Changing CanonicalizationMethod Algorithm -- dotnet web services enhancements

dotnet web services enhancements : Changing CanonicalizationMethod Algorithm

Colin Bowern
2/23/2006 5:37:35 PM

I'm trying to interop with a service provider's web service. They are
currently requesting that messages be signed with an X509 certificate.
The reference request notes the following Canonicalization algorithm:

<CanonicalizationMethod
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />

However, the WSEv3 output produces the following algorithm:

<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#" />

Is there any way to modify the canonicalization algorithm? I can see that
the XmlSignature class has reference to this namespace using the
InclusiveC14NTransform AlgorithmURI const. I'm just not sure how to force
the policy to use this algorithm over the other one without writing a custom
policy and filter set.

Passing the WSEv3 generated one returns a not supported error for that
particular algorithm.

Thanks,
Colin

Pablo Cibraro
2/24/2006 10:53:19 AM

Hi Colin,

You will have to implement a custom assertion to do something like that.
In the sample below I created a custom assertion using the turn-key
assertion UsernameForCertificate. (You have to configure this class as an
extension in the policy file)

public class MyCustomAssertion : UsernameForCertificateAssertion
{
public override SoapFilter
CreateClientOutputFilter(FilterCreationContext context)
{
return new MyClientOutputFilter(this);
}

protected class MyClientOutputFilter : ClientOutputFilter
{
public MyClientOutputFilter(UsernameForCertificateAssertion
assertion)
: base(assertion)
{
}

public override void SecureMessage(SoapEnvelope envelope,
Security security, MessageProtectionRequirements request)
{
base.SecureMessage(envelope, security, request);

foreach (ISecurityElement element in security.Elements)
{
if (element is MessageSignature)
{
MessageSignature signature =
(MessageSignature)element;

//XmlSignature.AlgorithmURI.InclusiveC14NTransform =
http://www.w3.org/TR/2001/REC-xml-c14n-20010315
signature.Signature.SignedInfo.CanonicalizationMethod
= XmlSignature.AlgorithmURI.InclusiveC14NTransform;
}
}
}
}
}

Regards,
Pablo Cibraro
http://weblogs.asp.net/cibrax

[quoted text, click to view]

Colin Bowern
2/24/2006 4:52:43 PM

Hey Pablo,

Thanks for the sample code. I was hoping that it would be a simple attribute
somewhere given the number of algorithms supported, but I guess not. I'll
give this a shot.

Cheers!
Colin

[quoted text, click to view]

Colin Bowern
2/25/2006 1:26:27 AM

So that solved my last problem. Now I'm onto a new one:

<soap:Fault xmlns:wsse="http://schemas.xmlsoap.org/ws/2002/04/secext" xmlns:c="urn:schemas-cybersource-com:transaction-data-1.18">
<faultcode>wsse:InvalidSecurity</faultcode>
<faultstring>
Security Data : Invalid WS Security Header: Not supported transform: http://www.w3.org/2001/10/xml-exc-c14n#
</faultstring>
</soap:Fault>

If I parse the transform blocks out of the document it works. That being
said removing data from the document doesn't feel right. The final hurdle
seems to be the security token reference value type. It points to "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
and as a result the service returns:

Security Data : Invalid WS Security Header: Not supported keyInfo type: wsse:SecurityTokenReference

I need to to look something more like this:

<SecurityTokenReference xmlns="http://schemas.xmlsoap.org/ws/2002/04/secext">
<Reference URI="X509Token" />
</SecurityTokenReference>

It does seem like the web service is running on older standards. I've been
going through the docs but it seems like WSE has grown to be quite complicated,
so I'm shooting in the dark here as to how to get this last bit of interop
going without using the proprietary signature functions.

Thanks,
Colin

[quoted text, click to view]

Colin Bowern
2/25/2006 1:27:17 AM

That solved my last problem. Now I'm onto a new one:

<soap:Fault xmlns:wsse="http://schemas.xmlsoap.org/ws/2002/04/secext" xmlns:c="urn:schemas-cybersource-com:transaction-data-1.18">
<faultcode>wsse:InvalidSecurity</faultcode>
<faultstring>
Security Data : Invalid WS Security Header: Not supported transform: http://www.w3.org/2001/10/xml-exc-c14n#
</faultstring>
</soap:Fault>

If I parse the transform blocks out of the document it works. That being
said removing data from the document doesn't feel right. The final hurdle
seems to be the security token reference value type. It points to "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
and as a result the service returns:

Security Data : Invalid WS Security Header: Not supported keyInfo type: wsse:SecurityTokenReference

I need to to look something more like this:

<SecurityTokenReference xmlns="http://schemas.xmlsoap.org/ws/2002/04/secext">
<Reference URI="X509Token" />
</SecurityTokenReference>

It does seem like the web service is running on older standards. I've been
going through the docs but it seems like WSE has grown to be quite complicated,
so I'm shooting in the dark here as to how to get this last bit of interop
going without using the proprietary signature functions.

Thanks,
Colin

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about dotnet web services enhancements

home · blog · groups

Questions? Comments? Contact the dn