I am trying to consume a SOAP 1.1 web service that runs on top of Oracle Web Logic, from a WCF client. The service implements the standard Oasis WS-Security 1.2, with body signing and encryption (sign before encrypt) and algorithms Basic256Sha256, and LaxTimestampLast configuration layout.
I am able to send the message signed and encrypted, with the expected format:
<s:Envelope
xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<o:Security s:mustUnderstand="1"
xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<e:EncryptedKey Id="_0"
xmlns:e="http://www.w3.org/2001/04/xmlenc#">
<e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"
xmlns="http://www.w3.org/2000/09/xmldsig#"/>
</e:EncryptionMethod>
<KeyInfo
xmlns="http://www.w3.org/2000/09/xmldsig#">
<o:SecurityTokenReference>
<o:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1">h5cRJR6NnWrnf3PvAPJ4iB70Tow=</o:KeyIdentifier>
</o:SecurityTokenReference>
</KeyInfo>
<e:CipherData>
<e:CipherValue>fOgGM...Ixw==</e:CipherValue>
</e:CipherData>
<e:ReferenceList>
<e:DataReference URI="#_2"/>
</e:ReferenceList>
</e:EncryptedKey>
<o:BinarySecurityToken u:Id="uuid-792fca62-dad8-442e-b720-d52f48768dd0-1" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">MIIFf...O2A8=</o:BinarySecurityToken>
<Signature
xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="#_1">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<DigestValue>0OiBt3eXZek5bJ9d9CFsduwbtQVoFY3DvFqxfnQz7Dg=</DigestValue>
</Reference>
<Reference URI="#uuid-a1958c98-41b5-40d4-bdaa-2c0948d4f526-1">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<DigestValue>PtcCDNfz7ocVM86qgSnDFnUUJnVz6E884Ll9QeV6Wfg=</DigestValue>
</Reference>
<Reference URI="#uuid-792fca62-dad8-442e-b720-d52f48768dd0-1">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<DigestValue>SezODccgkQ2rfYtKfSxAC14igVpLxbfQtKChSddDf+c=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>j6XPB.../ow==</SignatureValue>
<KeyInfo>
<o:SecurityTokenReference>
<o:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1">D5Myi4vs+Af3Dg1ByUs1kCKm55E=</o:KeyIdentifier>
</o:SecurityTokenReference>
</KeyInfo>
</Signature>
<u:Timestamp u:Id="uuid-a1958c98-41b5-40d4-bdaa-2c0948d4f526-1">
<u:Created>2017-11-06T20:43:29.722Z</u:Created>
<u:Expires>2017-11-06T20:48:29.722Z</u:Expires>
</u:Timestamp>
</o:Security>
</s:Header>
<s:Body u:Id="_1"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<e:EncryptedData Id="_2" Type="http://www.w3.org/2001/04/xmlenc#Content"
xmlns:e="http://www.w3.org/2001/04/xmlenc#">
<e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
<e:CipherData>
<e:CipherValue>L7f+O...Rw7jHL</e:CipherValue>
</e:CipherData>
</e:EncryptedData>
</s:Body>
</s:Envelope>
However, when getting the response:
<?xml version='1.0' encoding='UTF-8'?>
<S:Envelope
xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
<env:Header>
<wsse:Security
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" S:mustUnderstand="1">
<ns1:EncryptedKey
xmlns:ns1="http://www.w3.org/2001/04/xmlenc#" Id="18iq0thuJbDO21Gk">
<ns1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">
<ns2:DigestMethod
xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
</ns1:EncryptionMethod>
<ns3:KeyInfo
xmlns:ns3="http://www.w3.org/2000/09/xmldsig#">
<wsse:SecurityTokenReference
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsse11:TokenType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="str_nczorGBwzUSf1PJG">
<wsse:KeyIdentifier EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1">D5Myi4vs+Af3Dg1ByUs1kCKm55E=</wsse:KeyIdentifier>
</wsse:SecurityTokenReference>
</ns3:KeyInfo>
<ns1:CipherData>
<ns1:CipherValue>VLX9L...jTQ==</ns1:CipherValue>
</ns1:CipherData>
<ns1:ReferenceList>
<ns1:DataReference URI="#XgzvGdpjeeFiU0AH"/>
</ns1:ReferenceList>
</ns1:EncryptedKey>
<wsse11:SignatureConfirmation
xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="sigconf_gF2mG4MS0QT3gGyg" Value="j6XPB.../ow=="/>
<dsig:Signature
xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
<dsig:SignedInfo>
<dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<dsig:Reference URI="#Timestamp_be1msZa7e60oVdtW">
<dsig:Transforms>
<dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</dsig:Transforms>
<dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<dsig:DigestValue>mWxC8kSZIGKE1KTyVWbr2YgOmE1UqVNV3lS4vdM4kdM=</dsig:DigestValue>
</dsig:Reference>
<dsig:Reference URI="#Body_fr2ndXxiUtwuP3Y2">
<dsig:Transforms>
<dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</dsig:Transforms>
<dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<dsig:DigestValue>ZztOfa8rAv2aaMUxxKaYAPgUbEfIZRe/1ZRgPacmAlc=</dsig:DigestValue>
</dsig:Reference>
<dsig:Reference URI="#sigconf_gF2mG4MS0QT3gGyg">
<dsig:Transforms>
<dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</dsig:Transforms>
<dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<dsig:DigestValue>AfX4C1zXqAIX1pEHPw7PHEhf/g/8JWACJqgX7p63RkI=</dsig:DigestValue>
</dsig:Reference>
<dsig:Reference URI="#str_RLjzz112Lwz91VZF">
<dsig:Transforms>
<dsig:Transform Algorithm="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#STR-Transform">
<wsse:TransformationParameters>
<dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</wsse:TransformationParameters>
</dsig:Transform>
</dsig:Transforms>
<dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<dsig:DigestValue>gRa3zakGn13XISoKpekB3zl0iDqb/LmNy7+aMDtzKIY=</dsig:DigestValue>
</dsig:Reference>
</dsig:SignedInfo>
<dsig:SignatureValue>xlVJb...EPZg==</dsig:SignatureValue>
<dsig:KeyInfo>
<wsse:SecurityTokenReference
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsse11:TokenType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="str_RLjzz112Lwz91VZF">
<wsse:KeyIdentifier EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1">h5cRJR6NnWrnf3PvAPJ4iB70Tow=</wsse:KeyIdentifier>
</wsse:SecurityTokenReference>
</dsig:KeyInfo>
</dsig:Signature>
<wsu:Timestamp
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Timestamp_be1msZa7e60oVdtW">
<wsu:Created>2017-11-06T20:43:30Z</wsu:Created>
<wsu:Expires>2017-11-06T20:44:30Z</wsu:Expires>
</wsu:Timestamp>
</wsse:Security>
</env:Header>
<S:Body
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Body_fr2ndXxiUtwuP3Y2">
<ns1:EncryptedData
xmlns:ns1="http://www.w3.org/2001/04/xmlenc#" Id="XgzvGdpjeeFiU0AH" Type="http://www.w3.org/2001/04/xmlenc#Content" MimeType="text/xml">
<ns1:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
<ns1:CipherData>
<ns1:CipherValue>GT08G...PqanY</ns1:CipherValue>
</ns1:CipherData>
</ns1:EncryptedData>
</S:Body>
</S:Envelope>
The client test fails with this error:
Test Name: TestMethod_CodedCustomBinding
Test FullName: Integration.TestServiceClient.Tests.CodeClientTests.TestMethod_CodedCustomBinding
Test Source: C:\Source\Integration.TestServiceClient.Tests\CodeClientTests.cs : line 207
Test Outcome: Failed
Test Duration: 0:00:00.9372511
Result StackTrace:
at System.IdentityModel.StandardSignedInfo.EnsureAllReferencesVerified()
at System.IdentityModel.SignedXml.CompleteSignatureVerification()
at System.ServiceModel.Security.WSSecurityOneDotZeroReceiveSecurityHeader.ExecuteMessageProtectionPass(Boolean hasAtLeastOneSupportingTokenExpectedToBeSigned)
at System.ServiceModel.Security.ReceiveSecurityHeader.Process(TimeSpan timeout, ChannelBinding channelBinding, ExtendedProtectionPolicy extendedProtectionPolicy)
at System.ServiceModel.Security.MessageSecurityProtocol.ProcessSecurityHeader(ReceiveSecurityHeader securityHeader, Message& message, SecurityToken requiredSigningToken, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates)
at System.ServiceModel.Security.AsymmetricSecurityProtocol.VerifyIncomingMessageCore(Message& message, String actor, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates)
at System.ServiceModel.Security.MessageSecurityProtocol.VerifyIncomingMessage(Message& message, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates)
--- End of inner exception stack trace ---
Server stack trace:
at System.ServiceModel.Security.MessageSecurityProtocol.VerifyIncomingMessage(Message& message, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates)
at System.ServiceModel.Channels.SecurityChannelFactory`1.SecurityRequestChannel.ProcessReply(Message reply, SecurityProtocolCorrelationState correlationState, TimeSpan timeout)
at System.ServiceModel.Channels.SecurityChannelFactory`1.SecurityRequestChannel.Request(Message message, TimeSpan timeout)
at System.ServiceModel.Dispatcher.RequestChannelBinder.Request(Message message, TimeSpan timeout)
at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)
Exception rethrown at [0]:
at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
at Integration.ServiceClient.TestServiceClient.ServiceWs.notify(notifyRequest request)
at Integration.ServiceClient.TestServiceClient.ServiceWsClient.Integration.ServiceClient.TestServiceClient.ServiceWs.notify(notifyRequest request) in C:\Source\Integration.ServiceClient\Service References\TestServiceClient\Reference.cs:line 994
at Integration.ServiceClient.TestServiceClient.ServiceWsClient.notify(Int64 idNotification) in C:\Source\Integration.ServiceClient\Service References\TestServiceClient\Reference.cs:line 1000
at Integration.TestServiceClient.Tests.CodeClientTests.TestMethod_CodedCustomBinding() in C:\Source\Integration.TestServiceClient.Tests\CodeClientTests.cs:line 212
Result Message:
Test method Integration.TestServiceClient.Tests.CodeClientTests.TestMethod_CodedCustomBinding threw exception:
System.ServiceModel.Security.MessageSecurityException: Message security verification failed. ---> System.Security.Cryptography.CryptographicException: Unable to resolve the '#str_RLjzz112Lwz91VZF' URI in the signature to compute the digest.
However, the URI is present in the SecurityTokenReference tag inside the Signature > KeyInfo tag. Any idea about why this reference is not being found during the signature validation, and what can be done to resolve this error?
Please note:
you cannot use CertificateOverTransport and sign the message body.
WCF will not allow this, if you are doing this.
in this case, try using MutualCertificateDuplex and change your protection level to none: ProtectionLevel.None if you are not interested in signing the response.
If this fails, try to add custom binding to your WCF:
<customBinding>
<binding name="NewBinding0">
<textMessageEncoding messageVersion="Soap11" />
<security authenticationMode="MutualCertificateDuplex" includeTimestamp="false"
messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">
<secureConversationBootstrap />
</security>
<httpTransport />
</binding>
</customBinding>
This will allow your certificate to be digested correctly.
Related
I'm using the Systainsys SAML2 owin library in a .Net 4.8. After enabling logging I get this response logged. I don't understand what the issue is I'm redacting some of the stuff in the SAML response JIC
Saml2 Authentication failed. The received SAML data is
<?xml version="1.0" encoding="UTF-8"?>
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Destination="https://####.####.com/Saml2/Acs" ID="_c68e19d777a7a13bab9ff8d54e83ad54" InResponseTo="id4cced0bf2ffe4967a605d630433a5b72" IssueInstant="2020-12-29T08:34:21Z" Version="2.0">
<saml:Issuer>https://ut1-www.is.sg.######.com/_fed/1/244023058963</saml:Issuer>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
<Reference URI="#_c68e19d777a7a13bab9ff8d54e83ad54">
<Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>gDIpQQwjNoeuy99R70CK3foRdds=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>quIekezIAu/n4BzOFuhFLqGhV4s80O0dPeogYufJq/oz6hxFqVETwnZ4ogd+62gyAX7EpRQ2q/NT
EdnnonD7RIVK89E5/K+LXjNWpXGxYFOmyrjUVCpWpo4WoNh720TkRwAAOnDSSnimb/EZf/c74dFp
4O5oNPC2r1uYYZ2ka6Zz0BcwnDIkFnJ60Q90ooJlYKZyBgGWpia7iyr3B61FCb/4bd6XWo5f3OZX
+mUPkacouj8nvYVAnbvOZZd+jXsOEkPvBCiCT+iEOrd4zzGkdPnowN9/eDljGYmBvT7GdqkrDIN6
2UMiBArIe0lk9LkhLNSHWl0o4Fd7ca6i96tZeA==</SignatureValue>
<KeyInfo>
<X509Data>
<X509Certificate>MIIDA....</X509Certificate>
</X509Data>
</KeyInfo>
</Signature>
<samlp:Status>
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
</samlp:Status>
<saml:Assertion ID="_4c8ae5013fa6e1c8ba67d5274cec9bbd" IssueInstant="2020-12-29T08:34:21Z" Version="2.0">
<saml:Issuer>https://ut1-www.is.sg.#####.com/_fed/1/244023058963</saml:Issuer>
<saml:Subject>
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">######</saml:NameID>
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData InResponseTo="id4cced0bf2ffe4967a605d630433a5b72" NotOnOrAfter="2020-12-29T08:39:21Z" Recipient="https://#####.#####.com/Saml2/Acs" />
</saml:SubjectConfirmation>
</saml:Subject>
<saml:Conditions NotBefore="2020-12-29T08:34:21Z" NotOnOrAfter="2020-12-29T08:39:21Z">
<saml:AudienceRestriction>
<saml:Audience>https://####.#####.com/SAML2</saml:Audience>
</saml:AudienceRestriction>
</saml:Conditions>
<saml:AuthnStatement AuthnInstant="2020-12-29T08:34:21Z">
<saml:AuthnContext>
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
</saml:AuthnContext>
</saml:AuthnStatement>
</saml:Assertion>
</samlp:Response>
Edit
After enabling the Katana logging I got this error
Microsoft.IdentityModel.Tokens.SecurityTokenInvalidAudienceException: IDX10214: Audience validation failed. Audiences: 'https://.soterion.com/SAML2'. Did not match: validationParameters.ValidAudience: 'https://.soterion.com/Saml2' or validationParameters.ValidAudiences: 'null'.
at Microsoft.IdentityModel.Tokens.Validators.ValidateAudience(IEnumerable`1 audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) in C:\agent2_work\15\s\src\Microsoft.IdentityModel.Tokens\Validators.cs:line 108
at Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler.ValidateConditions(Saml2SecurityToken samlToken, TokenValidationParameters validationParameters) in C:\agent2_work\15\s\src\Microsoft.IdentityModel.Tokens.Saml\Saml2\Saml2SecurityTokenHandler.cs:line 948
The Owin library is very non-friendly when troubleshooting. Enable the Katana logging to get some more details.
You need to set tokenvalidationparameters. value of Audiences would be entity ID of your application and then pass tokenvalidationparamter to validate.
TokenValidationParameter parameters = new TokenValidationParameters();
parameters.ValidAudiences = new string[] {entity ID of SP}
We're currently porting a SOAP client to .NET Core but we're having issues on authentication. Based on our findings, it all boils down to adding both a UsernameToken and Signature to the SOAP Header. In .NET Framework, we authenticate like so:
WebServicesClientProtocol client;
X509SecurityToken token;
client.RequestSoapContext.Security.Tokens.Add(new UsernameToken("myusername", "mypassword", PasswordOption.SendPlainText);
client.RequestSoapContext.Security.Tokens.Add(token);
client.RequestSoapContext.Security.Elements.Add(new MessageSignature(token));
We added a WCF Connected Service to our .NET Core project and tried different configurations of the client. The closest we got are something like these:
// this adds UsernameToken only
var binding = new BasicHttpBinding(BasicHttpSecurityMode.TransportWithMessageCredential);
var client = new MyClient(binding, new EndpointAddress("https://myservice.com/foo");
client.ClientCredentials.UserName.UserName = "myusername";
client.ClientCredentials.UserName.Password = "mypassword";
---
// this adds Signature only
var binding = new BasicHttpBinding(BasicHttpSecurityMode.TransportWithMessageCredential);
binding.Security.Message.ClientCredentialType = BasicHttpMessageCredentialType.Certificate;
var client = new MyClient(binding, new EndpointAddress("https://myservice.com/foo"));
client.ClientCredentials.ClientCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.My, X509FindType.FindBySubjectName, "mycert");
Unfortunately, combining the two does not add both UsernameToken and Signature. We've tried many other variations of the configuration but was not successful.
Our working SOAP request looks something like this:
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing"
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<soap:Header>
<wsa:Action wsu:Id="Id-867b67fc-b2c7-4ca3-bcbb-fdf74ae04baf">http://myservice.com/foo/services/my_request</wsa:Action>
<wsa:MessageID wsu:Id="Id-e8c0e394-e80f-453b-b5d6-10369c186b02">urn:uuid:1aad204d-a5f4-4b33-986c-56011dc27ade</wsa:MessageID>
<wsa:ReplyTo wsu:Id="Id-790537dd-870a-45e0-9873-427684db6ea1">
<wsa:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</wsa:Address>
</wsa:ReplyTo>
<wsa:To wsu:Id="Id-791bacd6-af9b-4c45-ad13-e7297a8c8ea2">https://myservice.com/foo/services/abcServices</wsa:To>
<wsse:Security soap:mustUnderstand="1">
<wsu:Timestamp wsu:Id="Timestamp-6a6fb289-7878-413c-b88d-42f0522faa31">
<wsu:Created>2020-09-29T22:56:15Z</wsu:Created>
<wsu:Expires>2020-09-29T22:57:15Z</wsu:Expires>
</wsu:Timestamp>
<wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-2cca8c34-352c-4301-8bb5-da46a8c70746">
<wsse:Username>myusername</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">mypassword</wsse:Password>
<wsse:Nonce>ikb=nqrsp+OH=jEMDl+a1fgC</wsse:Nonce>
<wsu:Created>2020-09-29T22:56:15Z</wsu:Created>
</wsse:UsernameToken>
<wsse:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-7068c9fb-9793-451e-b462-aedf192c57aa">DciPWRsnJhRAOZCeZAwGCV9OzzucIYwvgAVbX46MIQAZNGSgQBcNcEMDDylCc90RdwAV/9XwDB30mJgiV5M8o6ImCggQogABgp0XNTBJnrugnYIGIAj+QUZ0zZivg9Uu/0BxKScQqcGbK43AwEAgwjNPGQ+AXwBAQVMsgFA80OIsQ1IwIwzxGApSzX2A5gY0cVx9rjnMrv+9ctmoqELA91fAgVBcVkATBUTnwQZExrHfxzAwYxAL5jBrngrgK9A2YYDBFDCVrDajRrCdcHM5RQhIwPbBBWMQZTQCAtwuDBsOCkYJKwSbUjvx3Ypg7nTsskyJeP3DPYVtOxpUkEIRYwuisEwANlGMBzmWEbNxMRUQGL2R1/BPFCzXbC/RMMQAVAVlAFB4MwaXYwdopUdMSAzT4F00YswQLf6MMxWDWqlCFwQ98GdHE1K0MnS1weWa+FQ0DVXQVK/JwUukgHvfvplVBPScuWjQAEMMiTSEa94Y5ES5dNdafc5cKIbzbkJCGCsVxxAQl8guEdJQH0cWKC9gROZYqYYFVGjBPkmLi9QgaEpPdBToRtDgTacqty1XyBdhDY3ntJYyxMaAHDeI0KIdKvDBIMCsX2xA8bQ2O8pCdFwQ37GUy1bMfTul7+JQfyyFZknHuVxuiWvNUsoGo0sQn2H3NODdLjMpLgVp3P3MmNc9AuSBzQw3WAGzNR7FnB1fU4VaLzciAAHFiA1LMwbMoIH2FcB907QjFNy08c8BBDoSgdUIp+BxGKyHATeqmHHI7iRsX0BuNv1VuSfnrjAANIWoQNA97DAKnSId5IEG39SaSesXunHQUsCrAMvA9yjcSLjXAxUT7DD2iQgINBLuMmqCz1Y9zUQggC7/I5NUDXO94jAxUg1gVgZZHcbA53SMsA57VwCAUI6AslwA7pGHq2YwbwBTg0Mb+cnEZjA9SuGVeuDnHmVZxgUjWds5snOH+enkMA+BhTzNR7HGNM1AElK0BkfCrgwyqAq22kdc7DnUYGEISIaDm0NYIA1QwBf+J7dwXaBHLmcG7ANAClBXfAQQXAN0g2/zGgFYNKhcgK2HoggNlByd2T0md0Rje00BG9QZlY5DXFNEArT+BPw1TqHYGHEgJhupWG7tsDg/DjANqUVyVEWp4xVjOh9YDIuq8U0TqmD4HVNbbIi2rMTVhZACYoscERM5guBoW4b2u2CCArlFVw1MOELOETnJQKQGNWNaWNVVDjYTsCqMkbqwRU59ijlZIUzhKDFgk098vCDCIwUMhEdA0VYLJvhuNc0QRp9Lakposm9LTKPZAz7yiSF5gwGsjqMACBDwOQMSBEQAaMGN3HNYMFABJQDl1UAbCBZa5gbWwLNdHZhzaawoARcul0Cn6QPQT7BGZGdUcYAlFVMl6k1n3dB70JzcWMapJpZFlI6Bn3IB/RhGDMIQ3D3E/n9wbQZKMDEAbR3VB8WMGZ3lzuHTaUbo2wB5l8Z2I5kt2DsmG7+9DkEYCGCzFA1mGlnIRQmcLBwHJxMRNyPgt0r3XFbIg8+EgzmaFm0M9lbSUVmb5ExAL5++kWxjIzE2oco1kY8sdOtB8OBfQlMyPv9+rEZrz+EDCkxAAIAtkaDRAqwBHpnM7gZmlQObRtgkWhAEbHnQ0Uk9p6geUwqQFAW14vG9Jge/ALNNAdw0AFw0VXmRgCYpLVFFgQoYBWWYH4CBFGidBAAhlDK5/MAjcZMR7S3RRpwvYUNBEorAcNmw1BEv3AjNawWPoI0gANGAHxrAR7Qm6cDIGNoYBLzUCGDfdxASw5gt9wvaN0mPu+JMARO/VfAMd7GY0TGmdDgImtbIKWE6Nnw0bIFi1XCH9AIDHb06Q8ufOxuxM0vz5IBnQLXWyEMQsRiJOBga4Mn0CBhQtciAwQmiqCqxAEj3ywDau2xAEvnEIOoEoxwyWQDHjYrCmSGUUbfM1Pd3WRYgAhTzYwz9fMF3AH0DcapF/IQdILuPBXxIpIGbbgwaCaM+LB4mZo5lBAROlBQrjYiYLjAVBU2zwH70EW49PAoA4GEwEpBIimD4ErDVLDk909BS8QH2y5Bq/BQMYOMIzUvbQkPOjR8EKRA0A+Gkvl8gMRwWYT17RipgAFENrrdSYsYooM5CdQAxs3NJRQLoegJRDcCMKAjjTWC4/AErgoTR1YmDdBBANzcP5ZVFUKOBEA3fvmkBQWnxOjBEjiQzSggLv+m12YsAjx0RdCqwW5VgUw=IAgRGRPVLWBIBVdNP0wWtHBt7esoIOSjDDLAxhftDgMY78oWkxMM8lxRm</wsse:BinarySecurityToken>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#" />
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
<Reference URI="#Id-157ede06-c0ff-4092-861c-74b7ed541bda">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>GMl851P/=af8OP8gf45n8xsL3fg/</DigestValue>
</Reference>
<Reference URI="#Id-ae995838-928a-452e-be22-633ca120855b">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>=VADYKMj8xOqZJZyReClqof3Ve3S</DigestValue>
</Reference>
<Reference URI="#Id-583f212c-afe0-4b2a-8f24-94a61ab01c11">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>OUa3ZYsm9=soUTrZ/51ko8YZ1UeX</DigestValue>
</Reference>
<Reference URI="#Id-3549607b-958f-4a73-887a-6e25c400368d">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>RCAWZo4o=R3wGfSUZhnA0VSxccEm</DigestValue>
</Reference>
<Reference URI="#Timestamp-814589a1-8fa8-4d05-bcb5-2cd5e59e4f95">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>nrSGxl2bQ6Ul2Wzgl27nb3ME8=p1</DigestValue>
</Reference>
<Reference URI="#Id-c4508205-7502-451a-b57c-ef3bae807828">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>IO5AN6rcQ7gmf+oyZ=YX+hcXamHa</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>wad2UgTSA/1JONW+s1gv/CVHJ85nwuRdakOx57Fpg+jS7R+LWHCAqXljtNS07OdFMHYrrpObgIIs5aSKXJfcdZy/bPuRkQKV=23GUMB3E90c2n42nHFn99ZqMGQJfHpukT71g1exbtlLwQgtCHq903ttBXEB/tkzvfKbQgbR+46gxRCjwlKiDvpUQBngcMOhyf8TZ6dgOWThIMZubJhzd7eXP5rLEl+L4qpOBosFJm6I5HcRSZaF/b/=4JT7U0KmCCLkEaUG+XdGmUyPcdLLGUpOhVh9P74rC7gBxnnyY9+djdu9qu7ibyRjGhngqjNOYu1wNI+Bi5ptK5vjgPwFa15H</SignatureValue>
<KeyInfo>
<wsse:SecurityTokenReference>
<wsse:Reference URI="#SecurityToken-61f81057-6b05-43c1-9b51-75a9a554f9f0" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" />
</wsse:SecurityTokenReference>
</KeyInfo>
</Signature>
</wsse:Security>
</soap:Header>
<soap:Body wsu:Id="Id-82864924-6cd8-44d4-955d-cd6ed8bf8067">
<myRequest xmlns="http://myservice.com/foo/params">
<foo>12345</foo>
<bar>baz</bar>
</myRequest>
</soap:Body>
</soap:Envelope>
Appreciate any help! Thank you!
Core does not support the security of the message layer, you can change the security of the message layer to the transport layer or use the .net framework:
For more information about WCF in core, please refer to this link:
https://github.com/dotnet/wcf/blob/master/release-notes/SupportedFeatures-v2.1.0.md
I’m trying to connect to a SOAP WS with the following features:
HTTPS
Signed Timestamp
Signed Body
Not encrypted Request
That's an example of the Soap Request I want:
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsu:Timestamp xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Timestamp-c1cf1e29">
<wsu:Created>2018-08-29T10:20:58Z</wsu:Created>
<wsu:Expires>2018-08-29T10:25:58Z</wsu:Expires>
</wsu:Timestamp>
<wsse:BinarySecurityToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-2e4f8773"
EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">
[...]
</wsse:BinarySecurityToken>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="#Timestamp-c1cf1e29">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>........</DigestValue>
</Reference>
<Reference URI="#Body-d96b5e74">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>........</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>
[...]
</SignatureValue>
<KeyInfo>
<wsse:SecurityTokenReference xmlns="">
<wsse:Reference URI="#SecurityToken-2e4f8773" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
</wsse:SecurityTokenReference>
</KeyInfo>
</Signature>
</wsse:Security>
</soapenv:Header>
<soapenv:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Body-d96b5e74">
[...]
</soapenv:Body>
</soapenv:Envelope>
I’m connecting thought WCF and I’ve created a custom binding that works via HTTPS, gives me the timestamp signed and is not encrypted, but I’m not able to sign the body.
I use a X509 Certificate for sign the timestamp.
That's the binding I'm using:
<binding name="customBind">
<security allowInsecureTransport="true" includeTimestamp="true"
requireDerivedKeys="false" authenticationMode="CertificateOverTransport" />
<textMessageEncoding messageVersion="Soap11" writeEncoding="UTF-8"/>
<httpsTransport />
</binding>
I’ve tried different bindings like wsHttpBinding, ws2007HttpBinding, basicHttpBinding, wsHttpContextBinding… with different configurations, with no succeed.
Any idea?
Thanks!
I'm trying to consume an external web service (as far as I can see it is an axis2/apache service) with a .NET 3.5 WCF client.
The service expects incoming messages to be signed and encrypted using x509 certificates. Signing and encrypting seems to work so far, but WCF adds a second <signature> element in the SOAP header, which confuses the remote web service.
I am unable to get rid of this second signature element. What I found while researching the matter is, that this signature is used to sign the first signature.
My WCF configuration currently uses a custom binding with the following security settings:
<security messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"
authenticationMode="MutualCertificate"
securityHeaderLayout="Lax"
defaultAlgorithmSuite="Basic128"
includeTimestamp="false"
keyEntropyMode="CombinedEntropy"
requireDerivedKeys="false"
messageProtectionOrder="SignBeforeEncrypt"
requireSignatureConfirmation="true">
Anybody has an idea as what I have to change to make this work?
A sample SOAP request generated by my client looks like this:
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<e:EncryptedKey Id="uuid-0a13788c-6cb3-4fe2-940b-1e220d15230e-3" xmlns:e="http://www.w3.org/2001/04/xmlenc#">
<e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns="http://www.w3.org/2000/09/xmldsig#"/>
</e:EncryptionMethod>
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<o:SecurityTokenReference>
<o:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"><!-- ... --></o:KeyIdentifier>
</o:SecurityTokenReference>
</KeyInfo>
<e:CipherData>
<e:CipherValue><!-- ... --></e:CipherValue>
</e:CipherData>
<e:ReferenceList>
<e:DataReference URI="#_2"/>
</e:ReferenceList>
</e:EncryptedKey>
<o:BinarySecurityToken>
<!-- Removed-->
</o:BinarySecurityToken>
<Signature Id="_0" xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/>
<Reference URI="#_1">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue><!-- ... --></DigestValue>
</Reference>
</SignedInfo>
<SignatureValue><!-- ... --></SignatureValue>
<KeyInfo>
<o:SecurityTokenReference k:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" xmlns:k="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd">
<o:Reference ValueType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" URI="#uuid-0a13788c-6cb3-4fe2-940b-1e220d15230e-3"/>
</o:SecurityTokenReference>
</KeyInfo>
</Signature>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="#_0">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue><!-- ... --></DigestValue>
</Reference>
</SignedInfo>
<SignatureValue><!-- ... --></SignatureValue>
<KeyInfo>
<o:SecurityTokenReference>
<o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-9618ae47-8bcd-4a96-b56e-800759a0ee57-7"/>
</o:SecurityTokenReference>
</KeyInfo>
</Signature>
</o:Security>
</s:Header>
<s:Body u:Id="_1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<e:EncryptedData Id="_2" Type="http://www.w3.org/2001/04/xmlenc#Content" xmlns:e="http://www.w3.org/2001/04/xmlenc#">
<e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
<e:CipherData>
<e:CipherValue><!-- ... --></e:CipherValue>
</e:CipherData>
</e:EncryptedData>
</s:Body>
</s:Envelope>
Turns out I was using the wrong messageSecurityVersion value. With a value of WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10 only a single signature is added to the SOAP header.
Afterwards the server was able to understand the requests. Some tweaks to the defaultAlgorithmSuite and now service and client are talking and understanding each other.
What is the best/doable way to implement SOAP, ws-security in C#.
These are the required security tokes as per documentation
–
Required Security
Tokens
•Username Token (username, password, timestamp and nonce)
•User cert
•Server cert
In the past When I created a SAOP+ HTTP request, I used a stringbuider and appended the request
stringbuilder sb = new stringbuilder();
Then finally used HTTPWebrequest.create(url) and then a HTTP post.
Any hints on how to start would help. Can anyone point me to some tutorials. I have used a certificate generating tool to generate a certificate.
I haven't really understood a good way to do this even after 3days of research and fiddling with certificates and web.configs
here's an example of a sample request in the documentation
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:mhs="http://org/TEST/mhs/" xmlns:urn="urn:hl7-org:v3">
<soapenv:Header>
<wsse:Security soap:mustUnderstand="1" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-e00c8062-83d2-4f04-88fc-996218e7bb3d">MIICeDCC....(signed user MLS cert).......</wsse:BinarySecurityToken>
<wsse:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-c0cc2cd4-cb77-4fa5-abfa-bd485afd1685">MIIDFj.....( MLS web-service end-point public cert)........</wsse:BinarySecurityToken>
<wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-970e9a80-00cc-4c86-8ec4-3ba16e029a5b">
<wsse:Username>....your_username.....</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">.....your_plaintext_password....</wsse:Password>
<wsse:Nonce>KNyu6MsXCkTg4DDyvwvEiw==</wsse:Nonce>
<wsu:Created>2010-09-15T18:00:30Z</wsu:Created>
</wsse:UsernameToken>
<xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<wsse:SecurityTokenReference>
<wsse:Reference URI="#SecurityToken-c0cc2cd4-cb77-4fa5-abfa-bd485afd1685" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
</wsse:SecurityTokenReference>
</KeyInfo>
<xenc:CipherData>
<xenc:CipherValue>gpBAWt91pdwhKva............</xenc:CipherValue>
</xenc:CipherData>
<xenc:ReferenceList>
<xenc:DataReference URI="#Enc-0641b860-b16d-4941-91c0-d60bece67794"/>
</xenc:ReferenceList>
</xenc:EncryptedKey>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="#Id-f10674fd-b999-47c9-9568-c11fa5e5405b">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>wRUq.........</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>tBSsaZi........</SignatureValue>
<KeyInfo>
<wsse:SecurityTokenReference>
<wsse:Reference URI="#SecurityToken-e00c8062-83d2-4f04-88fc-996218e7bb3d" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
</wsse:SecurityTokenReference>
</KeyInfo>
</Signature>
</wsse:Security>
</soapenv:Header>
<soapenv:Body wsu:Id="Id-f10674fd-b999-47c9-9568-c11fa5e5405b" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<xenc:EncryptedData Id="Enc-0641b860-b16d-4941-91c0-d60bece67794" Type="http://www.w3.org/2001/04/xmlenc#Content" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
<xenc:CipherData>
<xenc:CipherValue>SQsTCAK6ZaVhojB8+Y.........</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedData>
</soapenv:Body>
</soapenv:Envelope>