如何获得Java应用程序接受的WS-Security证书
因此,我已经与WS-Security斗争了一段时间,慢慢地取得了进展。首先让我简要描述一下我的设置。我在tomcat中运行Java应用程序,它提供了一个webservice端点(使用Spring)。我希望传入的消息被签名。我正在用SoapUI进行测试。因此,经过长时间的努力,我让服务器检查传入的消息是否有签名,并让SoapUI对传出的消息进行签名。但是,服务器不断拒绝证书,我不确定我在哪里做错了什么,即我是否在测试请求中发送了错误的证书信息,或者我没有在信任库中正确维护证书。以下是请求的示例:如何获得Java应用程序接受的WS-Security证书,java,soapui,ws-security,xml-signature,Java,Soapui,Ws Security,Xml Signature,因此,我已经与WS-Security斗争了一段时间,慢慢地取得了进展。首先让我简要描述一下我的设置。我在tomcat中运行Java应用程序,它提供了一个webservice端点(使用Spring)。我希望传入的消息被签名。我正在用SoapUI进行测试。因此,经过长时间的努力,我让服务器检查传入的消息是否有签名,并让SoapUI对传出的消息进行签名。但是,服务器不断拒绝证书,我不确定我在哪里做错了什么,即我是否在测试请求中发送了错误的证书信息,或者我没有在信任库中正确维护证书。以下是请求的示例:
<soapenv:Envelope xmlns="http://movilitas.com/movilizer/v7" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsu:Timestamp wsu:Id="Timestamp-7" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsu:Created>2011-06-30T12:51:33.407Z</wsu:Created>
<wsu:Expires>2011-06-30T12:53:13.407Z</wsu:Expires>
</wsu:Timestamp>
<ds:Signature Id="Signature-6" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#id-2">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>OiRQ2oXbajnnrSGsbOALT2i6brs=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
fmtFMSccFcwEfL1M8qgQ...
</ds:SignatureValue>
<ds:KeyInfo Id="KeyId-C3B38A939F7D63D51F13094382933988">
<wsse:SecurityTokenReference wsu:Id="STRId-C3B38A939F7D63D51F13094382933989" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:KeyIdentifier EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3SubjectKeyIdentifier">
MIICbzCCAdgCAQEwDQ...
</wsse:KeyIdentifier>
</wsse:SecurityTokenReference>
</ds:KeyInfo>
</ds:Signature>
</wsse:Security>
</soapenv:Header>
<soapenv:Body wsu:Id="id-2" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
[...]
</soapenv:Body>
</soapenv:Envelope>
我错过什么了吗?什么大东西?还是小的?这是我应该作为密钥标识符发送的吗?任何帮助都将不胜感激 您不发送证书本身,只发送对证书的引用-使用者密钥标识符。您必须将合作伙伴的公共证书存储在信任库(密钥库)中,或者必须在消息中包含二进制安全令牌。详见第3.3.2节
Jul 5, 2011 4:42:23 PM com.sun.xml.wss.impl.dsig.KeySelectorImpl resolve
SEVERE: WSS1353: Error occurred while resolving key information
com.sun.xml.wss.XWSSecurityException: No Matching public key for MIICbzCCAdgCAQEwDQ... subject key identifier found
at com.sun.xml.wss.impl.misc.DefaultSecurityEnvironmentImpl.getCertificate(DefaultSecurityEnvironmentImpl.java:617)
at com.sun.xml.wss.impl.dsig.KeySelectorImpl.resolve(KeySelectorImpl.java:385)
at com.sun.xml.wss.impl.dsig.KeySelectorImpl.select(KeySelectorImpl.java:232)
...