgtJRdSwFUOGA1eXcN82p69xgeoWg4GQd1bXYFu405hiNMuAQe98yg6s9g==</ds:SignatureValue>
        <ds:KeyInfo>
          <wsse:SecurityTokenReference>
            <wsse:KeyIdentifier EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">MIIFMDCCBBigAwIBAgIQSWtHiOJhlIGXXlVQfuGvMzANBgkqhkiG9w0BAQUFADCBtTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykxMDEvMC0GA1UEAxMmVmVyaVNpZ24gQ2xhc3MgMyBTZWN1cmUgU2VydmVyIENBIC0gRzMwHhcNMTQwNjAzMDAwMDAwWhcNMTgwNjAzMjM1OTU5WjB8MQswCQYDVQQGEwJVUzEOMAwGA1UECBMFVGV4YXMxDzANBgNVBAcUBkF1c3RpbjEbMBkGA1UEChQSUHJlZGljdGl2ZSBTY2llbmNlMQswCQYDVQQLFAJJVDEiMCAGA1UEAxQZd3d3LnByZWRpY3RpdmVzY2llbmNlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK9enbBiootY6sgYUkWThtCaWIUZKPtERx2m2btgAmwlB4ZG550uXmoxWKwwb9UqIlQiUfWdTQFD3GWD5Tiq/yN/toLimRXlcYt1CiJwIeUhdBQdrHB6KHEv2KUyCEnxBwRldEkHrxSKSbHpXLacl3OZixiRzyEMCuHYxhLbATNKRVmGyXmDYNDA4Nu4jj6LVzI7026bMGEAPbar93mhWV/lVmO6IKkQnck3s4pKqsnqQ/nl7+Vl8ftk6KbvAQ4U1xm+hr3zYwZiD+40xCFqMfRLE9uA4kTD2oMBKLIk9SXxjJmPOwS63PticE/gYEqLrristHjwxzrHI57sOMsnfC8CAwEAAaOCAXIwggFuMCQGA1UdEQQdMBuCGXd3dy5wcmVkaWN0aXZlc2NpZW5jZS5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NkLnN5bWNiLmNvbS9zZC5jcmwwZQYDVR0gBF4wXDBaBgpghkgBhvhFAQc2MEwwIwYIKwYBBQUHAgEWF2h0dHBzOi8vZC5zeW1jYi5jb20vY3BzMCUGCCsGAQUFBwICMBkWF2h0dHBzOi8vZC5zeW1jYi5jb20vcnBhMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBQNRFwWU0TBgn4dIKsl9AFj2L55pTBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zZC5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9zZC5zeW1jYi5jb20vc2QuY3J0MA0GCSqGSIb3DQEBBQUAA4IBAQBDZN0azh5pvzLUdEYO/iosv566nEoNBoRZ0mh7hdEMFphPQIIhFohklpB0Uf6NfhM5I79qrtOQ1b3gHLH1KyhW9zSL3ZcQINPKlfR9aPXVFcGM/0WlensbTAlFQUvFMexDvPqf1h3gp5knDffTLyTD1Ybw4h6jTQngJJm5BAWck8V7KHb5Q69utnPAfwTSblPpNIl2yzC5wIpSuvVD2ghW6h+abBLSXC54wAWzZnHJ5PBeWn0vZb/pXHszrk8TPd6xZmjF9N+UoKoqnn5lJZZja1XntPkIgGP9LAAlOaYIAP1hyWTWuYYoKjgGyjbfVEdjGB3qhV2eCPhZRjj0JWG6</wsse:KeyIdentifier>
          </wsse:SecurityTokenReference>
        </ds:KeyInfo>
      </ds:Signature>
      <wsse:UsernameToken>
        <wsse:Username/>
        <wsse:Password type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"/>
        <wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">rDR41po8gfpi5g9cNpYWWk5easQ=</wsse:Nonce>
        <wsu:Created>2014-08-06T15:06:43.387246</wsu:Created>
      </wsse:UsernameToken>
    </wsse:Security>
  </soapenv:Header>
  <soapenv:Body Id="id-65BB4C5D722C51E896140612427983429">
    <real:processMultiVerbatimDocument>
      <processMultiVerbatimDocumentRequest>
        <projectName/>
        <modelName/>
        <responseLevel/>
        <save/>
        <verbatimSet>
          <verbatim/>
        </verbatimSet>
        <limitByWordRank>true</limitByWordRank>
        <includeNRelations>false</includeNRelations>
      </processMultiVerbatimDocumentRequest>
    </real:processMultiVerbatimDocument>
  </soapenv:Body>
</soapenv:Envelope>

我的理解是算法状态如下：

获取包含的命名空间。
对它们运行C14N算法以规范化顺序和间距等事项
使用sha1对其进行哈希处理，然后转换为base64。这就是DigestValue
导入我的RSA私钥（未显示）并使用Crypto.Signature.PKCS1_v1_5
调用signer.sign（DigestValue）。这是SignatureValue

使用SoapUI时，我获得的SignatureValue与其不同。 SoapUI是正确的，而我的显然是错的，但我不知道从哪里开始调试。如果以前有人通过这个，那将非常感谢帮助！

由于

Answer 1

我知道这个问题已经过了一年多了，但我一直在努力用golang做同样的事情。

下载wss4j的源代码并运行其签名测试后，我发现您实际上没有签署在步骤3中确定的摘要值，而是将整个<ds:SignedInfo></ds:SignedInfo>块规范化，然后签名。如果您没有使用添加父命名空间的DOM，Wss4j还会在规范化之前将soap命名空间添加到元素，否则您的签名将无法验证。我没有使用Go的DOM，因此我必须确保将xmlns：soap添加到签名的info元素中。

我不知道添加的命名空间是否遵循WSSE规范，但这些是我的发现，并且我能够使用这种技术成功地将golang的签名SOAP消息发送到java服务。

你要签名的一个例子，记住标签之间的间距在c14n中很重要，所以我没有格式化，没有空格。

<SignedInfo xmlns="http://www.w3.org/2000/09/xmldsig#" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="real soapenv wsu"></InclusiveNamespaces></CanonicalizationMethod><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"></SignatureMethod><Reference URI="#id-65BB4C5D722C51E896140612427983429"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList=""></InclusiveNamespaces></Transform></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></DigestMethod><DigestValue>YIjV+XTiwlkXLG4yMhwuxXeHGYE=</DigestValue></Reference></SignedInfo>

如何生成XML SignatureValue

1 个答案: