CFX 和Spring 整合Ws Security 出现的问题

待我称王封你为后i 2022-04-14 02:12 236阅读 0赞

package com.easyway.cxf.security;

import java.io.IOException;  
import java.util.HashMap;  
import java.util.Map;

import javax.security.auth.callback.Callback;  
import javax.security.auth.callback.CallbackHandler;  
import javax.security.auth.callback.UnsupportedCallbackException;

import org.apache.ws.security.WSPasswordCallback;  
/\*\*  
 \* 采用回调方法检测WS调用的安全性  
 \* @author longgangbai  
 \*  
 \*/  
public class ServerPasswordHandler implements CallbackHandler\{

private Map<String, String> passwords;    
   
 public ServerPasswordHandler()\{  
  passwords=new HashMap<String, String>();  
     passwords.put("admin", "admin");    
        passwords.put("test", "test");    
        passwords.put("userName", "password");  
 \}  
   
 public void handle(Callback\[\] callbacks) throws IOException,  
   UnsupportedCallbackException \{  
   WSPasswordCallback pc = (WSPasswordCallback) callbacks\[0\];   
   //获取用户名  
   String id = pc.getIdentifier();  
   System.out.println("id==="+id);  
   //获取密码  
   String password = pc.getPassword();   
      if(passwords.containsKey(id))\{  
       if(!password.equals(passwords.get(id)))\{  
        throw new SecurityException("wrong password");  
       \}  
      \}else\{  
       throw new SecurityException("wrong username");  
      \}  
 \}  
\}  
package com.easyway.cxf.security;

import java.io.IOException;

import javax.security.auth.callback.Callback;  
import javax.security.auth.callback.CallbackHandler;  
import javax.security.auth.callback.UnsupportedCallbackException;  
import org.apache.ws.security.WSPasswordCallback;

public class ClientPasswordCallback implements CallbackHandler \{

public void handle(Callback\[\] callbacks) throws IOException,  
    UnsupportedCallbackException \{  
             WSPasswordCallback pc = (WSPasswordCallback) callbacks\[0\];     
             int usage = pc.getUsage();     
             System.out.println("identifier: " + pc.getIdentifier());     
             System.out.println("usage: " + pc.getUsage());     
             if (usage == WSPasswordCallback.USERNAME\_TOKEN) \{   
              System.out.println("admin =====");  
                     pc.setPassword("admin");    
                     pc.setIdentifier("admin");  
             \}  
  \}

package com.easyway.cxf.service;

import javax.jws.WebParam;  
import javax.jws.WebService;  
import java.util.List;

import com.easyway.cxf.model.User;  
/\*\*  
 \*  
 \* 采用JaxWS发布服务  
 \* 备注在接口中必须使用@WebService 注解否则出现错误  
 \*  
 \*  
 \* @author longgangbai  
 \*  
 \*/  
@WebService  
public interface HelloService \{  
 /\*\*  
  \* The @WebParam annotation is necessary as java interfaces do not store the Parameter name in the .class file. So if you leave out the annotation your parameter will be named arg0.  
  \* @param name  
  \* @return  
  \*/  
  public String hello(@WebParam(name="text")String name);  
   
  /\*\*  
   \* Advanced usecase of passing an Interface in.  JAX-WS/JAXB does not  
   \* support interfaces directly.  Special XmlAdapter classes need to  
   \* be written to handle them  
   \*/  
  public String sayHi(User user);

public String\[\] getAllUseNames(List<User> userList);  
\}  
package com.easyway.cxf.service;

import java.util.LinkedHashMap;  
import java.util.List;  
import java.util.Map;

import javax.jws.WebService;

import com.easyway.cxf.model.User;  
/\*\*  
 \*  
 \*  采用JaxWS发布服务  
 \*   
 \* JAX-WS includes many more annotations as well such as:  
 \*  
 \* @WebMethod - allows you to customize the operation name, exclude the operation from inclusion in the service, etc  
 \* @WebParam - allows you to customize a parameter's name, namespace, direction (IN or OUT), etc  
 \* @WebResult - allows you to customize the return value of the web service call  
 \*  
 \* @author longgangbai  
 \*  
 \*/  
@WebService(endpointInterface = "com.easyway.cxf.service.HelloService",  
        serviceName = "HelloService")  
public class HelloServiceImpl implements HelloService \{

Map<Integer, User> users = new LinkedHashMap<Integer, User>();

public String hello(String username) \{  
        return "Hello " + username;  
 \}

public String sayHi(User user) \{  
         users.put(users.size() + 1, user);  
         return "Hello "  + user.getUsername();  
 \}  
 public String\[\] getAllUseNames(List<User> userList) \{  
  String\[\] userListArr=new String\[userList.size()\];  
  for (int i=0;i<userList.size();i++) \{  
   userListArr\[i\]=userList.get(i).getUsername();  
  \}  
  return userListArr;  
 \}

采用如下代码测试没有问题：

package com.easyway.cxf.test.client.security;

import java.util.HashMap;  
import java.util.Map;

import org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor;  
import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;  
import org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor;  
import org.apache.ws.security.WSConstants;  
import org.apache.ws.security.handler.WSHandlerConstants;

import com.easyway.cxf.security.ClientPasswordCallback;  
import com.easyway.cxf.service.HelloService;  
import com.easyway.cxf.test.client.CFXClient;  
/\*\*  
 \*  
 \* @author Administrator  
 \*  
 \*/  
public class CXFClientSecurity \{  
public static void main(String\[\] args) \{  
 JaxWsProxyFactoryBean factory=new JaxWsProxyFactoryBean();  
 Map<String, Object> outProps = new HashMap<String, Object>();  
 outProps.put(WSHandlerConstants.ACTION,WSHandlerConstants.USERNAME\_TOKEN);  
 outProps.put(WSHandlerConstants.USER, "userName");  
 outProps.put(WSHandlerConstants.PASSWORD\_TYPE, WSConstants.PW\_TEXT);  
 outProps.put(WSHandlerConstants.PW\_CALLBACK\_CLASS,  
 ClientPasswordCallback.class.getName());  
 WSS4JOutInterceptor wssOut = new WSS4JOutInterceptor(outProps);  
 factory.getOutInterceptors().add(wssOut);  
 factory.getOutInterceptors().add(new SAAJOutInterceptor());  
 factory.setServiceClass(HelloService.class);  
 //和服务端发送路径一样的  
 factory.setAddress(CFXClient.SERVICE\_ADDRESS);  
 HelloService helloService=(HelloService)factory.create();  
 String msg=helloService.hello("xiaobai");  
 System.out.println("msg="+msg);  
\}  
\}  
package com.easyway.cxf.test.client.security;

import java.util.HashMap;  
import java.util.Map;

<?xml version="1.0" encoding="UTF-8"?>  
<beans xmlns="[http://www.springframework.org/schema/beans][http_www.springframework.org_schema_beans]"  
                 xmlns:xsi="[http://www.w3.org/2001/XMLSchema-instance][http_www.w3.org_2001_XMLSchema-instance]"  
                 xmlns:jaxws="[http://cxf.apache.org/jaxws][http_cxf.apache.org_jaxws]"  
                 xsi:schemaLocation="  
                       [http://www.springframework.org/schema/beans][http_www.springframework.org_schema_beans]  
                       [ http://www.springframework.org/schema/beans/spring-beans.xsd][http_www.springframework.org_schema_beans_spring-beans.xsd]  
                       [http://cxf.apache.org/jaxws][http_cxf.apache.org_jaxws] [http://cxf.apache.org/schemas/jaxws.xsd][http_cxf.apache.org_schemas_jaxws.xsd]">  
                    
 <import resource="classpath:META-INF/cxf/cxf.xml"/>  
 <import resource="classpath:META-INF/cxf/cxf-extension-soap.xml"/>  
 <import resource="classpath:META-INF/cxf/cxf-servlet.xml"/>  
        
      
  <bean id="logIn" class="org.apache.cxf.interceptor.LoggingInInterceptor" />  
  <bean id="logOut" class="org.apache.cxf.interceptor.LoggingOutInterceptor" />  
  <bean id="saajIn" class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor" />  
  <bean id="wss4jIn" class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">  
      <constructor-arg>  
     <map>  
      <entry key="action" value="UsernameToken"></entry>  
      <entry key="passwordType" value="PasswordText" />  
      <entry key="passwordCallbackClass" value="com.easyway.cxf.security.ServerPasswordHandler" />  
     </map>  
   </constructor-arg>  
  </bean>     
   
   
  <bean id="helloServiceBean" class="com.easyway.cxf.service.HelloServiceImpl"></bean>  
     
<bean id="proxyFactory" class="org.apache.cxf.jaxws.JaxWsServerFactoryBean">  
    <property name="serviceBean">  
        <ref bean="helloServiceBean"/>  
    </property>  
    <property name="address" value="[http://localhost:8080/HelloService"/][http_localhost_8080_HelloService]>  
     
    <property name="inInterceptors">  
      <list>  
        <ref bean="logIn" />  
         <ref bean="saajIn" />  
        <ref bean="wss4jIn" />  
      </list>  
    </property>  
     
    <property name="outInterceptors">  
      <list>  
        <ref bean="logOut" />  
      </list>  
    </property>  
  </bean>  
   
   
<bean id="server" class="org.apache.cxf.jaxws.JaxWsServerFactoryBean" factory-bean="proxyFactory"  factory-method="create" />

</beans>

client：applicationContext-client.xml

<?xml version="1.0" encoding="UTF-8"?>  
<beans xmlns="[http://www.springframework.org/schema/beans][http_www.springframework.org_schema_beans]"  
                 xmlns:xsi="[http://www.w3.org/2001/XMLSchema-instance][http_www.w3.org_2001_XMLSchema-instance]"  
                 xmlns:jaxws="[http://cxf.apache.org/jaxws][http_cxf.apache.org_jaxws]"  
                 xsi:schemaLocation="  
                       [http://www.springframework.org/schema/beans][http_www.springframework.org_schema_beans]  
                       [ http://www.springframework.org/schema/beans/spring-beans.xsd][http_www.springframework.org_schema_beans_spring-beans.xsd]  
                       [http://cxf.apache.org/jaxws][http_cxf.apache.org_jaxws] [http://cxf.apache.org/schemas/jaxws.xsd][http_cxf.apache.org_schemas_jaxws.xsd]">  
   
    
  <bean id="logIn" class="org.apache.cxf.interceptor.LoggingInInterceptor" />  
  <bean id="logOut" class="org.apache.cxf.interceptor.LoggingOutInterceptor" />  
  <bean id="saajOut" class="org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor" />  
  <bean id="wss4jOut" class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">  
    <constructor-arg>  
      <map>  
        <entry key="action" value="UsernameToken" />  
        <entry key="user" value="ws-client" />  
        <entry key="passwordType" value="PasswordText" />  
        <entry key="passwordCallbackClass" value="com.easyway.cxf.security.ClientPasswordCallback" />  
      </map>  
    </constructor-arg>  
  </bean>     
   
     
<bean id="proxyFactory" class="org.apache.cxf.jaxws.JaxWsProxyFactoryBean">  
    <property name="serviceClass" value="com.easyway.cxf.service.HelloService"/>  
    <property name="address" value="[http://localhost:8080/HelloService"/][http_localhost_8080_HelloService]>  
    <property name="inInterceptors">  
      <list>  
        <ref bean="logIn" />  
      </list>  
    </property>  
      
  </bean>  
  
<bean id="client" class="org.apache.cxf.jaxws.JaxWsProxyFactoryBean" factory-bean="proxyFactory" factory-method="create" />

</beans>

测试代码；  
package com.easyway.cxf.test.server;

import org.apache.cxf.endpoint.Server;  
import org.springframework.context.ApplicationContext;  
import org.springframework.context.support.ClassPathXmlApplicationContext;  
/\*\*  
 \* Spring 和CXF 整合客户端 测试  
 \* @author longgangbai  
 \*  
 \*/  
public class SpringCXFServer \{  
   
 public static void main(String\[\] args) \{  
    Thread wsPublisher = new Thread(new WebServicePublish());  
    wsPublisher.start();  
   \}

private static class WebServicePublish implements Runnable \{  
    public void run() \{

ApplicationContext ctx=new ClassPathXmlApplicationContext("/applicationContext-server.xml");  
      
     Server client = (Server)ctx.getBean("server");  
     client.start();  
    \}  
   \}

\}  
package com.easyway.cxf.test.client;

import org.springframework.context.ApplicationContext;  
import org.springframework.context.support.ClassPathXmlApplicationContext;

import com.easyway.cxf.model.User;  
import com.easyway.cxf.service.HelloService;  
/\*\*  
 \* Spring 和CXF 整合客户端 测试  
 \* @author longgangbai  
 \*  
 \*/

public class SpringCXFClient \{  
   
 public static void main(String\[\] args) \{  
    ApplicationContext ctx=new ClassPathXmlApplicationContext("/applicationContext-client.xml");  
     
    HelloService client = (HelloService)ctx.getBean("client");  
     
          User user=new User();  
          user.setPassword("password");  
          user.setUsername("username");  
          System.out.println(client.sayHi(user));  
    
    
 \}

\}  
客户端正常，服务端报错：

\------------------------------------  
Exception in thread "main" javax.xml.ws.soap.SOAPFaultException: An error was discovered processing the <wsse:Security> header  
 at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:147)  
 at $Proxy45.sayHi(Unknown Source)  
 at com.easyway.cxf.test.client.SpringCXFClient.main(SpringCXFClient.java:25)  
Caused by: org.apache.cxf.binding.soap.SoapFault: An error was discovered processing the <wsse:Security> header

[http_www.springframework.org_schema_beans]: http://www.springframework.org/schema/beans
[http_www.w3.org_2001_XMLSchema-instance]: http://www.w3.org/2001/XMLSchema-instance
[http_cxf.apache.org_jaxws]: http://cxf.apache.org/jaxws
[http_www.springframework.org_schema_beans_spring-beans.xsd]: http://www.springframework.org/schema/beans/spring-beans.xsd
[http_cxf.apache.org_schemas_jaxws.xsd]: http://cxf.apache.org/schemas/jaxws.xsd
[http_localhost_8080_cxf_services_helloService_wsdl]: http://localhost:8080/cxf/services/helloService?wsdl
[http_localhost_8080_HelloService]: http://localhost:8080/HelloService%22/