如何生成XML SignatureValu

Question

我正试图签署一个soap请求。文档的其余部分是有效的，但我最终得到的SignatureValue不是预期的值。在过去的几天里，我学习了Soap和签名，所以最有可能的情况是，当涉及到这个算法时，我误解了输入或操作顺序。在

这是请求，显然去掉了用户名/密码。对不起，这段代码。Soap请求需要很多元素才能获得完整的图像：

<soapenv:Envelope xmlns:real="http://realtime.cbapi.clarabridge.com/" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
  <soapenv:Header>
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <ds:Signature>
        <ds:SignedInfo>
          <ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
          <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
          <ds:Reference URI="#id-65BB4C5D722C51E896140612427983429">
            <ds:Transforms>
              <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                <ds:InclusiveNamespaces PrefixList="real soapenv wsu" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#"/>
              </ds:Transform>
            </ds:Transforms>
            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
            <ds:DigestValue>YIjV+XTiwlkXLG4yMhwuxXeHGYE=</ds:DigestValue>
          </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>OplmHJ6fpJNEcCwm58BIkM8r+sU6bsYS6DiRN+wtHkf4Aw0JFwHvbM/0noEFcVNWwVcfMMeHoidkCGVERNnWtt5e43ifIIyI1XxBaV/w3jastS8jgCxM9AXdfJKUm8Q+3pqFuaNnOAQnQPZ1FWUJh8hMWMtQNW5XRwP/+xpfSvI0lFUygy9VOZcjbYHLqadftkvmObDvN9Kg59oKYVuIRrwBeTquP/oJsdV/ni9Bu1deLSNxON4YtNU1JdGGnIkaZWbaMXVY+w9W6LBgLKoAZrKW6zi8NgtJRdSwFUOGA1eXcN82p69xgeoWg4GQd1bXYFu405hiNMuAQe98yg6s9g==</ds:SignatureValue>
        <ds:KeyInfo>
          <wsse:SecurityTokenReference>
            <wsse:KeyIdentifier EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">MIIFMDCCBBigAwIBAgIQSWtHiOJhlIGXXlVQfuGvMzANBgkqhkiG9w0BAQUFADCBtTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykxMDEvMC0GA1UEAxMmVmVyaVNpZ24gQ2xhc3MgMyBTZWN1cmUgU2VydmVyIENBIC0gRzMwHhcNMTQwNjAzMDAwMDAwWhcNMTgwNjAzMjM1OTU5WjB8MQswCQYDVQQGEwJVUzEOMAwGA1UECBMFVGV4YXMxDzANBgNVBAcUBkF1c3RpbjEbMBkGA1UEChQSUHJlZGljdGl2ZSBTY2llbmNlMQswCQYDVQQLFAJJVDEiMCAGA1UEAxQZd3d3LnByZWRpY3RpdmVzY2llbmNlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK9enbBiootY6sgYUkWThtCaWIUZKPtERx2m2btgAmwlB4ZG550uXmoxWKwwb9UqIlQiUfWdTQFD3GWD5Tiq/yN/toLimRXlcYt1CiJwIeUhdBQdrHB6KHEv2KUyCEnxBwRldEkHrxSKSbHpXLacl3OZixiRzyEMCuHYxhLbATNKRVmGyXmDYNDA4Nu4jj6LVzI7026bMGEAPbar93mhWV/lVmO6IKkQnck3s4pKqsnqQ/nl7+Vl8ftk6KbvAQ4U1xm+hr3zYwZiD+40xCFqMfRLE9uA4kTD2oMBKLIk9SXxjJmPOwS63PticE/gYEqLrristHjwxzrHI57sOMsnfC8CAwEAAaOCAXIwggFuMCQGA1UdEQQdMBuCGXd3dy5wcmVkaWN0aXZlc2NpZW5jZS5jb20wCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwKwYDVR0fBCQwIjAgoB6gHIYaaHR0cDovL3NkLnN5bWNiLmNvbS9zZC5jcmwwZQYDVR0gBF4wXDBaBgpghkgBhvhFAQc2MEwwIwYIKwYBBQUHAgEWF2h0dHBzOi8vZC5zeW1jYi5jb20vY3BzMCUGCCsGAQUFBwICMBkWF2h0dHBzOi8vZC5zeW1jYi5jb20vcnBhMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBQNRFwWU0TBgn4dIKsl9AFj2L55pTBXBggrBgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zZC5zeW1jZC5jb20wJgYIKwYBBQUHMAKGGmh0dHA6Ly9zZC5zeW1jYi5jb20vc2QuY3J0MA0GCSqGSIb3DQEBBQUAA4IBAQBDZN0azh5pvzLUdEYO/iosv566nEoNBoRZ0mh7hdEMFphPQIIhFohklpB0Uf6NfhM5I79qrtOQ1b3gHLH1KyhW9zSL3ZcQINPKlfR9aPXVFcGM/0WlensbTAlFQUvFMexDvPqf1h3gp5knDffTLyTD1Ybw4h6jTQngJJm5BAWck8V7KHb5Q69utnPAfwTSblPpNIl2yzC5wIpSuvVD2ghW6h+abBLSXC54wAWzZnHJ5PBeWn0vZb/pXHszrk8TPd6xZmjF9N+UoKoqnn5lJZZja1XntPkIgGP9LAAlOaYIAP1hyWTWuYYoKjgGyjbfVEdjGB3qhV2eCPhZRjj0JWG6</wsse:KeyIdentifier>
          </wsse:SecurityTokenReference>
        </ds:KeyInfo>
      </ds:Signature>
      <wsse:UsernameToken>
        <wsse:Username/>
        <wsse:Password type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"/>
        <wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">rDR41po8gfpi5g9cNpYWWk5easQ=</wsse:Nonce>
        <wsu:Created>2014-08-06T15:06:43.387246</wsu:Created>
      </wsse:UsernameToken>
    </wsse:Security>
  </soapenv:Header>
  <soapenv:Body Id="id-65BB4C5D722C51E896140612427983429">
    <real:processMultiVerbatimDocument>
      <processMultiVerbatimDocumentRequest>
        <projectName/>
        <modelName/>
        <responseLevel/>
        <save/>
        <verbatimSet>
          <verbatim/>
        </verbatimSet>
        <limitByWordRank>true</limitByWordRank>
        <includeNRelations>false</includeNRelations>
      </processMultiVerbatimDocumentRequest>
    </real:processMultiVerbatimDocument>
  </soapenv:Body>
</soapenv:Envelope>

我对算法的理解如下：

1. 获取包含的名称空间。在
2. 在它们上运行C14N算法来规范化诸如顺序和间距之类的东西
3. 使用sha1散列它们，然后转换为base64。这就是消化值
4. 导入我的RSA私钥（未显示）并使用加密签名.PKCS1_v1_5在
5. 呼叫签名者。签名（消化值）。这是签名值

当使用SoapUI时，我得到的SignatureValue与它不同。SoapUI是正确的，而我的显然是错误的，但是我不知道从哪里开始调试。如果有人以前经历过这种情况，我们将非常感谢您的帮助！在

谢谢

Answer 1

我知道这个问题已经有一年多了，但我一直在努力用golang做同样的事情。在

在下载了wss4j的源代码并运行了它们的签名测试之后，我发现您实际上并没有对步骤3中确定的摘要值进行签名，而是将整个<ds:SignedInfo></ds:SignedInfo>块规范化，然后对其进行签名。Wss4j还在规范化之前将soap名称空间添加到元素中，以防使用添加父名称空间的DOM，否则签名将无法验证。我没有使用Go的DOM，因此我必须确保添加xmlns:soap到签名的信息元素。在

我不知道添加的名称空间是否符合WSSE规范，但这些是我的发现，我能够使用这种技术成功地从golang向java服务发出一条签名的SOAP消息。在

举个例子，在c14n中，请记住标记之间的间距很重要，所以我将这个未格式化的标记之间没有空格。在

<SignedInfo xmlns="http://www.w3.org/2000/09/xmldsig#" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="real soapenv wsu"></InclusiveNamespaces></CanonicalizationMethod><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"></SignatureMethod><Reference URI="#id-65BB4C5D722C51E896140612427983429"><Transforms><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList=""></InclusiveNamespaces></Transform></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></DigestMethod><DigestValue>YIjV+XTiwlkXLG4yMhwuxXeHGYE=</DigestValue></Reference></SignedInfo>