WS-Security，以及如何进行身份验证

Question

Documentation of the service, says I need to use WS-Security. From they support, i got a p12 file, which I should be using.

What I did so far
I ran up SoapUI application, configured it, added wsdl etc, and got message <faultstring>These policy alternatives can not be satisfied: (...)</faultstring> So I found I need to add basic Auth to the request. And i got my proper answer.

What I need now
I need to use this to SOAP requests, on my PHP application.
First, i changed p12 file into pem , and tried :

$soapClient = new SoapClient('https://int.pz.gov.pl/pz-services/tpSigning?wsdl',
        array('location' => 'https://int.pz.gov.pl/pz-services/tpSigning?wsdl', 
        'trace' => 1,"exceptions" => 1, 
        'local_cert'=>'path/cert_file.pem',
        'passphrase'=>'cert_password'
));

But I am still getting same fail message about policies not being satisfied:

These policy alternatives can not be satisfied: 
{http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}AsymmetricBinding: Received Timestamp does not match the requirements 
{http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}X509Token: The received token does not match the token inclusion requirement 
{http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}SignedParts: Soap Body is not SIGNED in (...)

Help?
Is it even possible with just PHP? I tried several solutions, found some class extending SoapClient (using user/password, not p12/pem file), found even solution in c# (which I am too ready to use if that's what I need to do - sending xml to c# with WebSocket, and sending it back to browser), but non of those worked.

Answer 1

Changing the cert into pem format is the right way. The native PHP soap client class can not handle p12 certs. Have you tried the following?

try {
    $oClient = new SoapClient(
        'https://int.pz.gov.pl/pz-services/tpSigning?wsdl',
        [
            'authentication' => SOAP_AUTHENTICATION_DIGEST,
            'exceptions' => true,
            'local_cert' => dirname(__FILE__) . 'mycert.pem',
            'passphrase' => 'my_passphrase',
            'trace' => true, 
        ]
    );
} catch (SoapFault $oSoapFault) {
    echo "<pre>";
    var_dump($oSoapFault);
    echo "</pre>";
}

The PHP soap client class uses SOAP_AUTHENTICATION_BASIC by default. Perhaps the DIGEST auth is the right way? Normally the cert includes all the data.

You don 't need the location option. The location option is just required, when using non-wsdl conversation with target namespace as uri option without a direct wsdl file.

And always keep in mind: What works with SoapUI isn 't supposed to run with the native PHP client. ;)