Me encuentro desarrollando una solución de facturación electrónica DIAN-Colombia y estoy en el proceso de crear y firmar digitalmente el mensaje SOAP para comunicarme con el web service de validación previa. La estructura del mensaje SOAP que genera SOAPUI es la siguiente:
<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wcf="http://wcf.dian.colombia">
<soap:Header xmlns:wsa="http://www.w3.org/2005/08/addressing">
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsu:Timestamp wsu:Id="TS-261F6C1DB8F3AFA22D15962047238386">
<wsu:Created>2020-07-31T14:12:03.838Z</wsu:Created>
<wsu:Expires>2020-08-01T06:52:03.838Z</wsu:Expires>
</wsu:Timestamp>
<wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="X509-261F6C1DB8F3AFA22D15962047237291">MIIItTCCBp2gAwIBAgIIV95ucy/ByMg...</wsse:BinarySecurityToken>
<ds:Signature Id="SIG-261F6C1DB8F3AFA22D15962047237825" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces PrefixList="wsa soap wcf" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:CanonicalizationMethod>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#id-261F6C1DB8F3AFA22D15962047237744">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces PrefixList="soap wcf" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>F0BbpkmIW7M5fHl1I+sdhBG9qHKarFNxJGdGuH1Z5lM=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>cmBzdA3N9fNlsFgcDbMJwCj4QnIOw+WxiXVcG4zioLeAeDi0R3w1Yt0B3bzBn3KgEJPzTSy/vW+AdnZ/Q2JOeUfnXkGNa7d4lP3chygityViqVbEGQ==</ds:SignatureValue>
<ds:KeyInfo Id="KI-261F6C1DB8F3AFA22D15962047237682">
<wsse:SecurityTokenReference wsu:Id="STR-261F6C1DB8F3AFA22D15962047237713">
<wsse:Reference URI="#X509-261F6C1DB8F3AFA22D15962047237291" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
</wsse:SecurityTokenReference>
</ds:KeyInfo>
</ds:Signature>
</wsse:Security>
<wsa:Action>http://wcf.dian.colombia/IWcfDianCustomerServices/SendBillSync</wsa:Action>
<wsa:To wsu:Id="id-261F6C1DB8F3AFA22D15962047237744" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">https://vpfe-hab.dian.gov.co/WcfDianCustomerServices.svc</wsa:To>
</soap:Header>
Este es el código que tengo hasta el momento para generar la firma del mensaje SOAP:
XmlDocument xmlDoc = new XmlDocument();
xmlDoc.PreserveWhitespace = true;
xmlDoc.Load(ruta);
var ns = new XmlNamespaceManager(xmlDoc.NameTable);
ns.AddNamespace("soap", soap.NamespaceName);
ns.AddNamespace("wsse", wsse.NamespaceName);
ns.AddNamespace("ec", ec.NamespaceName);
ns.AddNamespace("ds", ds.NamespaceName);
ns.AddNamespace("wsu", wsu.NamespaceName);
CspParameters cspParams = new CspParameters();
cspParams.KeyContainerName = "XML_DSIG_RSA_KEY";
RSACryptoServiceProvider rsaKey = new RSACryptoServiceProvider(cspParams);
var signedXml = new SignedXmlWithId(xmlDoc);
var keyInfo = new KeyInfo();
XmlElement x = xmlDoc.CreateElement("wsse", "SecurityTokenReference", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");
XmlElement y = xmlDoc.CreateElement("wsse", "Reference", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");
x.SetAttribute("Id", wsu.NamespaceName, "STR-" + this.GetSecurityTokenReferenceID());
y.SetAttribute("URI", "#X509-" + this.GetBinarySecurityTokenID());
y.SetAttribute("ValueType", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3");
x.AppendChild(y);
var keyInfoData = new KeyInfoNode(x);
keyInfo.AddClause(keyInfoData);
keyInfo.Id = "KI-" + this.GetKeyInfoID();
signedXml.KeyInfo = keyInfo;
signedXml.SigningKey = rsaKey;
signedXml.Signature.Id = "SIG-" + this.GetSignatureID();
signedXml.SignedInfo.CanonicalizationMethod = SignedXml.XmlDsigExcC14NTransformUrl;
signedXml.SignedInfo.SignatureMethod = @"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";
XmlDsigExcC14NTransform canMethod = (XmlDsigExcC14NTransform)signedXml.SignedInfo.CanonicalizationMethodObject;
canMethod.Algorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
canMethod.InclusiveNamespacesPrefixList = _canonicaMethodPrefixList;
XmlDsigExcC14NTransform env = new XmlDsigExcC14NTransform();
env.Algorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
env.InclusiveNamespacesPrefixList = _transformPrefixList;
var reference = new Reference { Uri = "#id-" + this.ID };
reference.AddTransform(env);
signedXml.AddReference(reference);
signedXml.ComputeSignature();
var signedElement = signedXml.GetXml();
SetPrefix("ds", signedElement);
var nodoSecurity = xmlDoc.DocumentElement.SelectSingleNode(@"//wsse:Security", ns) as XmlElement;
nodoSecurity.AppendChild(signedElement);
xmlDoc.Save(ruta);
Y a continuacion lo que genera dicho codigo:
<Signature Id="SIG-5e21d3291c4240d59c17659c06ea811b" xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<InclusiveNamespaces PrefixList="wsa soap wcf" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" />
</CanonicalizationMethod>
<SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
<Reference URI="#id-702f0abae9ab446783a2b0bb1a47e163">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<InclusiveNamespaces PrefixList="soap wcf" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transform>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
<DigestValue>9NsYFHBFhdgVivZas6XW7pYXG/unN9k1+mEubpvF+SQ=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>WbVdox/6W6NU5hzE83Lpmonu/7nsGJj3N6aQQySBz+sAYDyY7FZ1GefQsRUZ3L8wwNThP52majeNtCnE2xJ4u5AHqt3VYZ4/kLap0ya7wIa/XUIGsZA/gCurNl8Xwb70GIWvttTIzTyu5JlfF3w6QQt/UINJ8Fysupk4CmoMPus=</SignatureValue>
<KeyInfo Id="KI-af4cbe1efbed4efc973aac357c086c2f">
<wsse:SecurityTokenReference wsu:Id="STR-2367a492da7d44e6862444c8d9c3bcf3">
<wsse:Reference URI="#X509-1f801956043443f290ef048e4d1100cb" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" />
</wsse:SecurityTokenReference>
</KeyInfo>
</Signature>
Tengo problemas para insertar los prefijos para el grupo de nodos Signature como los genera SOAPUI:
ds:
wsse: (wsse:SecurityTokenReference)
ec: (< ec:InclusiveNamespaces PrefixList="soap wcf" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>)
Tengo entendido que un documento después que se ha insertado la firma no puede modificarse y debido a esto quisiera recibir alguna ayuda para corregir el problema y generar un mensaje SOAP valido.
Muchas gracias por su colaboración.