1. Accueil
  2. Question et réponse
  3. Signer l'en-tête ws-security contenant le jeton d'Active STS

Signer l'en-tête ws-security contenant le jeton d'Active STS

2015-08-24 1 views
0

Cela semble devoir être manipulé nativement, donc je suis susceptible de faire quelque chose de mal. J'ai un client WCF qui appelle un STS actif et utilise le jeton du RTSR pour générer l'en-tête WS-Security inclus dans l'appel au RP. Le RP exige que l'en-tête soit signé, ce qui semble une demande assez juste. Cependant, l'en-tête WS-Security généré par le client n'inclut pas de signature et je ne vois pas comment le configurer pour le faire. L'en-tête généré est ci-dessous. Comme on peut le voir, il contient une signature pour l'assertion et la subjectconfirmationdata qui sont toutes les deux des responsabilités du STS. La signature d'en-tête «manquante», selon ma compréhension limitée, relève de la responsabilité du client. Donc, quelle configuration/code doit être ajouté pour obtenir un bloc de signature qui est un élément enfant de l'en-tête de sécurité, tout comme l'en-tête de référence ci-dessous.Signer l'en-tête ws-security contenant le jeton d'Active STS

client généré en-tête WS-Security

<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> 
    <u:Timestamp u:Id="_0"> 
     <u:Created>2015-08-24T21:04:41.090Z</u:Created> 
     <u:Expires>2015-08-24T21:09:41.090Z</u:Expires> 
    </u:Timestamp> 
    <Assertion ID="_fea24920-d64c-4758-b51e-61208cb5084f" IssueInstant="2015-08-24T21:04:40.060Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion"> 
     <Issuer Format="urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName">MySTS</Issuer> 
     <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> 
      <ds:SignedInfo> 
       <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
       <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/> 
       <ds:Reference URI="#_fea24920-d64c-4758-b51e-61208cb5084f"> 
        <ds:Transforms> 
         <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/> 
         <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
        </ds:Transforms> 
        <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/> 
        <ds:DigestValue>/tfOnmKqjmkK8gH1GMNQ/XJ5gdtwzvcJTqxwiZJ7noQ=</ds:DigestValue> 
       </ds:Reference> 
      </ds:SignedInfo> 
      <ds:SignatureValue>dGz1dN9odSSpblmgczWWRG6tF66oonOHAVJCSC5uqjCOH+18cjJfX/duqb0sv1w0VxGsKIzR0VZ74V5Pq5MWsKQArIgEwO/wnUEOcKPI9J3KlL/IU7XLJNFtVO/ioKB4ps34S/5vZLB+WxXryz5ylBd5JvVFT7cf9R68kSxY9IurxELCGdhe/YIgJtgI6JsEoqqk7314sUZj8qrCy5zUbEVufyyStCI23OIunXPQceksa/csdaTmHFPNkYtHY8yUmyzT8aKBVKZVG2iluXySoi0TwTiVH+4ImGqXKV+VhUebCwqQwAur1IWAu+V/r7ZkW7C0384ATkMTmmLXRhom3g==</ds:SignatureValue> 
      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"> 
       <KeyValue> 
        <RSAKeyValue> 
         <Modulus>2kUArhFnRE+a0oof35YUv0Pc8w+UHox/PlTxzDnp86eyiLggHj76egrVbtV6TpYXw783JUQb+NiKxm0V/f6DIeqFWvCeHfzFJaWntNwAjOULY3z0n4T5gJuHpk3/JtefBXBm2m5zW4OhvijMfU228oQ5kJDpuEmkcSgmyZwyPwbJZlLAS3agrFvMu+r7qU4O6imaCAoTt/QYHIo2TLKpprXSOFrszwJDz3I5XTGaE+peBlQueFg5XvlAlARqDfq3yCcP5Mlel1Xv6kFIv/0LBMCZ1U8zMgVQsKOGgnSXCGgyq+77nvS+MPSBc71jkSWh4FnxDFTlL1j1iGdH1BIkWQ==</Modulus> 
         <Exponent>AQAB</Exponent> 
        </RSAKeyValue> 
       </KeyValue> 
      </KeyInfo> 
     </ds:Signature> 
     <Subject> 
      <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[email protected]</NameID> 
      <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key"> 
       <SubjectConfirmationData a:type="KeyInfoConfirmationDataType" xmlns:a="http://www.w3.org/2001/XMLSchema-instance"> 
        <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"> 
         <KeyValue> 
          <RSAKeyValue> 
           <Modulus>2kUArhFnRE+a0oof35YUv0Pc8w+UHox/PlTxzDnp86eyiLggHj76egrVbtV6TpYXw783JUQb+NiKxm0V/f6DIeqFWvCeHfzFJaWntNwAjOULY3z0n4T5gJuHpk3/JtefBXBm2m5zW4OhvijMfU228oQ5kJDpuEmkcSgmyZwyPwbJZlLAS3agrFvMu+r7qU4O6imaCAoTt/QYHIo2TLKpprXSOFrszwJDz3I5XTGaE+peBlQueFg5XvlAlARqDfq3yCcP5Mlel1Xv6kFIv/0LBMCZ1U8zMgVQsKOGgnSXCGgyq+77nvS+MPSBc71jkSWh4FnxDFTlL1j1iGdH1BIkWQ==</Modulus> 
           <Exponent>AQAB</Exponent> 
          </RSAKeyValue> 
         </KeyValue> 
        </KeyInfo> 
       </SubjectConfirmationData> 
      </SubjectConfirmation> 
     </Subject> 
     <Conditions NotBefore="2015-08-24T20:59:36.114Z" NotOnOrAfter="2015-08-24T22:09:36.114Z"/> 
     <AttributeStatement> 
      <!-- attributes where here --> 
     </AttributeStatement> 
     <AuthnStatement AuthnInstant="2015-08-24T21:04:36.130Z"> 
      <AuthnContext> 
       <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef> 
      </AuthnContext> 
     </AuthnStatement> 
    </Assertion> 
</o:Security>

Le côté client WCF Reliure

<configuration> 
    <system.serviceModel> 
     <bindings> 
      <ws2007HttpBinding> 
       <binding> 
        <security mode="Transport"> 
         <transport clientCredentialType="None" /> 
        </security> 
       </binding> 
      </ws2007HttpBinding> 
      <customBinding> 
       <binding> 
        <security authenticationMode="IssuedTokenOverTransport" requireSignatureConfirmation="true" securityHeaderLayout="Lax" messageSecurityVersion="WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10" messageProtectionOrder="EncryptBeforeSign" 
        keyEntropyMode="CombinedEntropy" includeTimestamp="true"> 
         <issuedTokenParameters keyType="BearerKey" tokenType="urn:oasis:names:tc:SAML:2.0:assertion"> 
          <issuer address="" binding="ws2007HttpBinding"/> 
         </issuedTokenParameters> 
         <localClientSettings></localClientSettings> 
         <secureConversationBootstrap /> 
        </security> 
        <mtomMessageEncoding maxBufferSize="2147483647" /> 
        <httpsTransport requireClientCertificate="true" maxBufferPoolSize="134217728" maxReceivedMessageSize="134217728" maxBufferSize="134217728" /> 
       </binding> 
      </customBinding> 
     </bindings> 
     <client> 
      <endpoint binding="customBinding" contract="IReplacable" name="*" /> 
     </client> 
    </system.serviceModel> 
</configuration>

en-tête de sécurité Référence

<wsse:Security S:mustUnderstand="true" xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> 
    <wsu:Timestamp wsu:Id="timestamp1" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> 
     <wsu:Created>2015-08-21T22:34:49.138Z</wsu:Created> 
     <wsu:Expires>2016-08-21T22:34:49.138Z</wsu:Expires> 
    </wsu:Timestamp> 
    <saml2:Assertion ID="a956b920-4956-47c6-8a05-8a3a56e418a0" IssueInstant="2015-08-21T22:29:49.138Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"> 
     <saml2:Issuer Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">CN=SAMLUser,OU=SU,O=SAML User,L=LosAngeles,ST=CA,C=US</saml2:Issuer> 
     <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> 
      <ds:SignedInfo> 
       <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
       <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> 
       <ds:Reference URI="#a956b920-4956-47c6-8a05-8a3a56e418a0"> 
        <ds:Transforms> 
         <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/> 
         <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
        </ds:Transforms> 
        <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
        <ds:DigestValue>guh8xR0Vu+3X3LlLAu7SJ0wCKXw=</ds:DigestValue> 
       </ds:Reference> 
      </ds:SignedInfo> 
      <ds:SignatureValue>2X2UmgJMLGQIzN73pxxyQZVVttnE8xAkPmScvFCX2zlrS7QdmqM+BoJswtmDImK9wAhXC0WtY17U C97Iw7brHrmNtQa3tM+4JClSCuW6SM6OjHn3qMLHiUJrpIZ1k0YAYfLcIF9S7x5lYFKUzWk+oOz1 3LMOMsjORXCssUpzd3BCOUhSSeg9+6b76ZyqTeaFqldn1OmG9jz3QS+h/vUo24h1ohKPJqEcE9sG 3Ab3LqyYv8ASVP9DsKRjOjxGKfhFT5WD9gW10IqQY2YGyYtguHfsyf05dPGBuXB8jaPZ3wgYsYXU FMmjRmuAYQkdQQRH8ju4HwtWdGnTtCQBRoqboA==</ds:SignatureValue> 
      <ds:KeyInfo> 
       <ds:KeyValue> 
        <ds:RSAKeyValue> 
         <ds:Modulus>2kUArhFnRE+a0oof35YUv0Pc8w+UHox/PlTxzDnp86eyiLggHj76egrVbtV6TpYXw783JUQb+NiK xm0V/f6DIeqFWvCeHfzFJaWntNwAjOULY3z0n4T5gJuHpk3/JtefBXBm2m5zW4OhvijMfU228oQ5 kJDpuEmkcSgmyZwyPwbJZlLAS3agrFvMu+r7qU4O6imaCAoTt/QYHIo2TLKpprXSOFrszwJDz3I5 XTGaE+peBlQueFg5XvlAlARqDfq3yCcP5Mlel1Xv6kFIv/0LBMCZ1U8zMgVQsKOGgnSXCGgyq+77 nvS+MPSBc71jkSWh4FnxDFTlL1j1iGdH1BIkWQ==</ds:Modulus> 
         <ds:Exponent>AQAB</ds:Exponent> 
        </ds:RSAKeyValue> 
       </ds:KeyValue> 
      </ds:KeyInfo> 
     </ds:Signature> 
     <saml2:Subject> 
      <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">CN=SAMLUser,OU=SU,O=SAML User,L=LosAngeles,ST=CA,C=US</saml2:NameID> 
      <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key"> 
       <saml2:SubjectConfirmationData> 
        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> 
         <ds:KeyValue> 
          <ds:RSAKeyValue> 
           <ds:Modulus>2kUArhFnRE+a0oof35YUv0Pc8w+UHox/PlTxzDnp86eyiLggHj76egrVbtV6TpYXw783JUQb+NiK xm0V/f6DIeqFWvCeHfzFJaWntNwAjOULY3z0n4T5gJuHpk3/JtefBXBm2m5zW4OhvijMfU228oQ5 kJDpuEmkcSgmyZwyPwbJZlLAS3agrFvMu+r7qU4O6imaCAoTt/QYHIo2TLKpprXSOFrszwJDz3I5 XTGaE+peBlQueFg5XvlAlARqDfq3yCcP5Mlel1Xv6kFIv/0LBMCZ1U8zMgVQsKOGgnSXCGgyq+77 nvS+MPSBc71jkSWh4FnxDFTlL1j1iGdH1BIkWQ==</ds:Modulus> 
           <ds:Exponent>AQAB</ds:Exponent> 
          </ds:RSAKeyValue> 
         </ds:KeyValue> 
        </ds:KeyInfo> 
       </saml2:SubjectConfirmationData> 
      </saml2:SubjectConfirmation> 
     </saml2:Subject> 
     <saml2:AuthnStatement AuthnInstant="2015-08-21T22:27:49.138Z" SessionIndex="123456"> 
      <saml2:SubjectLocality/> 
      <saml2:AuthnContext> 
       <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:X509 </saml2:AuthnContextClassRef> 
      </saml2:AuthnContext> 
     </saml2:AuthnStatement> 
     <saml2:AttributeStatement> 
      <!-- attributes--> 
     </saml2:AttributeStatement> 
     <saml2:AuthzDecisionStatement Decision="Permit" Resource=""> 
      <saml2:Action Namespace="urn:oasis:names:tc:SAML:1.0:action:rwedc">Execute</saml2:Action> 
      <saml2:Evidence> 
       <saml2:Assertion ID="_3e0d08ce-a126-45e8-b602-ac0c7ea075ce" IssueInstant="2015-08-21T22:29:49.138Z" Version="2.0"> 
        <saml2:Issuer Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">CN=SAML User,OU=SU,O=SAML User,L=Los Angeles,ST=CA,C=US</saml2:Issuer> 
        <saml2:Subject> 
         <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">CN=SAMLUser,OU=SU,O=SAML User,L=LosAngeles,ST=CA,C=US</saml2:NameID> 
        </saml2:Subject> 
        <saml2:Conditions NotBefore="2015-08-21T21:34:49.138Z" NotOnOrAfter="2016-08-21T23:34:49.138Z"/> 
        <saml2:AttributeStatement> 
         <saml2:Attribute Name="AccessConsentPolicy" NameFormat="http://www.hhs.gov/healthit/nhin"> 
          <saml2:AttributeValue>urn:oid:1.2.3.4</saml2:AttributeValue> 
         </saml2:Attribute> 
         <saml2:Attribute Name="InstanceAccessConsentPolicy" NameFormat="http://www.hhs.gov/healthit/nhin"> 
          <saml2:AttributeValue>urn:oid:1.2.3.4.123456789 </saml2:AttributeValue> 
         </saml2:Attribute> 
        </saml2:AttributeStatement> 
       </saml2:Assertion> 
      </saml2:Evidence> 
     </saml2:AuthzDecisionStatement> 
    </saml2:Assertion> 
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> 
     <ds:SignedInfo> 
      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
      <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/> 
      <ds:Reference URI="#timestamp1"> 
       <ds:Transforms> 
        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> 
       </ds:Transforms> 
       <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/> 
       <ds:DigestValue>qs//Jxv/CVrDvTxn8hYvdSe1pbY=</ds:DigestValue> 
      </ds:Reference> 
     </ds:SignedInfo> 
     <ds:SignatureValue>uf13RmBH95fP4o6x6eXC84+gkoLeZqLshw0ycm8t6HJP0+OtVEPZJbAw/UF2i2rzDk6oFE/Rxe1l /cks9HkIyNBEIwt2VY1hUldWfGd1cDq6Pi/H3EGuMasr42Qm8ObPCkSFqXhgowtIsSR9amo3e1KO YBsjYLnidcaZi7B1c6DjH1GozgSgdZDrYANUJr/KJ8zDDhGU09WXEuOekx41YvS4nWn/EHJbV+xf zKTN9ds+91PtFL1nnjqJT9BH4V2TvnRildsh7BeoMqQrXuePp7FxxgxCtg5tB15gDrNS1mOLorQZ 5UwqSrLp2/WkGkpzabMf2oN56lkiB6IHvsZ+Yg==</ds:SignatureValue> 
     <ds:KeyInfo> 
      <wsse:SecurityTokenReference wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0" xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> 
       <wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID">a956b920-4956-47c6-8a05-8a3a56e418a0</wsse:KeyIdentifier> 
      </wsse:SecurityTokenReference> 
     </ds:KeyInfo> 
    </ds:Signature> 
</wsse:Security>

Source

2015-08-24 Tedford

Répondre

0

Les en-têtes ne sont pas signés puisque vous utilisez jeton de clé de support, comme indiqué dans votre configuration

<issuedTokenParameters keyType="BearerKey"...>

Il doit être soit une clé ou AsymmetricKey symétrique. En regardant votre en-tête SOAP de référence, vous aurez besoin d'un jeton de clé asymétrique.

La méthode la plus simple consiste à utiliser ws2007FederationBinding. Si vous devez utiliser une liaison de commande (comme dans votre config), voici une configuration exemple de MSDN à https://msdn.microsoft.com/en-us/library/aa734714(v=vs.100).aspx

<issuedTokenParameters 
     DefaultMessageSecurityVersion="System.ServiceModel.MessageSecurityVersion" 
     inclusionMode="AlwaysToInitiator/AlwaysToRecipient/Never/Once" 
     keySize="Integer" 
    keyType="AsymmetricKey/BearerKey/SymmetricKey" 
     tokenType="String" > 
    <additionalRequestParameters /> 
    <claimTypeRequirements> 
     <add claimType="URI" 
      isOptional="Boolean" /> 
    </claimTypeRequirements> 
    <issuer address="String" 
         binding=" " /> 
    <issuerMetadata address="String" /> 
</issuedTokenParameters>

Vous pouvez omettre l'élément émetteur et obtenir le SAML jeton séparément de votre STS en utilisant WS-Trust et utilisez le jeton pour sécuriser votre message sortant sur RP.

Source

2015-10-16 18:02:55

 Questions connexes

  • Aucun problème connexe^_^