Question

我遇到过SOAP签名问题。我使用的是Android 4.3。服务器说我的签名无效。我收到了example消息，我正在尝试重新创建它。那么问题是什么？我正在尝试从SignInfo生成SignatureValue。

如果有人可以向我解释创建带有详细信息的SOAP消息的整个过程，我将非常高兴。我一直在寻找答案。

我的留言：

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Header xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" soap:mustUnderstand="1"><wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" wsu:Id="X509-D674E7DD8DD86468D614642776005021" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">MIID6zCCAtOgAwIBAgIEAQAAAzANBgkqhkiG9w0BAQsFADBYMQswCQYDVQQGEwJDWjEaMBgGA1UEAwwRR0ZSIEVFVCB0ZXN0IENBIDExLTArBgNVBAoMJEdlbmVyw6FsbsOtIGZpbmFuxI1uw60gxZllZGl0ZWxzdHbDrTAeFw0xNjA1MTkxMjQ1MDJaFw0xODA1MTkxMjQ1MDJaMFMxCzAJBgNVBAYTAkNaMRUwEwYDVQQDDAxDWjEyMTIxMjEyMTgxFzAVBgNVBAoMDk9zb2JhIEZ5emlja8OhMRQwEgYDVQQFEwtUMDAwMDAwMDAwMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMt0eW9n+RB0PSawKSJbtAg3j7e1I5p7P9OvEj0n9raEMI496Zuw7s4VaE8JEX4iowjWhlPIOPljDiAXX6HgZzH4PDps0rFm388KZxj7Ek/ZLyyh5jRovc0Yccfgm3i2huBepk7ZtifZXOZzDEDT0CZsxRpypZJp9PK6SOdj2zPIc11F+prwsGQCDAZsRtama5/W5qn2YUWjjk+4c5Zu3TcknC7bcp1dg7RJ9yMtNiYPY7LNV3uWQhAXZVFpmOpbfYwT1F8H3/UrWDSJ5zrHshICPreMyZ0skU9SUANQ8QQKE6lSlgSs59YaeEmCyGtpttVjN+iR/L9M9FRtq3ZhZz0CAwEAAaOBwTCBvjAeBgNVHREEFzAVgRNlcG9kcG9yYUBmcy5tZmNyLmN6MB8GA1UdIwQYMBaAFHpa/A3L7DamDdppGWaMm++Cw6k0MB0GA1UdDgQWBBQbyTbuGBZdorOZZm7usMraGAJ2STBMBgNVHSAERTBDMEEGCmCGSAFlAwIBMAIwMzAxBggrBgEFBQcCAjAlGiNUZW50byBjZXJ0aWZpa2F0IEpFIFBPVVpFIFRFU1RPVkFDSTAOBgNVHQ8BAf8EBAMCBsAwDQYJKoZIhvcNAQELBQADggEBAC3L8Bm7ZlWui9xWrjM00SlvCokpc2ldGCxNvj4hANaISoLRdPVZAPeLd1X4KsRyxOIazR5oq3EKVZV1ZP3sCF4QFL+SqurkPiBbIrrbABDLyDpf/8DIfyA1x/+zNpN9ul9j9Ca1739P4L1x3wpQcYhEuvSrTiLztndlJb69LXgYZOFfqcBSRedRuMwRdtux9OWkkZjrd9wNHTCDOIfOPaPRRoq5IPHP32shsXaTLvhsT7ktvR5Fr/SQ8CkWq3U6tdcOQRN35ZWyYSyOd5/vkJqK773R/gAeBUE80gpLMdqgVj8HaD7RlHrYyYJEVUI9gbctTfUIJW/9LZ3K78JLXXg=</wsse:BinarySecurityToken><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="SIG-D674E7DD8DD86468D614642776005345"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="soap"></ec:InclusiveNamespaces></ds:CanonicalizationMethod><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"></ds:SignatureMethod><ds:Reference URI="#id-D674E7DD8DD86468D614642776005214"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList=""></ec:InclusiveNamespaces></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"></ds:DigestMethod><ds:DigestValue>UWKUBp8O/jI/pJyTxtsXC5Vz/bBwbz+XUyIODQpcN+E=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue></ds:SignatureValue><ds:KeyInfo Id="KI-D674E7DD8DD86468D614642776005082"><wsse:SecurityTokenReference wsu:Id="STR-D674E7DD8DD86468D614642776005123"><wsse:Reference URI="#X509-D674E7DD8DD86468D614642776005021" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"></wsse:Reference></wsse:SecurityTokenReference></ds:KeyInfo></ds:Signature></wsse:Security></SOAP-ENV:Header><soap:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="id-D674E7DD8DD86468D614642776005214"><Trzba xmlns="http://fs.mfcr.cz/eet/schema/v2"><Hlavicka dat_odesl="2016-09-19T19:06:37+01:00" prvni_zaslani="false" uuid_zpravy="9edeb22b-4234-4047-869c-3a76f86c20d3"></Hlavicka><Data celk_trzba="34113.00" cerp_zuct="679.00" cest_sluz="5460.00" dan1="-172.39" dan2="-530.73" dan3="975.65" dat_trzby="2016-01-05T00:30:12+01:00" dic_popl="CZ1212121218" id_pokl="/5546/RO24" id_provoz="273" porad_cis="0/6460/ZQ42" pouzit_zboz1="784.00" pouzit_zboz2="967.00" pouzit_zboz3="189.00" rezim="0" urceno_cerp_zuct="324.00" zakl_dan1="-820.92" zakl_dan2="-3538.20" zakl_dan3="9756.46" zakl_nepodl_dph="3036.00"></Data><KontrolniKody><pkp cipher="RSA2048" digest="SHA256" encoding="base64">lncmU7IdeWbscoTzTykEZ7NdATPtAH3t3i0mpNbAx3oquNJ7ML3UghGDDHncKLyfpnR+zCIltifxCx7k18X/9ZQVRMh5/42kTTPHlTR9x8y8i3zcK00+5znfgW/ofIT+mZUkJQ2dztxGmrVTJeYvXCrKX5qH+zwPpkdAAbc3DjhC+meMA8U+FY9MpqYZd0x7AzWSUI5gmrBxMThPZnzn3nonpFLwRI+WcGndnWzzLPf16CnJW3LJoYojGxzBC0peaEnDcWbr9WGeW+OFBv2MHrglip5RWugp+xat4g1jgWiMWyDA2TF6yY6ybtD1axygRfqqbmPMPKSX7Wl3xi4C3g==</pkp><bkp digest="SHA1" encoding="base16">F7370733-DF026DD5-704477C8-6AEA6E34-4CB34D92</bkp></KontrolniKody></Trzba></soap:Body></soap:Envelope>

我的SignInfo用于获取摘要以签名

<ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="soap"/></ds:CanonicalizationMethod><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><ds:Reference URI="#id-D674E7DD8DD86468D614642776005214"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList=""/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>UWKUBp8O/jI/pJyTxtsXC5Vz/bBwbz+XUyIODQpcN+E=</ds:DigestValue></ds:Reference></ds:SignedInfo>

还有我的java代码来生成SignatureValue：

Signature signature = Signature.getInstance("SHA256withRSA");
signature.initSign(CertificateManager.getCustomersPrivateKey(context));
signature.update("".getBytes());
byte[] signatureBytes = signature.sign();
String value = Base64.encodeToString(signatureBytes, Base64.DEFAULT);

Android并不天真地支持SOAP消息，但我必须使用它。

要求：

WS-Security 1.0和XML签名标准用于电子签名
属于用于实现电子签名的私钥的X509证书关于注册销售数据的消息，包括SOAP信封，应附在 BinarySecurityToken元素（http://docs.oasis-open.org/wss/2004/01/oasis-200401-wsssoap-message-security-1.0#Base64Binary）采用X509v3格式（http://docs.oasisopen.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3）
应使用“Exclusive C14N”XML规范化算法（Exclusive XML 规范化版本1.0，https://www.w3.org/TR/xml-exc-c14n/）
要计算SOAP消息签名的散列（摘要），SHA256算法应该使用（http://www.w3.org/2001/04/xmlenc#sha256）
对于SOAP消息的电子签名，应使用RSA-SHA256算法（http://www.w3.org/2001/04/xmldsig-more#rsa-sha256）
整个元素应包含在电子签名中，即消息标头没有电子签名（WS-Addressing或其他需要类似标准的标准）概念被使用）
可以在WSDL中提供有关WSS的其他要求。

问题的完整文档：here

非常感谢帮助！

SOAP签名无效

0 个答案: