SOAP风格webservice安全问题

傷城~ 2022-05-08 15:46 197阅读 0赞

ws接口的安全问题

1 接口调用者身份验证问题

Rsa：私钥加密，公钥解密

Cxf：usernameToken

1 在请求中加入wsse的安全协议

2 在wsse中用安全令牌(用户名/密码)来验证用户的身份

3  cxf在发送和接受ws的soap请求时，在框架中加入回掉函数来处理安全令牌的校验

4 将安全令牌信息放入请求信息中，服务器上在调用方法时拦截并且校验请求这的身份信息

**Cxf：安全令牌拦截器**

**服务器端：**

1.在spring配置文件中**注册服务身份安全拦截器WSS4JInInterceptor bean**，通过构造*注*入在map中依次放入安全令牌，用户密码，以及回调函数

2.注册回调函数类MyPwdCallback，用来处理安全令牌检验。

3.发布的webservice接口类中调用拦截器

spring配置文件内容如下：

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
    	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context"
    	xmlns:jaxws="http://cxf.apache.org/jaxws"
    	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
    		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd
    		http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd">
    
    	<context:property-placeholder location="classpath:dbconfig.properties" />
    	
    	<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource">
    		<property name="driverClassName" value="${driverClassName}" />
    		<property name="url" value="${url}" />
    		<property name="username" value="${jdbc.username}" />
    		<property name="password" value="${jdbc.password}" />
    	</bean>
    
    
    	
    	<bean id="sqlSessionFactoryBean" class="org.mybatis.spring.SqlSessionFactoryBean">
    		<property name="dataSource" ref="dataSource" />
    		<property name="configLocation" value="classpath:mybatis-config.xml" />
    		
    		
    	</bean>
    
    	
    	
    	<bean class="org.mybatis.spring.mapper.MapperScannerConfigurer">
    		<property name="basePackage" value="com.bojoy.mapper" />
    		
    		<property name="sqlSessionFactoryBeanName" value="sqlSessionFactoryBean" />
    	</bean>
    
    	<bean id="login" class="com.bojoy.service.LoginServiceImp" />
    	
    	<bean id="myPwdCallback" class="com.bojoy.service.MyPwdCallback" />
    	
    	<bean id="in" class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
    		<constructor-arg>
    			<map>
    				<entry key="action" value="UsernameToken" />
    				<entry key="passwordType" value="PasswordText" />
    				<entry key="passwordCallbackRef">
    					<ref bean="myPwdCallback" />
    				</entry>
    			</map>
    		</constructor-arg>
    	</bean>
    
    
        
    	<jaxws:endpoint address="/loginServiceInf"
    		implementorClass="com.bojoy.service.LoginServiceInf">
    		<jaxws:inInterceptors>
    			<ref bean="in" />
    		</jaxws:inInterceptors>
    		<jaxws:implementor>
    			<ref bean="login" />
    		</jaxws:implementor>
    	</jaxws:endpoint>
    
    </beans>

接口类MyPwdCallback代码如下：

package com.bojoy.service;
    
    import java.io.IOException;
    
    import javax.security.auth.callback.Callback;
    import javax.security.auth.callback.CallbackHandler;
    import javax.security.auth.callback.UnsupportedCallbackException;
    
    import org.apache.wss4j.common.ext.WSPasswordCallback;
    
    import com.bojoy.util.MyConfigUtil;
    import com.bojoy.util.MyPwTools;
    
    public class MyPwdCallback implements CallbackHandler {
    
    	@Override
    	public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
    
    		
    		 /*WSPasswordCallback wpc = (WSPasswordCallback) callbacks[0]; 
    		 String identifer = wpc.getIdentifer(); 
    		 String pw =MyConfigUtil.getProperties(identifer); 
    		 String getpw = MyPwTools.getPw(identifer, pw); wpc.setPassword(getpw);*/
    		 
    		WSPasswordCallback wpc = (WSPasswordCallback) callbacks[0];
    
    		String identifier = wpc.getIdentifier();
    
    		String password = "";
    
    		if (identifier.equals("cxf")) {
    			password = "wss4j";
    		}
    
    		wpc.setPassword(password);
    
    	}
    
    }

其他内容配置请参考前一篇cxf3.x整合spring4.x内容

发布服务端webservice，这样发布的webservice接口就有了安全令牌校验功能。

用SOAPUI接口进行测试：

将<soapenv:Header>替换成如下内容：

<soapenv:Header>
    
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
    
    <wsse:UsernameToken >
    
    <wsse:Username>cxf</wsse:Username>
    
    <wsse:Password    
    
    Type= "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">wss4j</wsse:Password>
    
    </wsse:UsernameToken>
    
    </wsse:Security>
    
    </soapenv:Header>

其中header中的username和password中为用户名和密码

点击测试，发现接口调用成功

![70][]

以上是用测试工具SOAPUI进行测试。下面编写客户端代码调用

客户端如下：

编写类MypasswordCallback

package com.sale.util;
    
    import java.io.IOException;
    
    import javax.security.auth.callback.Callback;
    import javax.security.auth.callback.CallbackHandler;
    import javax.security.auth.callback.UnsupportedCallbackException;
    
    import org.apache.wss4j.common.ext.WSPasswordCallback;
    //注意WSpasswordCallback是wss4j里面的包，而不是security里面的包。
    
    
    
    public class MyPasswordCallBack implements CallbackHandler {
    
    	@Override
    	public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
    		WSPasswordCallback wpc = (WSPasswordCallback) callbacks[0]; 
    	    wpc.setIdentifier("cxf");
    	    wpc.setPassword("wss4j");
    		
    	}
    
    }

编写测试工具类WSTest，代码如下：

package com.sale.test;
    
    import java.util.HashMap;
    import java.util.Map;
    
    import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;
    import org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor;
    import org.apache.wss4j.dom.handler.WSHandlerConstants;
    
    import com.bojoy.service.LoginServiceInf;
    import com.sale.bean.T_MALL_USER;
    import com.sale.util.MyPasswordCallBack;
    
    public class WSTest {
          public static void main(String[] args) {
    		//http://localhost:8083/abojoy-user/loginServiceInf?wsdl
        	  //webservice  客户端调用代码
        	  JaxWsProxyFactoryBean jaxWsProxyFactoryBean = new JaxWsProxyFactoryBean();
        	  jaxWsProxyFactoryBean.setAddress("http://localhost:8083/abojoy-user/loginServiceInf?wsdl");
        	  jaxWsProxyFactoryBean.setServiceClass(LoginServiceInf.class);
        	  Map<String,Object> map = new HashMap<String,Object>();
    
        	  map.put("action", "UsernameToken");
    
        	  map.put("passwordType", "PasswordText");
    
        	  map.put("user", "user");
    
        	  map.put(WSHandlerConstants.PW_CALLBACK_CLASS, MyPasswordCallBack.class.getName());
    
        	  WSS4JOutInterceptor wss4jOutInterceptor = new WSS4JOutInterceptor(map);
    
        	  //将设置好的拦截器加入jaxWsProxyFactoryBean中
    
        	  jaxWsProxyFactoryBean.getOutInterceptors().add(wss4jOutInterceptor);
    
        	  //注意要在create()方法前添加拦截器
    
        	   LoginServiceInf loginServiceInf  =  (LoginServiceInf) jaxWsProxyFactoryBean.create();
    
        	   T_MALL_USER  user = new T_MALL_USER();
    
        	  user.setYh_mch("xiaoming");
    
        	  user.setYh_mm("123");
    
        	  T_MALL_USER user_info = loginServiceInf.login(user);
    
        	  System.out.println(user_info);
    
        	  }
        	
        	  
    	}

运行WSTest类可以发现调用成功

[70]: /images/20220506/60f6d439f2b5435e817bc22abc8a6abf.png