如何：JavaScript中的wsse soap请求（节点）

Question

I need to communicate with a soap:xml API from a node server on the Wix.com platform. The API requires Soap WSSE authentication.

I can send an authenticated request to the endpoint in SoapUI, however haven't been able successfully do this on the Wix node platform.

Wix only have a subset of node packages available for install and XMLHttpRequest is not available in their environment.

I have tried node-soap but receive errors which indicate the package might be buggy on the Wix node platform.

I've found myself using the node "request" ( https://www.npmjs.com/package/request ) package and trying to roll my own solution to work around missing node packages and environment restrictions.

Currently I can send a request to the end point however I receive the following response;

<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Client</faultcode><faultstring>Access denied</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>\n

This suggests to me i'm not authenticating correctly.

As I mentioned, I've been able to successfully send requests and receive expected responses via SoapUI. So the API is functioning, and I suspect it's my implementation that is at fault. I'll be honest, I've worked with REST/JSON API's in the past, and it has been a long time since i've worked with a SOAP API, and I remember even back then having a whole lot of pain!

my request code

import request from 'request';
import {wsseHeaderAssoc} from 'backend/wsse';

export function getLocationID() {

    let apiUsername = "username";
    let apiPassword = "password";
    let apiURL = "https://api.serviceprovider.com/wsdl";

    // WSSE authentication header vars
    let wsse = wsseHeaderAssoc(apiUsername, apiPassword);
    let wsseUsername = wsse["Username"];
    let wssePasswordDigest = wsse["PasswordDigest"];
    let wsseCreated = wsse["Created"];
    let wsseNonce = wsse["Nonce"];

    let xml =
    `<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:masked:api">`+
        `<soapenv:Header>`+
            `<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">`+
                `<wsse:UsernameToken wsu:Id="UsernameToken-19834957983507345987345987345">`+
                    `<wsse:Username>${wsseUsername}</wsse:Username>`+
                    `<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">${wssePasswordDigest}</wsse:Password>`+
                    `<wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">${wsseNonce}</wsse:Nonce>`+
                    `<wsu:Created>${wsseCreated}</wsu:Created>`+
                `</wsse:UsernameToken>`+
            `</wsse:Security>`+
        `</soapenv:Header>`+
        `<soapenv:Body>`+
        ...
        `</soapenv:Body>`+
    `</soapenv:Envelope>`

    var options = {
    url: apiURL,
    method: 'POST',
    body: xml,
    headers: {
        'Content-Type':'text/xml;charset=utf-8',
        'Accept-Encoding': 'gzip,deflate',
        'Content-Length':xml.length,
        'SOAPAction':"https://api.serviceprovider.com/wsdl/service",
        'User-Agent':"Apache-HttpClient/4.1.1 (java 1.5)",
        'Connection':"Keep-Alive"
    }
    };

    let callback = (error, response, body) => {
    if (!error && response.statusCode == 200) {
        console.log('Raw result ', response);

        // If you ever get this working, do some mad magic here
    };
    console.log('Error ', response);  
    };

}

I'm using wsse-js ( https://github.com/vrruiz/wsse-js/blob/master/wsse.js ) to generate the PasswordDigest, Created datetime stamp and Nonce as the node wsse package ( https://www.npmjs.com/package/wsse ) isn't available on Wix. I've read over the code and based on what i've read elsewhere this looks like a good implementation.

I made one small addition to return the generated details in an assoc array;

export function wsseHeaderAssoc(Username, Password) {
    var w = wsse(Password);
    var wsseAssoc = [];
    wsseAssoc["Username"] = Username;
    wsseAssoc["PasswordDigest"] = w[2];
    wsseAssoc["Created"] = w[1];
    wsseAssoc["Nonce"] = w[0];
    return wsseAssoc;
}

As stated earlier i'm receiving a response of;

<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Client</faultcode><faultstring>Access denied</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>\n

And i'm expecting a valid SOAP XML response.

I've used the raw xml structure and headers from SoapUI to construct this, everything looks fine, i really have no idea where i'm going wrong.

I would love any pointers anyone could throw my way - I've lost 2 days trying to brute force this, I need help.

Answer 1

You can use the WSSecurity method from the soap package. An example from their README:

  var options = {
    hasNonce: true,
    actor: 'actor'
  };
  var wsSecurity = new soap.WSSecurity('username', 'password', options)
  client.setSecurity(wsSecurity);