[Python] How to Authenticate Zeep SOAP Client with Certificate from Windows Certificate Store?

I've looked quite deep into this but have had no success. I've tried a ton of methods. Basically, I have a .pfx file which I convert to a .pem file (since that's what zeep requires). I then pass the cert and key as a wsse BinarySignature to a Client object.

When running, I get

raise SignatureVerificationFailed()
zeep.exceptions.SignatureVerificationFailed


I've pinpointed the problem area down to this area of code in zeep's signature.py's _verify_envelope_with_key function:

header = envelope.find(QName(soap_env, "Header"))
if header is None:
raise SignatureVerificationFailed()


It seems as though it cannot find the header.

I've tried disabling verification as well, since the wsdl endpoint I connect to has <sp:HttpsToken RequireClientCertificate="false"/>.

This is one method I've tried so far of many. Is it possible that I need to load the .pfx file directly from the windows certification store to avoid stripping any necessary certificate authorization data?

Here is the script for the abovementioned scenario:

def setup_client():
session = Session()
session.verify = False
session.cert = (CERT_PATH, KEY_PATH)
transport = Transport(session=session)

settings = Settings(strict=False, xml_huge_tree=True)

wsse = BinarySignature(certfile=CERT_PATH, key_file=KEY_PATH)

client = Client(WSDL_URL, transport=transport, settings=settings, wsse=wsse)

return client

def main():

load_dotenv()

client = setup_client()

print(client)

response = client.service.Logout(
sessionId=0,
)


Note that I'm able to connect to the wsdl and retrieve information from it, but cannot send requests to it via the Client object. Thanks for any help on this, and I can offer more context on what I have and haven't tried if necessary. Thanks!

(You can also assume all the variables are properly defined/stored somewhere, but I exclude them here for security reasons).

Continue reading...