Repository navigation
workday web-service x509 SignatureVerificationFailed #1084
Description
Activity
I finally managed to connect to workday. However, I had to patch the source code.
Here is some info on the same
- I encountered the
'list' object has no attribute 'verify'. I follow the simple bug fix 1077.
if client.wsse:
# client.wsse.verify(doc)
if isinstance(client.wsse, list):
for wsse in client.wsse:
wsse.verify(doc)
else:
client.wsse.verify(doc)
- I also encountered zeep.exceptions.SignatureVerificationFailed. Upon verification, it seems the code is checking for security information in the response header which workday was not providing. Had to comment the below line of code in /zeep/wsse/signature.py at line 71
def verify(self, envelope):
key = _make_verify_key(self.cert_data)
# _verify_envelope_with_key(envelope, key)
return envelope
- Like I mentioned in my problem statement, the payload being generated by zeep contained the
wsse:SecurityTokenReferencewhich the workday studio tester payload was not. So, I reverse engineered to see if I can match the payload to what workday studio tester was generating. Below is the change I had to do /zeep/wsse/signature.py
# sec_token_ref = etree.SubElement(key_info, QName(ns.WSSE, "SecurityTokenReference"))
sec_token_ref = []
return security, sec_token_ref, x509_data
- There were a couple more edits I had to do based on link. Below is the change I made in signature.py
# xmlsec.template.add_transform(ref, xmlsec.Transform.EXCL_C14N)
xmlsec.template.add_transform(ref, xmlsec.Transform.ENVELOPED)
another here
ref = xmlsec.template.add_reference(
# signature, digest_method or xmlsec.Transform.SHA1, uri="#" + node_id
signature, digest_method or xmlsec.Transform.SHA1, uri=""
)
I was finally able to generate the payload and got a successful response.
@mvantellingen - Could you take a look at these changes and vet them? I am a noob in making changes to the source code. However, if you could take a look a look, I'd really be grateful to you. I would like to understand if by doing these above changes, I am not compromising the security of the zeep package as we intend to go ahead use it with X509 auth.
Reacted by Caio Salgado
Hello folks,
This is my first post. Please bear with me if I have made a mistake.
I am trying to connect to workday web-services with X509 signature. On the workday side, they have enabled the X509 only auth. The workday guy tested this using workday studio. It works there. I couldn't make it work in SOAP UI and below zeep too.
Below is the code snippet.
I specified the
digest_methodas the one being generated by zeep in the soap header is different from another envelope (working - generated by workday studio). However, I am still experiencing the below error.Note that I did change the code by following this link which I was earlier experiencing https://github.com/mvantellingen/python-zeep/pull/1077/files.
This is my security tag being generated. For security reasons, I have partially removed some info.
One thing I did observe in the soap header (working in workday studio) is that the
wsse:SecurityTokenReferenceis absent. Not sure what it means at this time.Please help !