dmvrtx / php-signed-soap-client

PHP SOAP Client with SOAP Message Security support

PHP SoapClient with SOAP Message Security

Requirements

• PHP compiled with SOAP support
• xmllint utility (ubuntu/debian has it in libxml2-utils package)
• HTTPRequest class provided by pecl_http extension

Usage

This class supports SOAP Message Security standard.

You should set certificate (in PFX or PKCS7 format) while initializng class. Other HTTP options, identical to HTTPRequest class request options are accepted too:

$client = new SignedSoapClient(
        'https://example.com?wsdl', 
        array(
                'ssl' => array(
                        'cert' => '/file',
                        'certpasswd' => 'password'
                        )
                )
);

Class signes SOAP-ENV:Body part of the message by default, this behaviour can be changed in buildSignedInfo method.

php-signed-soap-client's Issues

Class 'HTTPRequest' not found

Hello dear friend, im trying to use your class but i got PHP Fatal error: Uncaught SoapFault exception: [Client] Class 'HTTPRequest' on line 236.
Any recommendation?
Kind regards!

consumption error with https and ssl signature

Fatal error: Uncaught SoapFault exception: [WSDL] SOAP-ERROR: Parsing WSDL: Couldn't load from 'https://demo-servicesesb.datacredito.com.co/wss/dhws3/services/DHServicePlus?wsdl' : failed to load external entity "https://demo-servicesesb.datacredito.com.co/wss/dhws3/services/DHServicePlus?wsdl" in C:\xampp\htdocs\WsDemo\4.php:54 Stack trace: #0 C:\xampp\htdocs\WsDemo\4.php(54): SoapClient->SoapClient('https://demo-se...', Array) #1 C:\xampp\htdocs\WsDemo\4.php(281): SignedSoapClient->__construct('https://demo-se...', Array) #2 {main} thrown in C:\xampp\htdocs\WsDemo\4.php on line 54

$url= 'https://demo-servicesesb.datacredito.com.co/wss/dhws3/services/DHServicePlus?wsdl';
$client = new SignedSoapClient($url, array('ssl' => array('cert' => 'llave.p12','certpasswd' => 'seve2020')));

How should I use it, it throws me this error to try to use the class.
Can you give me an example of using the class to sign the header

`POST https://demo-servicesesb.datacredito.com.co:443/wss/dhws3/services/DHServicePlus HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: ""
Content-Length: 6120
Host: demo-servicesesb.datacredito.com.co:443
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.5 (Java/12.0.1)

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:v1="http://ws.hc2.dc.com/v1">
soapenv:Header
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:UsernameToken wsu:Id="UsernameToken-B628723B56469CA2B516065725499617">wsse:Usernamedfdfdfdfdf</wsse:Username><wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">dfdsffdfdfdfdsf</wsse:Password>
<wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">4+gVCZChKtFBeWygQ/44JQ==</wsse:Nonce>
wsu:Created2020-11-28T14:09:09.960Z</wsu:Created>
</wsse:UsernameToken>
<wsu:Timestamp wsu:Id="TS-B628723B56469CA2B516065725495456">
wsu:Created2020-11-28T14:09:09.545Z</wsu:Created>
wsu:Expires2020-11-28T14:10:09.545Z</wsu:Expires>
</wsu:Timestamp>
<wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509PKIPathv1" wsu:Id="X509-B628723B56469CA2B516065725491591">MIIFujCCBbYwggSeoAMCAQICEAdWOJ5kdYOJj4XpunYZRewwDQYJKoZIhvcNAQELBQAwgY8xCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE3MDUGA1UEAxMuU2VjdGlnbyBSU0EgRG9tYWluIFZhbGlkYXRpb24gU2VjdXJlIFNlcnZlciBDQTAeFw0yMDEwMjgwMDAwMDBaFw0yMTEwMjgyMzU5NTlaMBYxFDASBgNVBAMTC3pldmUuY29tLmNvMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4iiWAQOg9US66DEsOwpvOAeeHxBuCCX/8dByVDWwEQnW/468EThO6PgTI27f2vIRurVGJaVIzZiv8bZMGV4q+qRkGjNr2ouzRuBXf/NUOH06rBwj14rQgL4zRfA4zqHFcwBXJML+LH0ixpnWjcaPQBiFq7m1yLRMuKO/aLLDYtmX1bcPFsRbuCSaE14x3Yref87arVKKkDiq5zI3XxaouUIvQ3aeXVg0sag9GYJ6UtsIIYZfVtwVFag0gVnzwH0c6va6CheBjSfvgbqEt01yymXP7nv9czyYHpEbiHVZFD8Lv/IUflvCvezbk8942AvkbD6xOX3riZZGlSiQpzXg0wIDAQABo4IChDCCAoAwHwYDVR0jBBgwFoAUjYxexFStiuF36Zv5mwXhuAGNYeEwHQYDVR0OBBYEFAZ84xpq65DNUAxpM1iq9NiGG1ylMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBJBgNVHSAEQjBAMDQGCysGAQQBsjEBAgIHMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMAgGBmeBDAECATCBhAYIKwYBBQUHAQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29SU0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAnBgNVHREEIDAeggt6ZXZlLmNvbS5jb4IPd3d3LnpldmUuY29tLmNvMIIBBAYKKwYBBAHWeQIEAgSB9QSB8gDwAHYAfT7y+I//iFVoJMLAyp5SiXkrxQ54CX8uapdomX4i8NcAAAF1b9XpiQAABAMARzBFAiB3wTE0CV0KMsrR9u+K1yPIyfAZa9IHLHL3VSnCgwelKQIhAO/1ouZkUdfpWLGhuX5rBScOvsHaS/fSLYTwt9FLXy1dAHYAlCC8Ho7VjWyIcx+CiyIsDdHaTV5sT5Q9YdtOL1hNosIAAAF1fddfdsfdfMj9qjkK/s</wsse:BinarySecurityToken><ds:Signature Id="SIG-B628723B56469CA2B516065725494535" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">ds:SignedInfo<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces PrefixList="soapenv v1" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:CanonicalizationMethod><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#id-B628723B56469CA2B516065725493734">ds:Transforms<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces PrefixList="v1" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>ds:DigestValueqRuWWseXJFeT8pcEdqSWA2QWK6I=</ds:DigestValue></ds:Reference></ds:SignedInfo>ds:SignatureValue1+HdkjQ/S94blovaYLr1Ttgy12V/rkJMDbotOWMxHoIcySUoHwD8I1brl/bilJ/fhvicnsfP42zI
cbrjFc6W67/9BDXg8xoVmTAVXyjD3whlOVpizkqWUr+HO5t7hiiKXoz2f3KPVWixCPzw1YBANMni
nxABw/sH++xOl659q+Tu+vSpl3VIfdfdsffsdwHpoQ87lFBKXS7etRwgqp
+Py0dZn6nHh/3M9wTQsHHcS9JpGwTWCVaFGNeZPoSUPAo2Ph/xrfTgZaacsszkiWQNClpV1Rm1NL
Vb4xKbSdnL2fdfd4l7+asLFqg8Dx0UDwY7mFRaBqLg==</ds:SignatureValue><ds:KeyInfo Id="KI-B628723B56469CA2B516065725493612"><wsse:SecurityTokenReference wsse11:TokenType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509PKIPathv1" wsu:Id="STR-B628723B56469CA2B516065725493653" xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"><wsse:Reference URI="#X509-B628723B56469CA2B516065725491591" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509PKIPathv1"/></wsse:SecurityTokenReference></ds:KeyInfo></ds:Signature>
</wsse:Security>
</soapenv:Header>
<soapenv:Body wsu:Id="id-B628723B56469CA2B516065725493734" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
v1:consultarHC2
v1:solicitud
v1:clave034JAY</v1:clave>
v1:identificacion1057184125</v1:identificacion>
v1:primerApellidoACUÑA</v1:primerApellido>
v1:producto64</v1:producto>
v1:tipoIdentificacion1</v1:tipoIdentificacion>
v1:usuario93ddddda4389</v1:usuario>

v1:parametros

v1:parametro

v1:tipo?</v1:tipo>

v1:nombre?</v1:nombre>

v1:valor?</v1:valor>
</v1:parametro>
</v1:parametros>
</v1:solicitud>
</v1:consultarHC2>
</soapenv:Body>
</soapenv:Envelope>`

Signed Header

How to sign just the header?

Thank you.

not compatible __doRequest function

Getting error

SignedSoapClient::__doRequest($request, $location, $action, $version) should be compatible with SoapClient::__doRequest($request, $location, $action, $version, $one_way = NULL)"

Warning: openssl_x509_read(): supplied parameter cannot be coerced into an X509 certificate!

Sup,

I'm using key.pem to signing xml document, and get this error. If you get the same error and you can't change key to pfx or pcks7, just use something like that: xmlspec

xmlsec --sign --output doc-signed.xml \
     --privkey-pem userkey.pem doc.xml

or xmlsec1 ;-) And don't waste your time...