'WS Security 1.2 in SOAP web services Delphi XE8 for sign body
I have read that there is no way to create a message with ws-security from httprio, only modifying the xml that is generated, in the beforeexecute, overwriting the stream content. But I want to know how sign the body section from that xml.
In JBoss this is the example (https://docs.jboss.org/author/display/WFLY10/WS-Security.html) but I don't find classes or methods in Delphi for do it.
The wsdl definition include a wsp section not readed when imported the wsdl definition
<wsp:Policy xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy" wsu:Id="SecurityServiceSignThenEncryptPolicy">
<wsp:ExactlyOne>
<wsp:All>
<sp:AsymmetricBinding xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:InitiatorToken>
<wsp:Policy>
<sp:X509Token sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
<wsp:Policy>
<sp:WssX509V1Token11/>
</wsp:Policy>
</sp:X509Token>
</wsp:Policy>
</sp:InitiatorToken>
<sp:RecipientToken>
<wsp:Policy>
<sp:X509Token sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Never">
<wsp:Policy>
<sp:WssX509V1Token11/>
</wsp:Policy>
</sp:X509Token>
</wsp:Policy>
</sp:RecipientToken>
<sp:AlgorithmSuite>
<wsp:Policy>
<sp:TripleDesRsa15/>
</wsp:Policy>
</sp:AlgorithmSuite>
<sp:Layout>
<wsp:Policy>
<sp:Lax/>
</wsp:Policy>
</sp:Layout>
<sp:IncludeTimestamp/>
<sp:EncryptSignature/>
<sp:OnlySignEntireHeadersAndBody/>
<sp:SignBeforeEncrypting/>
</wsp:Policy>
</sp:AsymmetricBinding>
<sp:SignedParts xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<sp:Body/>
</sp:SignedParts>
<sp:EncryptedParts xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<sp:Body/>
</sp:EncryptedParts>
<sp:Wss10 xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:MustSupportRefIssuerSerial/>
</wsp:Policy>
</sp:Wss10>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
Then I need rewrite the xml before request with a token and the body encrypted with that token.
I need encrypt the body with a token, that is how jboss do it. No user or password. Only encrypt the message.
My original xml normal for call webservice look as:
<?xml version="1.0"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<SOAP-ENV:Body>
<shawAny xmlns="http://showany.com/webservices">
<Value xmlns="">1360814</nroCertificado>
<autenticacion xmlns=""> <signWSAA>EISgwe7vyrAtvpe/uBy1Vj9IyYRGjjZfY4isNTLYDhl33BeqPWHjJ5NXU5+UMBSxjAO84bCydJJmCiDlATZq725EThMppowyO2CcAYBET8zBdqlXqaVMT12OHFnSH5QHc5aG4SkrgubPXqCeJO5Lcb/T6irySorBaYG647K33/8=</signWSAA>
<CN>dnra</CN> <ticketWSAA>CjxhdXRoPgoJPGlkIHVuaXF1ZV9pZD0iNzQwMDE0NjUyIiBzcmM9IkM9UFksIE89ZG5hLCBPVT1zb2ZpYSwgQ049d3NhYXRlc3QiIGdlbl90aW1lPSIyMDIwLTA3LTIwVDEwOjI5OjI3LjYzMi0wNDowMCIgZXhwX3RpbWU9IjIwMjAtMDctMjFUMTA6Mjk6MjcuNjMyLTA0OjAwIi8+Cgk8b3BlcmF0aW9uIHZhbHVlPSJncmFudGVkIiB0eXBlPSJsb2dpbiI+CgkJPGxvZ2luIHVpZD0iQz1QWSwgTz1ETlJBLCBPVT1USSwgQ049ZG5yYSIgc2VydmljZT0ic2VydmljaW9jZXJuYWMiIGF1dGhtZXRob2Q9ImNtcyI+CgkJPC9sb2dpbj4KCTwvb3BlcmF0aW9uPgo8L2F1dGg+Cg==</ticketWSAA>
</autenticacion>
</showAny>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope
and then ws-security must look as:
<?xml version="1.0" encoding="UTF8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Header>
<wsse:Security xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" SOAP-ENV:mustUnderstand="1">
<wsse:BinarySecurityToken
EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509"
wsu:Id="x509cert00">CjxhdXRoPgoJPGlkIHVuaXF1ZV9pZD0iMTYwMTE4MTMwIiBzcmM9IkM9UFksIE89ZG5hLCBPVT1zb2ZpYSwgQ049d3NhYXRlc3QiIGdlbl90aW1lPSIyMDIwLTA3LTIwVDE1OjUzOjMyLjAxMC0wNDowMCIgZXhwX3RpbWU9IjIwMjAtMDctMjFUMTU6NTM6MzIuMDEwLTA0OjAwIi8+Cgk8b3BlcmF0aW9uIHZhbHVlPSJncmFudGVkIiB0eXBlPSJsb2dpbiI+CgkJPGxvZ2luIHVpZD0iQz1QWSwgTz1ETlJBLCBPVT1USSwgQ049ZG5yYSIgc2VydmljZT0ic2VydmljaW9jZXJuYWMiIGF1dGhtZXRob2Q9ImNtcyI+CgkJPC9sb2dpbj4KCTwvb3BlcmF0aW9uPgo8L2F1dGg+Cg==
</wsse:BinarySecurityToken>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="wsse SOAP-ENV"/></ds:CanonicalizationMethod><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><ds:Reference URI="#TheBody"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>VhsSnaEAFsY0OYegKQh99v9csXg=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>axkNSVJdFcJWvd9H2TFYC5AvKLs8c3aMxeXKr0ZrQFWUp7fGivPtAAbQAlO2Wju14sy+TM1POyRd8blkJLLYVcFokrRj7X2SshbKasIosH9aWVoMdl8cL7G1SmUBguxekuI4N++yAAHJZotBka575Eaj3bNlSMNTZL5K2hqTFxal/oIExwDMNAmtCpiEapHgaW7mXgqibttNKhxrGmAGidBnHVGgqMcbM3l6aWhD8F6L4IK1PuB1LQoW/n8wkeO2+PrUzIqQ4LY5+Bx69OZjNHcuiC7HdwMNH9+aMipa7b3Q3DZ0+Qi4k/DWbT3kxterYnOWk6XULifV0F2pH3lg4Q==</ds:SignatureValue><ds:KeyInfo><wsse:SecurityTokenReference><wsse:Reference URI="#x509cert00" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509"/></wsse:SecurityTokenReference></ds:KeyInfo></ds:Signature></wsse:Security>
</SOAP-ENV:Header>
<SOAP-ENV:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="TheBody">
<getVersion xmlns="http://msgsec.wssecfvt.ws.ibm.com"/>
MIIDjjCCAnagAwIBAgIIU/FocaP2GcUwDQYJKoZIhvcNAQEFBQAwVTEWMBQGA1UE
AwwNU0lGUm9vdENBMjA0ODETMBEGCgmSJomT8ixkARkWA1NJRjETMBEGCgmSJomT
8ixkARkWA0NPTTERMA8GCgmSJomT8ixkARkWAVAwHhcNMjAwNjE4MjAxNDUxWhcN
MzAwNjE2MjAxNDUxWjA4MQ0wCwYDVQQDDARkbnJhMQswCQYDVQQLDAJUSTENMAsG
A1UECgwERE5SQTELMAkGA1UEBhMCUFkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQDWtyo5ASPoLtHGdAaj9CXBtiMnaGZQ6ERjeDvg+2czWKcbpIBUCl4C
hpOfcWobR5+gF7br3wYzhkg4GqyXIcDqlZQiRNRD8gnR0Q0ZFo0AMtabEGnOrSTJ
e5Wi+2af4Ku5kETSah7zWnv58OELQYzPVh2wxc2v0uuQ9N0riF16d1Do3knuqP4U
rz0/qXokpcIUpWt9FnWK7ux0fmaBipPDQeYPxBlIFKrGwIzj8JjWHliWJ3e1lyab
Qz2l9rkVi+gvbHixazie/sU0zcz7rMYbvM1/kD0ScRbvbr9i6xKPns97GWS2t2Q+
vnN9bQqOqPJTlJKpCJPBPV23W1FJ3HD3AgMBAAGjfzB9MB0GA1UdDgQWBBSevr6z
DFqKIIXrnlrF12ViI9iJgjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFIwsCl6R
oTkooHzDxwykypf6IsWtMA4GA1UdDwEB/wQEAwIE8DAdBgNVHSUEFjAUBggrBgEF
BQcDAQYIKwYBBQUHAwIwDQYJKoZIhvcNAQEFBQADggEBAIjTQ7NFHCdHLdp5z3zL
sqeuq6e7CEYng0i3uW/xFgzKg20W7xh99KgmPiVjEBNMxsXhbMqEtvuOOF4aj+HH
fmMa0wvLzrKD0symhnBlLZCQbDrRsk6KkGuqcPn40csQ12O8G8kEqjuf2SoYkHye
bXDL2+fwdpX+SgLwWy88xSjwPHPT4IqbuYFn7uFzpgUOCDVNFUl++gMkNVW+MR6S
OBqfc84dVAANhThH7rwxnPiQ8/8l2BLUgGhFyZqDHlmUbsnd6QTCLFSREV3m3Mra
uoRs/tuAdlGM/01C65eNPsajaWXmkoM3EZk+SLt5+038DECfRkkuLToA8W2783H1
pIQ=
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
Solution 1:[1]
You do not need to write and append the XML for the security header manually. The Delphi SOAP implementation has TSOAPHeader objects for that.
Example:
type
TMySoapHeader = class(TSOAPHeader)
private
FSomeData: string;
published
property SomeData: string read FSomeData write FSomeData;
end;
To apply the header before sending it, use:
(Webservice as ISOAPHeaders).Send(header);
I've created WS-Sec headers (for Username/Password auth) in the past, which I added add GitHub: https://github.com/ronaldhoek/SOAPStuff
[EIDT] Recently added the BinarySecurityToken part to the Security header for version '200401'.
These could help you build the headers required for this service.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 |