Question

我一直在阅读与XML签名相关的所有内容，这是一个痛苦，痛苦的世界，就像今天一样。

我能够向远程WSDL（https://tbk.orangepeople.cl/WSWebpayTransaction/cxf/WSWebpayService?wsdl）发出SOAP请求，我也应该验证他们的响应（当然！），但是我可以＆＃39;似乎弄清楚如何正确验证XML SignatureValue。

我也无法使用 openssl （OpenSSL 0.9.8zg 2015年7月14日）在终端（MAC OSX 10.11.1）上验证此签名，但我并不自信足够我的文件输入和命令100％正确给出一个积极的结果。

向我提供公共证书的实体向我保证这是正确的，所以那里没有运气。我还创建了一个正确配置Outgoing＆amp; amp;的SoapUI项目。即将到来的WSS备份此声明。

对于任何有兴趣的人，我使用Signer和Nokogiri :: XML :: Builder为我的请求生成签名的XML，Savon自己处理请求，并在下面的代码中我和＃ 39; m分别使用Akami :: WSSE :: VerifySignature来处理响应。

这是我到目前为止所拥有的：

XML（响应）：

Get-EventLog Security -After '11/1/15'.... | Export-CSV "filepath"

证书（certificate_server.crt）：

$(function(){
    var backgroundImg = document.querySelector(".image-selector");

    var bmyObject = {
        backImgNaturalWidth : backgroundImg.naturalWidth,
        /*
            Rest of the object that is okay
        */
    };

    /*Rest of my script*/
}

使用Ruby源代码（稍加修改，使用 OpenSSL :: Digest :: SHA1.new 代替简化沼气池映射方法）：

<?xml version="1.0"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Header>
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" soap:mustUnderstand="1">
      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="SIG-1426">
        <ds:SignedInfo>
          <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
            <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="soap"/>
          </ds:CanonicalizationMethod>
          <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
          <ds:Reference URI="#id-1425">
            <ds:Transforms>
              <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList=""/>
              </ds:Transform>
            </ds:Transforms>
            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
            <ds:DigestValue>o6RiSp7nGmMWf01mYh3FGNpK80A=</ds:DigestValue>
          </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>irR3w9BKEf64eN9FJRnCBqHEj5kWZu+Bn5QlNrBTxp/tbGxgU1ViTLFNu6kQJFfxEFB1AoN7Ks5c
QKOK5eBwbA3j6486XQPMoYOvOWxtr73PS09LVFp6P1aZ0y5wHTf7dQ89GJ35Zb0JemvkeSN0XWQt
X3USE7A6z4t04jx95FX+Me6dTAFyf3ealyISfrfYkIsasqU6W/orhRgyKunq6N1aTZ7HmphaSgtu
EEncUiKS6aEdvD0NjwKWXlTr/5NT5BQ7T9cmWS00QYjlRlF2SGww44SAehNojwqFy40SEpuVPVJv
DH9GH4ITsy72DeY/PXkHkaEpDIPM32EUfobE1zRM0zwPLGQysGcELSRfzAWR9QWO1NmPecABymZ8
qMNQRxUK5MkX2S/O29Jpmq/8q/VWQQhnMmj6YdL8NAE1RmjH11wNXdWHRM+3iLndMk5EpiDtFZSo
fDmtNBWhiBzE3g/OZYBbZVM9MvQjMj0x2aK8rZK/qRylbVjhYaJI8hEOiAJZeAHErwuynjP01ONI
bXeyqZik5x54zamdsQs5UlXaGYRAqVInKr1j4+trJTstAqP7C22cEUULyKO2jkBj/wWpRhucjbJH
4XXHuVHQWP2myvnImaOHuAC8TFSCsV6/hOx206G4Yd1cyHSfNM3XEQURVlOaO0an582OlFxFvnU=</ds:SignatureValue>
        <ds:KeyInfo Id="KI-FBCFA2CE61C97ADD4A14467251913442138">
          <wsse:SecurityTokenReference wsu:Id="STR-FBCFA2CE61C97ADD4A14467251913442139">
            <ds:X509Data>
              <ds:X509IssuerSerial>
                <ds:X509IssuerName>CN=10,OU=ExperTI,O=ExperTI,L=Santiago,ST=Santiago,C=CL,1.2.840.113549.1.9.1=#16116a636572646140657870657274692e636c</ds:X509IssuerName>
                <ds:X509SerialNumber>1401281826</ds:X509SerialNumber>
              </ds:X509IssuerSerial>
            </ds:X509Data>
          </wsse:SecurityTokenReference>
        </ds:KeyInfo>
      </ds:Signature>
    </wsse:Security>
  </soap:Header>
  <soap:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="id-1425">
    <ns2:initTransactionResponse xmlns:ns2="http://service.wswebpay.webpay.transbank.com/">
      <return>
        <token>e30965b17f7854b21bf77f313cb9a117214e62fb5d98c6ff2580e859d013ed32</token>
        <url>https://tbk.orangepeople.cl/filtroUnificado/initTransaction</url>
      </return>
    </ns2:initTransactionResponse>
  </soap:Body>
</soap:Envelope>

这只在最后一行失败：

如果有人能发现错误/错误/遗漏代码，或者提供一个有效的例子，我将非常感激。

Answer 1

Had to verify this by making new requests using PHP xmlseclibs, but it turned out to be missing '\n's on the signature field and a missing namespace from the root Envelope XML tag on the data field of the following line:

certificate_server.public_key.verify(signature_digester, signature, data)

For this case in particular, the element SignedInfo in data needed to be verified while also having the following namespace, which was not included by the 'canonicalize' method:

xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"

Hope this helps someone in the future!

使用X509证书的Ruby SOAP响应无法通过XML SignatureValue验证

1 个答案: