CXF 安全认证
CXF的webService已经创建好，但没有安全可言，毕竟这是Internet服务呀。
CXF给了一个很完整的安全架构，但CXF给出的ws_security DEMO太复杂了，又是password jks X509 Timestamp。 我试了很多次都没有成功。化繁为简，只实现一个user password好了。下面开始
编写cxf.xml在原来的bean的地方声明一下就可以了
Java代码
<bean id="WSS4JInInterceptor" class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
<constructor-arg>
<map>
<entry key="action" value="UsernameToken" />
<entry key="passwordType" value="PasswordText" />
<entry key="passwordCallbackClass"
value="com.xxxx.Service.ServerPasswordCallback" />
</map>
</constructor-arg>
</bean>
<jaxws:endpoint id="chartScreen" implementor="#chartScreenService"
address="/ChartScreenService" >
<jaxws:inInterceptors>
<bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor" />
<ref bean="WSS4JInInterceptor" />
</jaxws:inInterceptors>
</jaxws:endpoint>
<bean id="WSS4JInInterceptor" class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
<constructor-arg>
<map>
<entry key="action" value="UsernameToken" />
<entry key="passwordType" value="PasswordText" />
<entry key="passwordCallbackClass"
value="com.mms.webservice.test.ServerPasswordCallback" />
</map>
</constructor-arg>
</bean>
<jaxws:endpoint id="helloWorld"
implementor="com.mms.webservice.HelloWorldImpl"
address="/HelloWorld">
<jaxws:inInterceptors>
<!--
<bean
class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor" />
<bean
class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
<constructor-arg>
<map>
<entry key="action" value="UsernameToken" />
<entry key="passwordType" value="PasswordText" />
<entry key="passwordCallbackClass"
value="com.mms.webservice.test.ServerPasswordCallback" />
</map>
</constructor-arg>
</bean>
-->
<ref bean="WSS4JInInterceptor" />
</jaxws:inInterceptors>
</jaxws:endpoint>
WSS4JInInterceptor就是我们要定义的东东了。CXf已经帮你写好了。设置属性就可以了。里面属性值挺多的，CXF的文档就是太简单了，opensource的弊病！属性值就查API吧。
下面需要写server端的密码回调函数，验证logic就在这里定义了。
Java代码
public class ServerPasswordCallback implements CallbackHandler {
private Map<String, String> passwords = new HashMap<String, String>();
public ServerPasswordCallback(){
passwords.put("admin", "admin");
passwords.put("test", "test");
}
@Override
public void handle(Callback[] callbacks) throws IOException,
UnsupportedCallbackException {
for (int i = 0; i < callbacks.length; i++) {
WSPasswordCallback pc = (WSPasswordCallback) callbacks[i];
if(!passwords.containsKey(pc.getIdentifier()))
throw new WSSecurityException("user not match");
String pass = passwords.get(pc.getIdentifier());
String pwd = pc.getPassword();
if (pwd == null || !pwd.equals(pass)){
throw new WSSecurityException("password not match");
}
}
}
}就此server端的验证就全部ok了。这时再调用原来的调用程序就会报ws_security错误了。
下面给出Client验证程序
其实就是在soapheader上加相应内容。也需要用到inInterceptors
Java代码
public class ClientPasswordCallback implements CallbackHandler {
private Map<String, String> passwords =
new HashMap<String, String>();
public ClientPasswordCallback(){
passwords.put("admin", "admin");
passwords.put("test", "test");
}
@Override
public void handle(Callback[] callbacks) throws IOException,
UnsupportedCallbackException {
for (int i = 0; i < callbacks.length; i++) {
WSPasswordCallback pc = (WSPasswordCallback) callbacks[i];
int usage = pc.getUsage();
if(!passwords.containsKey(pc.getIdentifier()))
throw new WSSecurityException("user not exists ");
String pass = passwords.get(pc.getIdentifier());
if (usage == WSPasswordCallback.USERNAME_TOKEN && pass != null) {
pc.setPassword(pass);
return;
}
}
}
}
JaxWsProxyFactoryBean factory = new JaxWsProxyFactoryBean();
Map<String, Object> outProps = new HashMap<String, Object>();
outProps.put(WSHandlerConstants.ACTION,
WSHandlerConstants.USERNAME_TOKEN);
outProps.put(WSHandlerConstants.USER, "admin");
outProps.put(WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_TEXT);
outProps.put(WSHandlerConstants.PW_CALLBACK_CLASS,
ClientPasswordCallback.class.getName());
WSS4JOutInterceptor wssOut = new WSS4JOutInterceptor(outProps);
factory.getOutInterceptors().add(wssOut);
factory.getOutInterceptors().add(new SAAJOutInterceptor());
factory.setServiceClass(IChartScreenService.class);
factory.setAddress("http://localhost:8080/ECFlight/service/ChartScreenService");
IChartScreenService service = (IChartScreenService) factory.create();
也可采用spring 配置：
<!-- wssecurity -->
<bean id="clientPasswordCallback" class="com.evermoresw.megp.utilities.ClientPasswordCallback" />
<bean id="wsOutInterceptor" class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
<constructor-arg>
<map>
<entry key="action" value="UsernameToken" />
<entry key="passwordType" value="PasswordText" />
<entry key="user" value="admin" />
<entry key="passwordCallbackRef">
<ref bean="clientPasswordCallback" />
</entry>
</map>
</constructor-arg>
</bean>
<jaxws:client id="client_testService" serviceClass="com.evermore.moa.service.Test"
address="http://localhost:8080/cxfTestServer/service/testService">
<jaxws:outInterceptors>
<bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor" />
<ref bean="wsOutInterceptor"/>
</jaxws:outInterceptors>
</jaxws:client>
问题：Exception in thread "main" java.lang.NoClassDefFoundError: org/apache/xml/security/Init
加上：xmlsec-1.4.3.jar包
For WS-Security support:
- bcprov-jdk15.jar
- xalan.jar
- serializer.jar
- wss4j.jar
- xmlsec.jar