Encryption 通过Python为soap消息签名

我正在努力用私钥对XML soap消息进行签名。我以前用Java做过，但是用Python做起来很困难。我在主目录中保存了一个模板XML，其中填充了“BinarySecurityToken”和“KeyInfo”标记的值。其中的值是使用相同的私钥通过soapui生成的（因为指向Body标记的URI总是相同的）。之后，我将计算全身标记的摘要值，并将其填充到“SignedInfo”中的“DigestValue”标记中。现在我正对这个签名信息标签进行Canonizing并计算其上的“SignatureValue”。但最终，当我将此Soap XML传递给Web服务时，我会收到一条策略错误消息（因为错误的签名生成），下面是我的代码：

          body = etree.tostring(root.find('.//{http://schemas.xmlsoap.org/soap/envelope/}Body'))
          c14n_exc = True
          ref_xml = canonicalize(body, c14n_exc)
          digest_value = sha1_hash_digest(ref_xml)
          #Inserting the digest Value
          for soapheader in root.xpath('soapenv:Header/wsse:Security/ds:Signature/ds:SignedInfo/ds:Reference', namespaces=ns):
                soaptag = etree.XPathEvaluator(soapheader,namespaces=ns)
                soaptag('ds:DigestValue')[0].text = digest_value

          signed_info_xml = etree.tostring(root.find('.//{http://www.w3.org/2000/09/xmldsig#}SignedInfo'))
          signed_info = canonicalize(signed_info_xml, c14n_exc)
          pkey = RSA.load_key("privkeyifind.pem", lambda *args, **kwargs: "nopass")
          signature = pkey.sign(hashlib.sha1(signed_info).digest())
          signature_value = base64.b64encode(signature)
          #Inserting the signature Value

          for signedInfo in root.xpath('soapenv:Header/wsse:Security/ds:Signature', namespaces=ns):
                signtag = etree.XPathEvaluator(signedInfo,namespaces=ns)
                signtag('ds:SignatureValue')[0].text = signature_value
  canonReq = canonicalize(etree.tostring(root), c14n_exc)
          proc = Popen(["curl", "-k", "-s" ,"--connect-timeout", '3', '--data-binary' , canon2, "https://world-service-dev.intra.aexp.com:4414/worldservice/CLIC/CaseManagementService/V1"], stdout=PIPE, stderr=PIPE)
          response, err = proc.communicate()



#######################################################
#Method to generate the digest value of the xml message
#######################################################
def sha1_hash_digest(payload):
    "Create a SHA1 hash and return the base64 string"
    return base64.b64encode(hashlib.sha1(payload).digest())

#####################################
#Method to canonicalize a request XML
#to remove tabs, line feeds/spaces,
#quoting, attribute ordering and form
#a proper XML
#####################################
def canonicalize(xml, c14n_exc=True):
    "Return the canonical (c14n) form of the xml document for hashing"
    # UTF8, normalization of line feeds/spaces, quoting, attribute ordering...
    output = StringIO()
    # use faster libxml2 / lxml canonicalization function if available
    et = lxml.etree.parse(StringIO(xml))
    et.write_c14n(output, exclusive=c14n_exc)
    return output.getvalue()

---

我只能使用2.6.6的标准Python函数。我无法下载signxml等消息签名库（由于环境的限制）。

您可能需要在另一台机器上下载一份suds（）副本，看看它是如何实现的。我不太明白，但既然你对这个过程比较熟悉，你可能会更快。谢谢你的建议。。。