WCF Client Sign only soap body

Question

I did some research on this, but couldn't find a proper solution. Why does my soap request so many reference uri's. The outgoing soap body only should be signed using Private key and encrypted using public key.

My outgoing soap has some additional elements

1)Additional encrypted data node. 2) Additioanal and unreferenced reference URi in Signature

    
    
    
    

                  
        
        
          
            
          
        
        
          Wp9slJCs7umXjsMi6diTRB+cSLIADY8RyeNmym7MkfYVxDmP5FIKXwyIV8e7IbLlJEKBUqgIQbYTtwNej7E1PfoD+vI64rOTyxbIhgZ/icnoAIQFJ/Mwuwq60hJhjpfC9m2Ll/S+JsWfg+0Njl+gpYzaECLYeSGEJND6CmbKTUY=
        
        
       
    ---Not needed.Only #_2,which references the Body is needed
        
      
---Not needed 
      
        
        
          
        
      
      
        
          
          
           Needed
            
              
            
            
            l6kqP048t5INzJT3W8gxVSXplaE=
          
           --Not needed
            
              
            
            
            r9QXAfEWv2UhmnjzIXyoyHVy9wQ=
          
           --Not needed
            
              
            
            
            5JI25GEJj/63MQB6j2P2uiFTwe0=
          
           --Not needed
            
              
            
            
            dRaV5csLUbHL6k4X97njcIkwp5k=
          
           --Not needed
            
              
            
            
            3c80pnhYcV2BcsEsduxDdQ6z2q0=
          
           --Not needed
            
              
            
            
            1fvCyhzU3bILTCoFB8xUnQtP2wA=
          
           --Not needed
            
              
            
            
            LihjfykAPG4wv/HsoKZXjuJ4Eq0=
          
        
        removed

This is the custom Binding

 AsymmetricSecurityBindingElement secBE = AsymmetricSecurityBindingElement.CreateMutualCertificateDuplexBindingElement();
            secBE.AllowSerializedSigningTokenOnReply = false;
            secBE.RequireSignatureConfirmation = true ;
            secBE.DefaultAlgorithmSuite = SecurityAlgorithmSuite.TripleDesRsa15;
           secBE.MessageSecurityVersion = MessageSecurityVersion.WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10;
           X509SecurityTokenParameters x509ProtectionParameters = new X509SecurityTokenParameters();
           x509ProtectionParameters.RequireDerivedKeys = false;
           x509ProtectionParameters.X509ReferenceStyle = X509KeyIdentifierClauseType.SubjectKeyIdentifier;
           x509ProtectionParameters.ReferenceStyle = SecurityTokenReferenceStyle.Internal;
           x509ProtectionParameters.InclusionMode = SecurityTokenInclusionMode.AlwaysToRecipient;
           secBE.InitiatorTokenParameters = x509ProtectionParameters;
           secBE.RecipientTokenParameters = x509ProtectionParameters;
           secBE.MessageProtectionOrder = MessageProtectionOrder.EncryptBeforeSign;
           secBE.EndpointSupportingTokenParameters.SignedEncrypted.Add(new X509SecurityTokenParameters());
           CustomTextMessageBindingElement enc = new CustomTextMessageBindingElement();
           HttpsTransportBindingElement b = new HttpsTransportBindingElement();
            b.RequireClientCertificate = true;
            CustomBinding be = new CustomBinding();
            be.Elements.Add(secBE);
            be.Elements.Add(enc);
            be.Elements.Add(b);
            return be;

part of Soap sample from vendor. As per my understanding only the Body is signed and encrypted.









gpBAWt91pdwhKva............







SAMP L E R EQUE ST W I T H WS S E CURI T Y
eMedNY Meds History Service User Guide Page 13 of 48 February 16, 2012
Version 1.1







wRUq.........


tBSsaZi........












SQsTCAK6ZaVhojB8+Y.........

Edited to show custom EncryptedData, Signature elements

   public static void Encrypt(XmlDocument xmlDoc, string elementToEncrypt, SymmetricAlgorithm ts, XmlNamespaceManager nsmgr, string encdataId) //[8]
        {
            XmlNode elementsToEncrypt = xmlDoc.DocumentElement.SelectSingleNode("/s:Envelope/s:Body", nsmgr);

            XmlElement xmlElementToEncrypt = (XmlElement)elementsToEncrypt;
            EncryptedXml encryptedXml = new EncryptedXml();
            byte[] encryptedElement = encryptedXml.EncryptData
                    (xmlElementToEncrypt,ts, true);

            System.Security.Cryptography.Xml.EncryptedData encryptedData = new System.Security.Cryptography.Xml.EncryptedData();
            encryptedData.Id = encdataId;
            encryptedData.Type = EncryptedXml.XmlEncElementUrl;
            encryptedData.EncryptionMethod =
                new System.Security.Cryptography.Xml.EncryptionMethod(EncryptedXml.XmlEncTripleDESUrl);
            // Create a new CipherData object.
            CipherData cd = new CipherData();
            // Assign a byte array to be the CipherValue. This is a byte array representing encrypted data.
            cd.CipherValue = new byte[8];
            encryptedData.CipherData = cd;
            EncryptedXml.ReplaceElement(xmlElementToEncrypt, encryptedData, true);
        }
        public void SignSoapBody(XmlDocument xmlDoc, XmlNode xmlnodeEncKey, string encdataId)
        {
            XmlNamespaceManager nsmgr =
                           new XmlNamespaceManager(xmlDoc.NameTable);
            nsmgr.AddNamespace("s",
                 @"http://www.w3.org/2000/09/xmldsig#");
            X509Certificate2 cert = GetCertificateFromStore("LMWARD");
            string refURI = DateTime.Now.Ticks.ToString();

            // *** Signed XML will create Xml Signature - Xml fragment
            SignedXml signedXml = new SignedXml(xmlDoc);
            signedXml.SigningKey = cert.PrivateKey;
            // *** Create a KeyInfo structure
            KeyInfo keyInfo = new KeyInfo();

            KeyInfoX509Data keyInfoData = new KeyInfoX509Data();
            keyInfoData.AddCertificate(cert);
            keyInfo.AddClause(keyInfoData);
            signedXml.KeyInfo = keyInfo;

            signedXml.SignedInfo.CanonicalizationMethod = SignedXml.XmlDsigC14NTransformUrl;
            // *** Now create reference to sign: Point at the Body element

            Reference reference = new Reference();
            reference.Uri = "#"+ encdataId;  // reference id=body section in same doc
            reference.AddTransform(new XmlDsigExcC14NTransform());  // required to match doc
            signedXml.AddReference(reference);
            // *** Finally create the signature
            signedXml.ComputeSignature();
            XmlElement signedElement = signedXml.GetXml();
            XmlNode SignatureNode = xmlDoc.CreateNode(XmlNodeType.Element, "Signature", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");
            SignatureNode.InnerXml = signedElement.InnerXml;
            // *** And add our signature as content

            XmlNode commonParent = xmlnodeEncKey.ParentNode;
           commonParent.InsertAfter(SignatureNode, xmlnodeEncKey);

        }

Actually the encrypted data method encrypts the soap body, adds a reference ID. i would need some help on the SignSoapBody(...). It needs a SecurityTokenReference inside the KeyInfo element,and moreover different Canonicalization algorithm. It is totally not writing what is needed. See above for how the request should look like.
THis is what it actually writes to the Signature (My code generates the following signature)

 
        
          
          
          
            
              
            
            
            NUOpt38t11pdL0wAPiyFthhYM9Q=
          
        
        kNXiSoBMOeEuoKhUQzuJddNzPrSGxFZIyj0QIp0ngmEbUwQXP25loZBKtX6QB/l913ZX5PGgU7IwCsVjuiCluqqtEGEy7V03gqSKpY+Iz45Md+kyazrfDXDVnPNIZKN8p8K+0QhJmqWA0r1K/sjyYldNiJJd8d12gIRPtDEVGPU=
        
          
            =

Edited 06/26

 
    
    
      
        
      
    
    
      
    
    
      
      ---NOT NEEDE---
    
  
---NOT NEEDED---

Thank you Sun

Yaron Naveh · Accepted Answer

Change MessageSecurityVersion to a value that starts with WSSecurity10

WCF Client Sign only soap body

Answers (1)

Related Questions