WebService CXF学习（高级篇3）：WS-Security

    这一节我们来探讨一下WebService安全问题，如果所有系统都运行在一个封闭的局域网内，那么可以不考虑网络攻击，拒绝服务，消息篡改，窃取等问题。但通常情况都接入互联网，那么我就得考虑信息安全问题，像前面那样直接将消息裸传，肯定不行。那么，我们就得给消息加密。CXF可以结合WSS4J来对消息安全进行管理，可以使用令牌，X.509认证对消息头或内容进行加密。这节我只对令牌加密做一个简单的描述，我们还以Demo的形式来讲解一下。
    这个Demo是在CXF+Spring+Hibernate的基础修改而成。在这里我只针对修改的东西进行讲解。

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:jaxws="http://cxf.apache.org/jaxws"
	xsi:schemaLocation="
		http://www.springframework.org/schema/beans 
		http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
		http://cxf.apache.org/jaxws 
		http://cxf.apache.org/schemas/jaxws.xsd">
	<import resource="classpath:META-INF/cxf/cxf.xml" />
	<import resource="classpath:META-INF/cxf/cxf-extension-soap.xml" />
	<import resource="classpath:META-INF/cxf/cxf-servlet.xml" />


	<jaxws:endpoint id="service"
		implementor="com.itdcl.service.ServiceImpl" address="/Service">
		<jaxws:inInterceptors>
			<bean
				class="org.apache.cxf.interceptor.LoggingInInterceptor" />
			<bean
				class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor" />
			<bean
				class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
				<constructor-arg>
					<map>
						<entry key="action" value="UsernameToken" />
						<entry key="passwordType"
							value="PasswordText" />
						<entry key="user" value="cxfServer" />
						<entry key="passwordCallbackRef">
							<ref bean="serverPasswordCallback" />
						</entry>
					</map>
				</constructor-arg>
			</bean>
		</jaxws:inInterceptors>
	</jaxws:endpoint>

	<bean id="serverPasswordCallback"
		class="com.itdcl.ws.ServerPasswordCallback" />

</beans>

    action:UsernameToken指使用用户令牌
    passwordType:PasswordText指密码加密策略，这里直接文本
    user:cxfServer指别名
    passwordCallBackRef:serverPasswordCallback指消息验证

    消息验证类：

package com.itdcl.ws;

import java.io.IOException;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;

import org.apache.ws.security.WSPasswordCallback;

public class ServerPasswordCallback implements CallbackHandler {

	public void handle(Callback[] callbacks) throws IOException,
			UnsupportedCallbackException {
		WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
		String pw = pc.getPassword();
		String idf = pc.getIdentifier();
		System.out.println("password:"+pw);
		System.out.println("identifier:"+idf);
		if (pw.equals("josen") && idf.equals("admin")) {
			// 验证通过
		} else {
			throw new SecurityException("验证失败");
		}
	}

}

     消息验证类通过实现CallbackHandler接口，实现handle方法来进行用户认证。

     那么，客户端又怎样来验证消息是否确呢。

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:jaxws="http://cxf.apache.org/jaxws"
	xsi:schemaLocation="
		http://www.springframework.org/schema/beans 
		http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
		http://cxf.apache.org/jaxws 
		http://cxf.apache.org/schemas/jaxws.xsd">

	<jaxws:client id="service"
		address="http://localhost:9999/cxf/Service"
		serviceClass="com.itdcl.service.IService">
		<jaxws:outInterceptors>
			<bean
				class="org.apache.cxf.interceptor.LoggingOutInterceptor" />
			<bean
				class="org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor" />
			<bean
				class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
				<constructor-arg>
					<map>
						<entry key="action" value="UsernameToken" />
						<entry key="passwordType"
							value="PasswordText" />
						<entry key="user" value="cxfClient" />
						<entry key="passwordCallbackRef">
							<ref bean="clientPasswordCallback" />
						</entry>
					</map>
				</constructor-arg>
			</bean>
		</jaxws:outInterceptors>
	</jaxws:client>

	<bean id="clientPasswordCallback"
		class="com.itdcl.ws.ClientPasswordCallback" />
</beans>

    客户端在发送SOAP时对消息对认证，策略跟服务端一样。但是认证类有所区别：

package com.itdcl.ws;

import java.io.IOException;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;

import org.apache.ws.security.WSPasswordCallback;

public class ClientPasswordCallback implements CallbackHandler {

	public void handle(Callback[] callbacks) throws IOException,
			UnsupportedCallbackException {
		for(int i=0;i<callbacks.length;i++)
        {
             WSPasswordCallback pc = (WSPasswordCallback)callbacks[i];
             pc.setPassword("josen");
             pc.setIdentifier("admin");
        }
	}

}

     客户端在发送消息，设置好用户名和密码。服务端用相应的用户名和密码进行验证。

     令牌验证就如此简单。

评论

6 楼 yangzg216 2012-12-10  

安全验证貌似有问题，服务端获取不到client传递过去的password。
把下面服务器端验证代码

 if (pw.equals("josen") && idf.equals("admin")) {  
            // 验证通过  
        } else {  
            throw new SecurityException("验证失败");  
        }  

改成

 if (idf.equals("admin")) {  
              pc.setPassword("josen");  
        } else {  
            throw new SecurityException("验证失败");  
        }  

这样就好使了。应该是客户端和服务器端都去setPassword，然后它会自动去判断两个Password是不是相同。相同则验证通过，否则失败。

5 楼 夜乡晨 2011-10-03  

服务器端好像不能直接拿到密码。授权信息失败。

4 楼 yl9448 2011-08-12  

能不能发一份源码给我呢 [e-mail]   ，我在client调用总是报错
    public static void main(String args[]) throws Exception {
        ClassPathXmlApplicationContext context = new ClassPathXmlApplicationContext(new String[]{"net/cxf/client/client-beans.xml"});
        HelloWorld client = (HelloWorld) context.getBean("client");
        String str = client.sayHi("fuhaidong");

        System.out.println(
                "client: " + str);
    }

报错如下：
Exception in thread "main" javax.xml.ws.soap.SOAPFaultException: MustUnderstand headers:[{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Security] are not understood
at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:146)
at $Proxy37.sayHi(Unknown Source)
at net.cxf.client.HelloWorldClientTest.main(HelloWorldClientTest.java:61)

3 楼 session&cookies 2010-12-02  

在服务器端使用了CXF的WS-Security，客户端用axis的话如何处理？如何发送给服务器端验证？

2 楼 xuzhfa123 2010-11-25  

你捕捉异常信息

1 楼 yulon 2010-11-24  

若验证失败，怎么给客户端返回调用失败的信息