WS-请求中的安全标头不匹配

Question

我们应该在哪里定义放置哪个安全标头。我有一个启用ws安全的web服务，需要使用(为此目的我正在使用wso2 ESB 4.9.0 )，我可以看到的是，当试图通过ESB调用客户端时，标头不匹配，并且得到了一个错误。下面给出了预期的请求消息和ESB生成的请求消息。如果有人能帮忙我会很高兴的。

预期请求消息

<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:mob="http://com.mobitel.payment/MobitelPaymentGW/">
   <soapenv:Header>
      <wsse:Security 
         xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" 
         xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" 
         soapenv:mustUnderstand="1">
         <wsse:UsernameToken 
            wsu:Id="UsernameToken-B4BD97FC2A64C1B4DE15580859645869">
            <wsse:Username>MobitelPaymentGWUser</wsse:Username>
            <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">MobitelPay#123Test</wsse:Password>
            <wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">8mIivn6+R6uqXclmVDva1A==</wsse:Nonce>
            <wsu:Created>2019-05-17T09:39:24.586Z</wsu:Created>
         </wsse:UsernameToken>
      </wsse:Security>
   </soapenv:Header>
   <soapenv:Body>
      <mob:payBill>
         <transaction>
            <serviceId>TEST</serviceId>
            <mobileOrAccountNo>0710380350</mobileOrAccountNo>
            <signature>201905170000000007</signature>
            <amount>1</amount>
            <payMode>COU</payMode>
            <txnDate>2019-05-17 13:28:00</txnDate>
         </transaction>
      </mob:payBill>
   </soapenv:Body>
</soapenv:Envelope>

ESB生成的请求

[![<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope">
   <soapenv:Header>
      <wsse:Security 
        xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" 
        soapenv:mustUnderstand="true">
         <wsse:UsernameToken 
            xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" 
            wsu:Id="UsernameToken-4">
            <wsse:Username>MobitelPaymentGWUser</wsse:Username>
            <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">MobitelPay#123Test
            </wsse:Password>
            <wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">pf0L6vJFNPvYzn+Zaz8PJQ==
            </wsse:Nonce>
            <wsu:Created>2019-07-15T03:23:29.681Z</wsu:Created>
         </wsse:UsernameToken>
      </wsse:Security>
   </soapenv:Header>
   <soapenv:Body>
      <mob:payBill xmlns:mob="http://com.mobitel.payment/MobitelPaymentGW/">
         <transaction xmlns="http://ws.apache.org/ns/synapse">
            <serviceId>TEST</serviceId>
            <mobileOrAccountNo>0710380350</mobileOrAccountNo>
            <signature>201905170000000007</signature>
            <amount>1</amount>
            <payMode>COU</payMode>
            <txnDate>2019-05-17 13:28:00</txnDate>
         </transaction>
      </mob:payBill>
   </soapenv:Body>
</soapenv:Envelope>

Rampart版本1.6.1

添加了一个图像，指示头的位置不同：1

提前感谢Yasothar

Answer 1

我看了一眼，没有看到任何明显的差别。是的，名称空间声明并不在相同的位置，但两者都是“XML等效的”，因此，如果接收端遵循相同的标准，签名就不会成为问题。编辑:并不是所有的建议都是有效的，因为这是关于基本权利和不签署。