WS-Security消息中没有针对已配置的肥皂角色/角色“”的签名！ （来自客户）

Question

我绑定如下

    //Get certificate in bytes[]
            X509Store store = new X509Store(StoreLocation.CurrentUser);
            store.Open(OpenFlags.ReadWrite);
            localCert = new X509Certificate2(cert.File, "mypassword");
            store.Add(localCert);
            certFriendlyName = localCert.FriendlyName;

            //set binding
            SecurityBindingElement security = new TransportSecurityBindingElement();
            X509SecurityTokenParameters item = new X509SecurityTokenParameters(X509KeyIdentifierClauseType.Any, SecurityTokenInclusionMode.AlwaysToRecipient);
            security.EndpointSupportingTokenParameters.SignedEncrypted.Add(item);
            security.IncludeTimestamp = false;
            security.MessageSecurityVersion = MessageSecurityVersion.WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10;
            TextMessageEncodingBindingElement encoding = new TextMessageEncodingBindingElement(MessageVersion.Soap11, Encoding.UTF8);
            HttpsTransportBindingElement transport = new HttpsTransportBindingElement();
            transport.RequireClientCertificate = true;
            System.ServiceModel.Channels.Binding currentBinding = new CustomBinding(security, encoding, transport);
             EndpointIdentity identity = EndpointIdentity.CreateDnsIdentity("mydns");
             EndpointAddress ea = new EndpointAddress(new Uri("MyURI"), identity);


            service.ClientCredentials.ClientCertificate.SetCertificate(StoreLocation.CurrentUser, StoreName.My , X509FindType.FindBySubjectName, certFriendlyName);
             service.ClientCredentials.ServiceCertificate.SetDefaultCertificate(System.Security.Cryptography.X509Certificates.StoreLocation.CurrentUser,
                                                                                           System.Security.Cryptography.X509Certificates.StoreName.My,
                                                                                           System.Security.Cryptography.X509Certificates.X509FindType.FindBySubjectName,
                                                                                           certFriendlyName);

下面是提供的WSDL中的安全策略

<wsp:Policy Name="GAPolicy" wsu:Id="policy.ga" xmlns:wsaws="http://www.w3.org/2005/08/addressing">
    <wsp:ExactlyOne>
        <wsp:All>
            <wsaws:UsingAddressing xmlns:wsaws="http://www.w3.org/2006/05/addressing/wsdl" />
        </wsp:All>
    </wsp:ExactlyOne>
</wsp:Policy>

<wsp:Policy Name="NPPIPolicy" wsu:Id="policy.nppi"
    xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
    <wsp:ExactlyOne>
        <wsp:All>
            <!-- Force the use of WS-Addressing -->
            <wsaws:UsingAddressing xmlns:wsaws="http://www.w3.org/2006/05/addressing/wsdl" />

            <!-- Require a signature on the body of the message -->
            <wsp:SignedParts>
                <wsp:Body />
            </wsp:SignedParts>

            <!-- X.509 Certs in header -->
            <wsp:AsymmetricBinding
                xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                <wsp:Policy>
                    <sp:InitiatorSignatureToken>
                        <wsp:Policy>
                                <sp:X509Token
                                    sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200512/IncludeToken/AlwaysToRecipient" />
                        </wsp:Policy>
                    </sp:InitiatorSignatureToken>
                    <sp:RecipientToken>
                        <wsp:Policy>
                            <sp:X509Token
                                sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Never" />
                        </wsp:Policy>
                    </sp:RecipientToken>
                    <!-- Supported encryption algorithms -->
                    <sp:AlgorithmSuite>
                        <wsp:Policy>
                            <wsp:ExactlyOne>
                                <sp:Basic256 />
                                <sp:TripleDes />
                                <sp:TripleDesSha256 />
                                <sp:TripleDesSha256Rsa15 />
                            </wsp:ExactlyOne>
                        </wsp:Policy>
                    </sp:AlgorithmSuite>
                    <!-- Do not impose an order of layout -->
                    <sp:Layout>
                        <wsp:Policy>
                            <sp:Lax />
                        </wsp:Policy>
                    </sp:Layout>
                </wsp:Policy>
            </wsp:AsymmetricBinding>
        </wsp:All>
    </wsp:ExactlyOne>
</wsp:Policy>

<wsp:Policy Name="PCIPolicy" wsu:Id="policy.pci"
    xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
    <wsp:ExactlyOne>
        <wsp:All>
            <!-- Force the use of WS-Addressing -->
            <wsaws:UsingAddressing xmlns:wsaws="http://www.w3.org/2006/05/addressing/wsdl" />

            <!-- Require a signature on the body of the message -->
            <wsp:SignedParts>
                <wsp:Body />
            </wsp:SignedParts>

            <!-- X.509 Certs in header -->
            <wsp:AsymmetricBinding
                xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                <wsp:Policy>
                    <sp:InitiatorSignatureToken>
                        <wsp:Policy>
                                <sp:X509Token
                                    sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200512/IncludeToken/AlwaysToRecipient" />
                        </wsp:Policy>
                    </sp:InitiatorSignatureToken>
                    <sp:RecipientToken>
                        <wsp:Policy>
                            <sp:X509Token
                                sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Never" />
                        </wsp:Policy>
                    </sp:RecipientToken>
                    <!-- Supported encryption algorithms -->
                    <sp:AlgorithmSuite>
                        <wsp:Policy>
                            <wsp:ExactlyOne>
                                <sp:Basic256 />
                                <sp:TripleDes />
                                <sp:TripleDesSha256 />
                                <sp:TripleDesSha256Rsa15 />
                            </wsp:ExactlyOne>
                        </wsp:Policy>
                    </sp:AlgorithmSuite>
                    <!-- Do not impose an order of layout -->
                    <sp:Layout>
                        <wsp:Policy>
                            <sp:Lax />
                        </wsp:Policy>
                    </sp:Layout>
                </wsp:Policy>
            </wsp:AsymmetricBinding>
        </wsp:All>
    </wsp:ExactlyOne>
</wsp:Policy>

使用此方法，我遇到“ System.ServiceModel.FaultException：WS-Security消息中没有为已配置的肥皂角色/角色“”！（来自客户端）的签名”！

Answer 1

直接使用CustomBinding。 通过引入WsHttpBinding并设置其安全性以期望客户端证书，您可以配置完全不同的安全性模式。 我写了一篇有关此问题的文章 （由于您已经在MSDN上发现了问题）。 从文章中描述的绑定开始或根据您的需要对其进行修改。 所描述的绑定在每个请求消息中使用带有支持证书的双向HTTPS（HTTPS的客户端证书）。