SOAP错误，随机生成的值nonce已过期.运行操作时出错:

Question

我正在尝试使用WCF连接到Java Web服务。我无法控制网络服务。尝试过的Soap UI这是SOAP UI 上正在工作的传出请求

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" 
xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken u:Id="UsernameToken-5"><wsse:Username>Charlie</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">Cardon1127</wsse:Password>
<wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">2u6oHBCYoXG15hZdvwbbBQ==</wsse:Nonce>
<u:Created>2013-12-04T17:12:09.884Z</u:Created></wsse:UsernameToken></wsse:Security>
</s:Header>
<s:Body xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<COREEnvelopeRealTimeRequest xmlns="http://www.caqh.org/SOAP/WSDL/CORERule2.2.0.xsd"><PayloadType xmlns="">X12_270_Request_005010X279A1
</PayloadType><ProcessingMode xmlns="">RealTime</ProcessingMode><PayloadID xmlns="">25f6a623-e53a-4263-8310-869666576380</PayloadID>
<TimeStamp xmlns="">2013-12-04T05:00:22Z</TimeStamp><SenderID xmlns="">Charlie</SenderID><ReceiverID xmlns="">431754897</ReceiverID>
<CORERuleVersion xmlns="">2.2.0</CORERuleVersion><Payload xmlns="">My Payload</Payload></COREEnvelopeRealTimeRequest></s:Body></s:Envelope>

WCF客户端

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" 
xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<o:Security s:mustUnderstand="1" 
xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<o:UsernameToken u:Id="uuid-2d5afa3f-b6c4-44f4-bbc3-072ede1b3469-5" 
xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<o:Username>Charlie</o:Username>
<o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">Cardon1127</o:Password>
<o:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">ODwd
dPUEK5FwBLM4RCgmWY8jWmM=</o:Nonce>
<u:Created>2013-12-04T11:10:26.349Z</u:Created></o:UsernameToken>
</o:Security>
</s:Header>
<s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<COREEnvelopeRealTimeRequest xmlns="http://www.caqh.org/SOAP/WSDL/CORERule2.2.0.xsd">
<PayloadType xmlns="">X12_270_Request_005010X279A1</PayloadType><ProcessingMode xmlns="">RealTime</ProcessingMode>
<PayloadID xmlns="">8b967b05-7c1d-40e4-b066-4f58ddb27924</PayloadID><TimeStamp xmlns="">2013-12-04T05:10:22Z</TimeStamp>
<SenderID xmlns="">Charlie</SenderID><ReceiverID xmlns="">431754897</ReceiverID><CORERuleVersion xmlns="">2.2.0</CORERuleVersion>
<Payload xmlns="">My Payload</Payload></COREEnvelopeRealTimeRequest></s:Body></s:Envelope>

这就是我生成nonce（WriteTokenCore）的方式WCF：将Nonce添加到UsernameToken使用.Net客户端的请求出现错误：

       security.wssecurity.WSSContextImpl.s02: com.ibm.websphere.security.WSSecurityException: Exception org.apache.axis2.AxisFault: CWWSS6521E: The Login failed because of an exception: javax.security.auth.login.LoginException: CWWSS5193E:
     The nonce, which is a randomly generated value, has expired. ocurred while running action: 
com.ibm.ws.wssecurity.handler.WSSecurityConsumerHandler$1@47098188

感谢

Answer 1

消息可能花了太长时间才到达，或者客户端和服务器之间可能存在时间同步问题。

确保客户端和服务器的日期、时间和时区同步。如果它们都是同步的，则需要确定消息为什么要花这么长时间才能到达

取自http://publib.boulder.ibm.com/infocenter/dmndhelp/v6r2mx/index.jsp?topic=/com.ibm.websphere.wbpm.messages.620.doc/messages/com.ibm.ws.wssecurity.resources.wssmessages.html

Answer 2

根据oasis-200401-wss-username-token-profile v1.0（第173行，第9页）

密码文本（默认值）

用户名、密码哈希或派生的实际密码密码或S/KEY。哈希密码时应使用此类型使用不依赖于nonce或创建时间的等价物，或者当使用除SHA1之外的摘要算法时

如果您的密码类型为PasswordText或SOAP服务器将拒绝该请求，则不应发送Nonce和Created。

如果你需要发送一个nonce并创建，你将使用"上的相同值来计算Password的摘要；nonce"；以及"；创建"；，nonce可以是任何随机文本，您可以在不创建的情况下使用Guid或random生成它（第113行，第8页）

Password_Digest = Base64 ( SHA-1 ( nonce + created + password ) )

并设置密码类型"#PasswordDigest"

所有这些都取决于您的web服务规范，如果密码需要清除，则不要发送随机数并创建，如果需要摘要，则您将计算它，并发送随机数和创建。