I created WCF client that integrates Java WS. The idea is quite easy. I should sign my request with client's certificate and the server should return signed response. Signed by server's private key. All communications runs over SSL.
I enabled .NET tracing and I can see that my request is processed successfully and that the response is received. Unfortunately I received the following exception:
Cannot find a token authenticator for the 'System.IdentityModel.Tokens.X509SecurityToken' token type.
I found a Yaron blog and he proposed a solution that does not work me.
Here is my client configuration:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.diagnostics>
<sources>
<source propagateActivity="true" name="System.ServiceModel" switchValue="All" logKnownPii="true">
<listeners>
<add name="xml"/>
</listeners>
</source>
<source propagateActivity="true" name="System.ServiceModel.IdentityModel" switchValue="All" logKnownPii="true">
<listeners>
<add name="xml"/>
</listeners>
</source>
<source propagateActivity="true" name="System.ServiceModel.Activation" switchValue="All" logKnownPii="true">
<listeners>
<add name="xml"/>
</listeners>
</source>
<source name="System.ServiceModel.MessageLogging" switchValue="All" logKnownPii="true">
<listeners>
<add name="xml" />
</listeners>
</source>
</sources>
<sharedListeners>
<add initializeData="c:\log\Traces.svclog" type="System.Diagnostics.XmlWriterTraceListener"
name="xml" traceOutputOptions="None">
</add>
</sharedListeners>
<trace autoflush="true" indentsize="2">
<listeners>
<add name="xml"/>
</listeners>
</trace>
</system.diagnostics>
<startup>
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5.2" />
</startup>
<system.serviceModel>
<diagnostics>
<messageLogging logEntireMessage="true" logKnownPii="true" logMalformedMessages="false"
logMessagesAtServiceLevel="true" logMessagesAtTransportLevel="true"
/>
<endToEndTracing propagateActivity="true" activityTracing="true"
messageFlowTracing="true" />
</diagnostics>
<client>
<endpoint address="https://www.server.com/ws"
behaviorConfiguration="clientCertificateBehaviour" binding="customBinding"
bindingConfiguration="appCustomBinding" contract="ws.services"
name="app-servicesSOAP" >
</endpoint>
</client>
<bindings>
<customBinding>
<binding name="appCustomBinding">
<security allowSerializedSigningTokenOnReply="true" enableUnsecuredResponse="true"
authenticationMode="CertificateOverTransport" requireDerivedKeys="false"
securityHeaderLayout="Lax" allowInsecureTransport="false"
messageProtectionOrder="SignBeforeEncrypt" protectTokens="false"
messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"
requireSignatureConfirmation="false" />
<textMessageEncoding messageVersion="Soap11" />
<httpsTransport authenticationScheme="Digest" transferMode="Buffered"
requireClientCertificate="true" />
</binding>
</customBinding>
</bindings>
<behaviors>
<endpointBehaviors>
<behavior name="clientCertificateBehaviour">
<clientCredentials>
<clientCertificate findValue="CLIENT_CERT" storeLocation="CurrentUser"
x509FindType="FindBySubjectName" />
<serviceCertificate>
<defaultCertificate findValue="SERVER_CERT" x509FindType="FindBySubjectName" />
<authentication certificateValidationMode="None" />
</serviceCertificate>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
</system.serviceModel>
</configuration>
And the response I am receiving is:
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" SOAP-ENV:mustUnderstand="1">
<wsu:Timestamp xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="XWSSGID-14514880453351538613570">
<wsu:Created>2015-12-30T15:07:25Z</wsu:Created>
<wsu:Expires>2015-12-30T15:12:25Z</wsu:Expires>
</wsu:Timestamp>
<wsse:BinarySecurityToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="XWSSGID-14501832448541055407999">MASASIFIjCCB.......</wsse:BinarySecurityToken>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="XWSSGID-1450183244852-860467203">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="wsse SOAP-ENV"/>
</ds:CanonicalizationMethod>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#XWSSGID-14514880453351164099649">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
<ds:XPath>./SOAP-ENV:Envelope/SOAP-ENV:Header/wsse:Security/ds:Signature[1]/ds:KeyInfo/wsse:SecurityTokenReference</ds:XPath>
</ds:Transform>
<ds:Transform Algorithm="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#STR-Transform">
<wsse:TransformationParameters>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</wsse:TransformationParameters>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>5kmj7l.....</ds:DigestValue>
</ds:Reference>
<ds:Reference URI="#XWSSGID-14514880453351538613570">
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>GssfNgXcx....</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>zcfVW....</ds:SignatureValue>
<ds:KeyInfo>
<wsse:SecurityTokenReference xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="XWSSGID-1451488045318234803139">
<wsse:Reference URI="#XWSSGID-14501832448541055407999" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
</wsse:SecurityTokenReference>
</ds:KeyInfo>
</ds:Signature>
</wsse:Security>
</SOAP-ENV:Header>
<SOAP-ENV:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="XWSSGID-14514880453351164099649">
body content
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
The exception i received should indicate that the certificate is incorrectly referenced but I do not see anything to be wrong in the response. Is this WCF related issue?
Thanx!
Try authenticationMode of "mutualCertificate", set ProtectionLevel.Sign on the contract, and posisbly also allowSerializedTokenOnResponse=true. Some more information here: https://gist.github.com/yaronn/6775810