Статус: Новичок
Группы: Участники
Зарегистрирован: 20.04.2012(UTC)
Сообщений: 4
|
Здравствуйте. Подписываю soap сообщение, пытаюсь проверить через сервис ( http://188.254.16.92:7777/gateway/services/SID0003038 ) получаю ошибку. <error> <ns2:errorCode>3</ns2:errorCode> <ns2:errorMessage>Неверная ЭП сообщения</ns2:errorMessage> </error> Хотя сообщение после подписи выглядит почти так же, как и тестовый валидный запрос. Код: public Boolean sign(SOAPMessage message) throws Exception {
if (message == null) {
return false;
}
// Prepare secured header
message.getSOAPPart().getEnvelope().addNamespaceDeclaration("wsse", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");
message.getSOAPPart().getEnvelope().addNamespaceDeclaration("wsu", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd");
message.getSOAPPart().getEnvelope().addNamespaceDeclaration("ds", "http://www.w3.org/2000/09/xmldsig#");
message.getSOAPBody().setAttributeNS("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd", "wsu:Id", "body");
WSSecHeader header = new WSSecHeader();
header.setActor("http://smev.gosuslugi.ru/actors/smev");
header.setMustUnderstand(false);
Element sec = header.insertSecurityHeader(message.getSOAPPart());
Document doc = message.getSOAPPart().getEnvelope().getOwnerDocument();
Element token = (Element) sec.appendChild(
doc.createElementNS("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd", "wsse:BinarySecurityToken"));
token.setAttribute("EncodingType", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary");
token.setAttribute("ValueType", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3");
String certIdGUID = java.util.UUID.randomUUID().toString();
token.setAttribute("wsu:Id", "CertId-" + certIdGUID);
token.setAttribute("xmlns:wsu", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd");
token.setAttribute("xmlns:wsse", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");
header.getSecurityHeader().appendChild(token);
// Prepare signature provider
XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM", xmlDSigProvider);
List<Transform> transformList = new ArrayList<Transform>();
Transform transformC14N = fac.newTransform(Transforms.TRANSFORM_C14N_EXCL_OMIT_COMMENTS, (XMLStructure) null);
transformList.add(transformC14N);
Reference ref = fac.newReference(
"#body",
fac.newDigestMethod("http://www.w3.org/2001/04/xmldsig-more#gostr3411", null),
null, null, null);
//transformList, null, null);
//Collections.singletonList(transform), null, null);
// Make link to signing element
SignedInfo si = fac.newSignedInfo(
fac.newCanonicalizationMethod(CanonicalizationMethod.EXCLUSIVE,
(C14NMethodParameterSpec) null),
fac.newSignatureMethod("http://www.w3.org/2001/04/xmldsig-more#gostr34102001-gostr3411", null),
Collections.singletonList(ref));
// Prepare key information to verify signature in future on other side
KeyInfoFactory kif = fac.getKeyInfoFactory();
final Object[] obj = samData.clone();
X509Data x509d = kif.newX509Data(Collections.singletonList((X509Certificate) obj[0]));
KeyInfo ki = kif.newKeyInfo(Collections.singletonList(x509d), "Key-" + java.util.UUID.randomUUID().toString());
// Create signature and sign by private key
XMLSignature sig = fac.newXMLSignature(si, ki, null, "Signature-" + java.util.UUID.randomUUID().toString(), null);
DOMSignContext signContext = new DOMSignContext((Key) obj[1], token);
signContext.putNamespacePrefix(javax.xml.crypto.dsig.XMLSignature.XMLNS, "ds");
sig.sign(signContext);
// Insert signature node in document
Element sigE = (Element) XPathAPI.selectSingleNode(signContext.getParent(), "//ds:Signature");
Node keyE = XPathAPI.selectSingleNode(sigE, "//ds:KeyInfo", sigE);
token.appendChild(doc.createTextNode(XPathAPI.selectSingleNode(keyE, "//ds:X509Certificate", keyE).getFirstChild().getNodeValue()));
keyE.removeChild(XPathAPI.selectSingleNode(keyE, "//ds:X509Data", keyE));
NodeList chl = keyE.getChildNodes();
for (int i = 0; i < chl.getLength(); i++) {
keyE.removeChild(chl.item(i));
}
Element secTokenRef = doc.createElementNS("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd", "wsse:SecurityTokenReference");
secTokenRef.setAttribute("wsu:Id", "StrId-" + java.util.UUID.randomUUID().toString());
secTokenRef.setAttribute("xmlns:wsu", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd");
secTokenRef.setAttribute("xmlns:wsse", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");
Node str = keyE.appendChild(secTokenRef);
Element reference = doc.createElementNS("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd", "wsse:Reference");
reference.setAttribute("xmlns:wsse", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");
Element strRef = (Element) str.appendChild(reference);
strRef.setAttribute("ValueType", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3");
strRef.setAttribute("URI", "#CertId-" + certIdGUID);
header.getSecurityHeader().appendChild(sigE);
return true;
}
получившийся xml: Код:
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<soapenv:Header><wsse:Security soapenv:actor="http://smev.gosuslugi.ru/actors/smev" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"><wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="CertId-f9ad9fce-935a-4289-861e-0c294b9171b6" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">MIIBeTCCASigAwIBAgIEBaaEEjAIBgYqhQMCAgMwMTELMAkGA1UEBhMCUlUxEjAQBgNVBAoTCUNy
eXB0b1BybzEOMAwGA1UEAxMFQWxpYXMwHhcNMTIwMjA5MDk0MTE0WhcNMTMwMjA5MDk0MTE0WjAx
MQswCQYDVQQGEwJSVTESMBAGA1UEChMJQ3J5cHRvUHJvMQ4wDAYDVQQDEwVBbGlhczBjMBwGBiqF
AwICEzASBgcqhQMCAiMBBgcqhQMCAh4BA0MABEAjPxcQ98okKKIpC4qCTVfYvBSoL+q1ZTGr+OH7
F/ObaujgqcHSIX6bVEXaH0gUI3v8Lmx5+39/0X3TV7agnsCYoyYwJDAOBgNVHQ8BAf8EBAMCBsAw
EgYDVR0TAQH/BAgwBgEB/wIBBTAIBgYqhQMCAgMDQQC5s07kzfDuksZiGypn2mGiFZPU4L4DNq43
7KCnoidgK+uxdLpTBTuq1yJty6E3cwCrnNynr9GKYMQHikUAEmLZ</wsse:BinarySecurityToken><ds:Signature Id="Signature-35c6168c-c5cd-4083-8de5-d966be77e65f" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#gostr34102001-gostr3411"/><ds:Reference URI="#body"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#gostr3411"/><ds:DigestValue>E1VFiBqcPyFf2ofw4T4FcrjjTyW++Ih14aqnyHUpcL8=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>LzbBeEyOlTw7y+s+M6yRRPEb997nz3uOocWpjgGWxbgtQbLgJuBm72uYfESyKExzJ3FYOSPoDD1O
dWaGit/pJA==</ds:SignatureValue><ds:KeyInfo Id="Key-c956bcda-be7a-40b2-8a7f-2ea7e0c6b5c8"><wsse:SecurityTokenReference wsu:Id="StrId-e122f453-e047-4e63-bcd6-6e34410b0d5e" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><wsse:Reference URI="#CertId-f9ad9fce-935a-4289-861e-0c294b9171b6" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"/></wsse:SecurityTokenReference></ds:KeyInfo></ds:Signature></wsse:Security></soapenv:Header>
<soapenv:Body wsu:Id="body">
<ns2:M_Service_Execution_Request xmlns:ns2="http://www.uecard.ru/" xmlns:xmime="http://www.w3.org/2005/05/xmlmime">
<ns2:Initiator_ID>
<ns2:Member_ID>0</ns2:Member_ID>
</ns2:Initiator_ID>
<ns2:TransactionType>Service_Execution</ns2:TransactionType>
<ns2:Number>324718804045</ns2:Number>
<ns2:Date_time>2011-11-24T13:26:44</ns2:Date_time>
<ns2:Message_Type>Request</ns2:Message_Type>
<ns2:Service_Identifier>02000000000002000001</ns2:Service_Identifier>
<ns2:WebServiceURI>GETTIMEMED</ns2:WebServiceURI>
<ns2:Authentification_Data>
<ns2:Terminal_Info>111111114402071F1F1FC700</ns2:Terminal_Info>
<ns2:Unpredictable_Number>4E6BAB64</ns2:Unpredictable_Number>
<ns2:Operation_Timestamp>120124132636</ns2:Operation_Timestamp>
<ns2:Extra_Data>064300000000000000000000000075EE64656669EE6564</ns2:Extra_Data>
<ns2:Request_Hash>DA39A3EE5E6B4B0D3255BFEF95601890AFD80709</ns2:Request_Hash>
<ns2:AAC>006A</ns2:AAC>
<ns2:Operation_Info>E01601</ns2:Operation_Info>
<ns2:Application_Cryptogram>5ACDD864</ns2:Application_Cryptogram>
<ns2:IC_Challenge>00112233445566778899AABBCCDDEEFF</ns2:IC_Challenge>
<ns2:Application_PAN_SIN>964350111900000013607839817224</ns2:Application_PAN_SIN>
<ns2:SecurityCounters>EREREQ==</ns2:SecurityCounters>
<ns2:TerminalPK>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</ns2:TerminalPK>
</ns2:Authentification_Data>
<ns2:Point_Of_Operation>ЕПКУ</ns2:Point_Of_Operation>
<ns2:Request_Message>PEdFVFRJTUVNRUQ+DQo8Q09ERVJFR0lPTj40MDwvQ09ERVJFR0lPTj4NCjxDT0RFTFBVPjMzMzwvQ09ERUxQVT4JCQkNCjxDT0RFU1BFQz4wOTwvQ09ERVNQRUM+DQo8REFURT4wMi4wNC4yMDEyPC9EQVRFPg0KCSA8VElNRUZST00+OTwvVElNRUZST00+DQoJIDxUSU1FVE8+MTI8L1RJTUVUTz4NCgkgPElTQUNDVVJBVEU+VHJ1ZTwvSVNBQ0NVUkFURT4JDQo8L0dFVFRJTUVNRUQ+</ns2:Request_Message>
</ns2:M_Service_Execution_Request>
</soapenv:Body>
</soapenv:Envelope>
|
