使用WS-UsernameToken认证的SOAP请求示例 [英] Example of SOAP request authenticated with WS-UsernameToken
问题描述
我正在尝试使用WS-UsernameToken规范对SOAP请求进行身份验证，但是目标设备始终拒绝访问.我的无效请求看起来像这样. (我要哈希的密码是system.)
I'm trying to authenticate a SOAP request using WS-UsernameToken spec, but the target device is always denying access. My non-working request looks like this. (The password I'm trying to hash is system.)
<?xml version="1.0" encoding="UTF-8"?>
<Envelope xmlns="http://www.w3.org/2003/05/soap-envelope">
<Header>
<Security xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<UsernameToken>
<Username>root</Username>
<Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">EVpXS/7yc/vDo+ZyIg+cc0fWdMA=</Password>
<Nonce>tKUH8ab3Rokm4t6IAlgcdg9yaEw=</Nonce>
<Created xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2010-08-10T10:52:42Z</Created>
</UsernameToken>
</Security>
</Header>
<Body>
<SomeRequest xmlns="http://example.ns.com/foo/bar" />
</Body>
</Envelope>
我正在寻找的是一个类似的请求示例，但具有实际起作用的身份验证令牌.例如，如果您有使用这些令牌的gSOAP应用程序，并且可以生成一个请求并将结果发布到此处，我将不胜感激.
What I'm looking for is a similar request example, but with authentication token that actually works. For example if you have gSOAP application that uses these token, and can generate a request and post the result here, I'd be very grateful.
推荐答案
核心内容是为命名空间定义前缀，并使用它们来强化每个标签-您正在混合3个命名空间，并且通过尝试不能飞行破解默认值.完全使用标准操作 c-以防万一对方有点草率.
The core thing is to define prefixes for namespaces and use them to fortify each and every tag - you are mixing 3 namespaces and that just doesn't fly by trying to hack defaults. It's also good to use exactly the prefixes used in the standard doc - just in case that the other side get a little sloppy.
最后但并非最不重要的一点是，最好在可能的情况下为字段使用默认类型-密码必须列出类型，因为Nonce已经是Base64.
Last but not least, it's much better to use default types for fields whenever you can - so for password you have to list the type, for the Nonce it's already Base64.
在通过XML发送生成的令牌之前，请确保检查生成的令牌是否正确，并且不要忘记wsse:Password的内容是Base64(SHA-1(即刻+创建+密码))和日期时间在wsu:Created可以很容易将您弄乱.因此，一旦您修复了前缀和名称空间，并验证了SHA-1在没有XML的情况下是否可以正常工作(假设您正在验证请求并进行SHA-1计算的服务器端)，您还可以执行创建的真实操作，甚至没有Nonce. Oh和Nonce可以使用不同的编码，因此，如果您真的想强制使用另一种编码，则必须进一步研究wsu命名空间.
Make sure that you check that the generated token is correct before you send it via XML and don't forget that the content of wsse:Password is Base64( SHA-1 (nonce + created + password) ) and date-time in wsu:Created can easily mess you up. So once you fix prefixes and namespaces and verify that yout SHA-1 work fine without XML (just imagine you are validating the request and do the server side of SHA-1 calculation) you can also do a truial wihtout Created and even without Nonce. Oh and Nonce can have different encodings so if you really want to force another encoding you'll have to look further into wsu namespace.
<S11:Envelope xmlns:S11="..." xmlns:wsse="..." xmlns:wsu= "...">
<S11:Header>
...
<wsse:Security>
<wsse:UsernameToken>
<wsse:Username>NNK</wsse:Username>
<wsse:Password Type="...#PasswordDigest">weYI3nXd8LjMNVksCKFV8t3rgHh3Rw==</wsse:Password>
<wsse:Nonce>WScqanjCEAC4mQoBE07sAQ==</wsse:Nonce>
<wsu:Created>2003-07-16T01:24:32</wsu:Created>
</wsse:UsernameToken>
</wsse:Security>
...
</S11:Header>
...
</S11:Envelope>
这篇关于使用WS-UsernameToken认证的SOAP请求示例的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
