i'm trying to develop WCF service with WS-Security (Https and messages signed), basically - it's working and i can consume it with my .NET client app, but i need to be able to test this webservice with SoapUi. I can generate almost the same request like made by my .NET client app, but with only one difference - SoapUi use canonicalization xml-exc-c14n# like:
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<InclusiveNamespaces PrefixList="wsse s" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transform>
and my .NET client like:
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
I've tried samples from Change canonicalization algorithm with WCF to change this, but without success. I can't set defaultAlgorithmSuite variable with class derived from SecurityAlgorithmSuite because WCF throws ArgumentOutOfRangeException but only on runtime. Below's my configuration:
EndpointAddress address = new EndpointAddress(new Uri("dest_wcf_address"), EndpointIdentity.CreateDnsIdentity("cert"));
CustomBinding binding = new CustomBinding();
AsymmetricSecurityBindingElement asec = (AsymmetricSecurityBindingElement)SecurityBindingElement.CreateMutualCertificateBindingElement(MessageSecurityVersion.WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10);
asec.SetKeyDerivation(false);
asec.AllowInsecureTransport = true;
asec.IncludeTimestamp = true;
TextMessageEncodingBindingElement textMessageEncoding = new TextMessageEncodingBindingElement(MessageVersion.Soap11, Encoding.UTF8);
HttpsTransportBindingElement transport = new HttpsTransportBindingElement();
transport.RequireClientCertificate = false;
binding.Elements.Add(asec);
binding.Elements.Add(textMessageEncoding);
binding.Elements.Add(transport);
config.Description.Behaviors.Add(new ServiceMetadataBehavior { HttpGetEnabled = true, HttpsGetEnabled = true });
config.Description.Behaviors.Add(new ServiceDebugBehavior { IncludeExceptionDetailInFaults = true });
X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
config.Credentials.ServiceCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.My, X509FindType.FindBySubjectName, "cert_cn");
config.Credentials.ClientCertificate.SetCertificate(
StoreLocation.LocalMachine,
StoreName.My,
X509FindType.FindBySubjectName,
"clienct_cert_cn");
config.Credentials.ClientCertificate.Authentication.
CertificateValidationMode =
X509CertificateValidationMode.Custom;
config.Credentials.ClientCertificate.Authentication.CustomCertificateValidator = new CustomX509CertificateValidator();
config.Credentials.ClientCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None;
ServiceEndpoint endpoint = config.AddServiceEndpoint(typeof(IService1), binding, "service_address");
endpoint.Address = address;
So how to change canonicalization algorithm
I haven't found the way to change Canonicalization algorithm but the problem was different - SoapUI doesn't trim whitespaces while calculating signature hash using EXC-C14N. Pretty print in xml broke security. As solution we can set Strip Whitespaces property in SoapUI on Request level, or manually remove them from body element.