How to sign custom Soap Header?

Question

Hello

I've added a custom soap header <MyApp:FOO> element to the <soap:Header> element and the requirments states that i must sign this element , how would one do that? <MyApp:FOO> contains a number of things (username, preferences, etc) that identifies a user on higher level. I've succesfully used a policy file and now a policyClass with CertificateAssertions and SoapFilters to sign wsu:Timestamp, wsu:action, wsu:MessageId etc. But now the <MyApp:FOO> element needs to signed aswell.

What i've understood this far is that the element that needs to be signed must be indentified with a wsu:Id attribute and then transformed using xml-exc-c14n.

So, how do I specify that the soap header should be signed aswell? This is the current class that i use for signing my message.

internal class FOOClientOutFilter: SendSecurityFilter
{
X509SecurityToken clientToken;

public FOOClientOutFilter(SSEKCertificateAssertion parentAssertion)
: base(parentAssertion.ServiceActor, true)
{
// Get the client security token.
clientToken = X509TokenProvider.CreateToken(StoreLocation.CurrentUser, StoreName.My, "CN=TestClientCert");

// Get the server security token.
serverToken = X509TokenProvider.CreateToken(StoreLocation.LocalMachine, StoreName.My, "CN=TestServerCert");
}

public override void SecureMessage(SoapEnvelope envelope, Security security)
{
// Sign the SOAP message with the client's security token.
security.Tokens.Add(clientToken);

security.Elements.Add(new MessageSignature(clientToken));
}
}

Answer 1

My current version of SecureMessage seems to do the trick..

 public override void SecureMessage(SoapEnvelope envelope, Security security)
 {
  //EncryptedData data = new EncryptedData(userToken);
  SignatureReference ssekSignature = new SignatureReference();
  MessageSignature signature = new MessageSignature(clientToken);
  // encrypt custom headers

  for (int index = 0; index < envelope.Header.ChildNodes.Count; index++)
  {
   XmlElement child =
     envelope.Header.ChildNodes[index] as XmlElement;

   // find all FOO headers
   if (child != null && child.Name == "FOO")
   {
    string id = Guid.NewGuid().ToString();
    child.SetAttribute("Id", "http://docs.oasis-" +
       "open.org/wss/2004/01/oasis-200401-" +
       "wss-wssecurity-utility-1.0.xsd", id);
    signature.AddReference(new SignatureReference("#" + id));
   }
  }

  // Sign the SOAP message with the client's security token.
  security.Tokens.Add(clientToken);

  security.Elements.Add(signature);
 }

Answer 2

Including supplementary articles from MSDN

How to: Add an Id Attribute to a SOAP Header

How to: Digitally Sign a Custom SOAP Header