Question

我尝试使用以下命令使用P12私钥对我的测试xml进行签名，并出现以下错误：

xmlsec1 --sign --output tested.payload.xml --pkcs12 SenderCert/sender.p12 --pwd password tested.xml 

Error: failed to find default node with name="Signature"
Error: failed to load template "tested.xml"
Error: failed to sign file "tested.xml"

有什么建议吗？

Answer 1

Security标记内应该有一个Header标记，在您的SOAP消息中大致有这样的结构：

<soapenv:Header>
<wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="X509-A64424329E443DAEFE14265088735561">CERTIFICATE_HERE</wsse:BinarySecurityToken>
    <ds:Signature Id="SIG-A64424329E443DAEFE14265088736534" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                <ec:InclusiveNamespaces PrefixList="raad soapenv" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            </ds:CanonicalizationMethod>
            <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
            <ds:Reference URI="#id-15652DE155DD8DFF971422029213153243">
                <ds:Transforms>
                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                        <ec:InclusiveNamespaces PrefixList="raad" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    </ds:Transform>
                </ds:Transforms>
                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                <ds:DigestValue/>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue/>
        <ds:KeyInfo Id="KI-A64424329E443DAEFE14265088736252">
            <wsse:SecurityTokenReference wsu:Id="STR-A64424329E443DAEFE14265088736273">
                <wsse:Reference URI="#X509-A64424329E443DAEFE14265088735561" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
            </wsse:SecurityTokenReference>
        </ds:KeyInfo>
    </ds:Signature>
</wsse:Security>
</soapenv:Header>

xmlsec1不会插入新标记，而是使用值填充必要的标记

Answer 2

我刚遇到同样的问题。我通过添加$in_text = implode(',',array_map('implode',$myArray3)); echo $in_text;标签来解决它，这是OASIS中的标准SAML，然后就可以了。

但问题是我需要简化<samlsig:Signature>以调整与SAML标准不完全相同的IDP。我不知道如何解决这种情况。有人知道吗？

使用xmlsec1的XML签名

2 个答案: