WCF wsHttpBinding和XML签名

Question

I have a WCF SOAP service that responds with licensing information. The client will save the SOAP response and load it every time the program loads, verifying the user is not passed the expiration date etc. Because of this, one of the requirements of the response is to have a signature such that the client can run the data through some encryption algorithm and check the result against the signature that was sent over to verify nothing has been changed about the file. This is nothing new, this is XML signing . However, the service is written with DataContractSerializer, so I can't just take the data, create an XML signature, and inject that straight into the SOAP response.

I know WsHttpBinding has some security features, the WS-Security page on MSDN describes the Ws binding protocol WRT to SOAP as having the ability to...

Identify the entity or entities involved with the message.

Prove that the entities have the correct group memberships.

Prove that the entities have the correct set of access rights.

Prove that the message has not changed.

but I can't find exactly how it does that last part. Looking at the SOAP response I get with WsHttpBinding on, I see CipherData and CipherValue, but researching that leads me to believe that's more to do with the actual message encryption, not content validation. I see something like ValidateResponse and ValidateResult, but those look like spaces for another endpoint to validate the information, and this product needs to work on devices not connected to the internet once the file is gotten from this service.

I know I could theoretically just put all the data into a variable and SHA256 it and tell my client to do the same process but that's dirty and very unstandardized. I feel like there should be an equivalent to XML Signatures for SOAP responses but I can't find anything through searching.

Answer 1

wsHttpBinding supports WS-Security, which includes digital signature in the SOAP message. To enable it, you need to use the ServiceContractAttribute.ProtectionLevel or the OperationContractAttribute.ProtectionLevel on the service contract definition, rather than doing it in the service configuration like you would expect

So, on your service contract:

  [ServiceContract(ProtectionLevel=ProtectionLevel.EncryptAndSign)]
  public interface IMyServiceThatIWantToEncyptAndSign
  {
    ...
  }

or

  [ServiceContract(ProtectionLevel=ProtectionLevel.Sign)]
  public interface IMyServiceThatIWantToSign
  {
    ...
  }

or

[OperationContract(ProtectionLevel=ProtectionLevel.EncryptAndSign)]
string MyOperationThatIWantToEncryptAndSignSign(string msg);

or

[OperationContract(ProtectionLevel=ProtectionLevel.Sign)]
string MyOperationThatIWantToSign(string msg);

The default value for this is ProtectionLevel.None which is why I think you are not seeing any signature.

The relevant MSDN links are here for the service contract:

http://msdn.microsoft.com/en-us/library/system.servicemodel.servicecontractattribute.aspx

and here for the operation contract:

http://msdn.microsoft.com/en-us/library/system.servicemodel.operationcontractattribute.aspx