WS-Security and certificate format
I am trying to test a WCF service with WS-Security, X.509 certificate profile. I exported my certificate to a PFX file using the Windows Certificates MMC Add-in. However it seems that soapUI doesn'...
Forum Discussion
Hi guys,
I am using soapUI v3.6.1 (Trail version) and trying to send SOAP requests using X509 certificate. But, the request fails with "500 Internal server error". There is no information in the error log or soapui log. In the http log, I can see the below SOAP message.
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" mustUnderstand="0" actor="">
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="Signature-7">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#id-8">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>Cl0KhgzIct++bRKNZ/M7WTty4Ec=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>QzGfVGLbmOEN3RF27sREt0DDp387bbLAOXX1krb7ctY=</ds:SignatureValue>
<ds:KeyInfo Id="KeyId-A738352153DAE7C9EE129056247962411">
<wsse:SecurityTokenReference wsu:Id="STRId-A738352153DAE7C9EE129056247962412" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:KeyIdentifier EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">MIIG2jCCBcKgAwIBAgIKO5QhCQAAAAF9IzANBgkq.....
</wsse:KeyIdentifier>
</wsse:SecurityTokenReference>
</ds:KeyInfo>
</ds:Signature>
</wsse:Security>
</soapenv:Header>
<soapenv:Body wsu:Id="id-8" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<spml:searchRequest xmlns:spml="urn:siemens:names:prov:gw:SPML:2:0" xsi:schemaLocation="urn:siemens:names:prov:gw:SDS_SUBSCRIBER:1:0 sds_subscriber-1.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<version>SDS_SUBSCRIBER_v10</version>
<base>
<objectclass>Subscriber</objectclass>
<alias name="msisdn" value="61400606462"/>
</base>
</spml:searchRequest>
</soapenv:Body>
</soapenv:Envelope>
However, as per the standard, its expected that the SOAP message would be in the below format..
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<soapenv:Header>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#Body">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-
20010315#WithComments"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>C/XuRHa+cndQKRJEk+falPNaYEE=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
GxZMhsrcRIujUT5GKW/OUI06CIBNgoIjl8efq8ch5UmFyU6lH4XGslpOvxrCp/j7+B6o0FOOhZ5NZldKRihZoDzG9pzdNi9Ljw
EFO1p/wOaxisDoMNuDo0Ymi2TEEZzOKkApcDK6zF7oQqfONrRTM=
</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
MIIG2jCCBcKgAwIBAgIKO5QhCQAAAAF9IzANBgkq.....
</ds:X509Certificate>
</ds:X509Data>
<ds:KeyValue>
<ds:RSAKeyValue>
<ds:Modulus>
pWgJX6zaUSVLrCb08vjHJ9un21OpWM99d+hSgVJQBnVSL+eXSvA5jPcZQbYkNEY4bCG+mc8G6oaNN8T8RESEOvfdsykMhkfMLL
oYbARLHEmw/iDVNbdCCocgbc6QWCYJQ6dMqlBE7lYnJcuS/TI+/UtDkyw2tR6/yU=
</ds:Modulus>
<ds:Exponent>AQAB</ds:Exponent>
</ds:RSAKeyValue>
</ds:KeyValue>
</ds:KeyInfo>
</ds:Signature>
</soapenv:Header>
<soapenv:Body Id="Body">
<spml:searchRequest xmlns:spml="urn:siemens:names:prov:gw:SPML:2:0" xsi:schemaLocation="urn:siemens:names:prov:gw:SDS_SUBSCRIBER:1:0 sds_subscriber-1.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<version>SDS_SUBSCRIBER_v10</version>
<base>
<objectclass>Subscriber</objectclass>
<alias name="msisdn" value="61400606462"/>
</base>
</spml:searchRequest>
</soapenv:Body>
</soapenv:Envelope>
If you compare, you will notice that soapUI isn't sending some of the required tags like - <X509Certificate>, <RSAKeyValue>, <Modulus>, etc
I would like to know if this is a known bug/issue and whether its fixed in the licensed version or not.
Appreciate if I could get a quick response. I really need one.
Thanks in advance
Manu
I am using soapUI v3.6.1 (Trail version) and trying to send SOAP requests using X509 certificate. But, the request fails with "500 Internal server error". There is no information in the error log or soapui log. In the http log, I can see the below SOAP message.
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" mustUnderstand="0" actor="">
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="Signature-7">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#id-8">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>Cl0KhgzIct++bRKNZ/M7WTty4Ec=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>QzGfVGLbmOEN3RF27sREt0DDp387bbLAOXX1krb7ctY=</ds:SignatureValue>
<ds:KeyInfo Id="KeyId-A738352153DAE7C9EE129056247962411">
<wsse:SecurityTokenReference wsu:Id="STRId-A738352153DAE7C9EE129056247962412" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:KeyIdentifier EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3">MIIG2jCCBcKgAwIBAgIKO5QhCQAAAAF9IzANBgkq.....
</wsse:KeyIdentifier>
</wsse:SecurityTokenReference>
</ds:KeyInfo>
</ds:Signature>
</wsse:Security>
</soapenv:Header>
<soapenv:Body wsu:Id="id-8" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<spml:searchRequest xmlns:spml="urn:siemens:names:prov:gw:SPML:2:0" xsi:schemaLocation="urn:siemens:names:prov:gw:SDS_SUBSCRIBER:1:0 sds_subscriber-1.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<version>SDS_SUBSCRIBER_v10</version>
<base>
<objectclass>Subscriber</objectclass>
<alias name="msisdn" value="61400606462"/>
</base>
</spml:searchRequest>
</soapenv:Body>
</soapenv:Envelope>
However, as per the standard, its expected that the SOAP message would be in the below format..
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<soapenv:Header>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#Body">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-
20010315#WithComments"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>C/XuRHa+cndQKRJEk+falPNaYEE=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
GxZMhsrcRIujUT5GKW/OUI06CIBNgoIjl8efq8ch5UmFyU6lH4XGslpOvxrCp/j7+B6o0FOOhZ5NZldKRihZoDzG9pzdNi9Ljw
EFO1p/wOaxisDoMNuDo0Ymi2TEEZzOKkApcDK6zF7oQqfONrRTM=
</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
MIIG2jCCBcKgAwIBAgIKO5QhCQAAAAF9IzANBgkq.....
</ds:X509Certificate>
</ds:X509Data>
<ds:KeyValue>
<ds:RSAKeyValue>
<ds:Modulus>
pWgJX6zaUSVLrCb08vjHJ9un21OpWM99d+hSgVJQBnVSL+eXSvA5jPcZQbYkNEY4bCG+mc8G6oaNN8T8RESEOvfdsykMhkfMLL
oYbARLHEmw/iDVNbdCCocgbc6QWCYJQ6dMqlBE7lYnJcuS/TI+/UtDkyw2tR6/yU=
</ds:Modulus>
<ds:Exponent>AQAB</ds:Exponent>
</ds:RSAKeyValue>
</ds:KeyValue>
</ds:KeyInfo>
</ds:Signature>
</soapenv:Header>
<soapenv:Body Id="Body">
<spml:searchRequest xmlns:spml="urn:siemens:names:prov:gw:SPML:2:0" xsi:schemaLocation="urn:siemens:names:prov:gw:SDS_SUBSCRIBER:1:0 sds_subscriber-1.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<version>SDS_SUBSCRIBER_v10</version>
<base>
<objectclass>Subscriber</objectclass>
<alias name="msisdn" value="61400606462"/>
</base>
</spml:searchRequest>
</soapenv:Body>
</soapenv:Envelope>
If you compare, you will notice that soapUI isn't sending some of the required tags like - <X509Certificate>, <RSAKeyValue>, <Modulus>, etc
I would like to know if this is a known bug/issue and whether its fixed in the licensed version or not.
Appreciate if I could get a quick response. I really need one.
Thanks in advance
Manu
