CXF 2.5 服务端和客户端添加安全认证

最新推荐文章于 2017-02-07 15:57:04 发布

原创最新推荐文章于 2017-02-07 15:57:04 发布 · 443 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#WebService

WebService 专栏收录该内容

2 篇文章

订阅专栏

本文介绍如何使用Apache CXF实现带有安全认证的WebService。包括服务端配置与客户端调用过程，涵盖Spring框架整合及UsernameToken认证方式。

CXF Download : http://www.apache.org/dyn/closer.cgi?path=/cxf/2.5.2/apache-cxf-2.5.2.zip

服务端代码

IHi.java

package com.cumce.spring.service;

import javax.jws.WebParam;
import javax.jws.WebResult;
import javax.jws.WebService;
//import javax.jws.soap.SOAPBinding;
//import javax.jws.soap.SOAPBinding.Style;

/**
 * IHi.java
 * 
 * @author  
 * @version 1.0, 2012-2-26
 * @since   JDK1.5
 */
@WebService
//@SOAPBinding(style = Style.RPC)
public interface IHi {
	
	@WebResult(name = "result") String call(@WebParam(name = "name") String name);

}

Hi.java

package com.cumce.spring.service;

import javax.jws.WebParam;
import javax.jws.WebResult;
import javax.jws.WebService;

/**
 * Hi.java
 * 
 * @author 
 * @version 1.0, 2012-2-26
 * @since   JDK1.5
 */
@WebService
public class Hi implements IHi {

	/* (non-Javadoc)
	 * @see com.cumce.spring.service.IHi#call(java.lang.String)
	 */
	@Override
	public @WebResult(name = "result") String call(@WebParam(name = "name") String name) {
		String s = "Hi, " + name;
		System.out.println(s);
		return s;
	}

}

ServerPasswordCallback.java

package com.cumce.spring.handler;

import java.io.IOException;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;

import org.apache.ws.security.WSPasswordCallback;

/**
 * ServerPasswordCallback.java
 * 
 * @author 
 * @version 1.0, 2012-2-26
 * @since   JDK1.5
 */
public class ServerPasswordCallback implements CallbackHandler {
	
	/* (non-Javadoc)
	 * @see javax.security.auth.callback.CallbackHandler#handle(javax.security.auth.callback.Callback[])
	 */
	@Override
	public void handle(Callback[] callbacks) throws IOException,
			UnsupportedCallbackException {
		
		WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
		if (pc.getIdentifier().equals("user_name")) { // username
			pc.setPassword("password"); // password
			System.out.println("通过安全认证");
		}

	}

}

application-context.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
	xmlns:jaxws="http://cxf.apache.org/jaxws"
	xmlns:http-conf="http://cxf.apache.org/transports/http/configuration"
	xsi:schemaLocation="http://www.springframework.org/schema/beans 
		http://www.springframework.org/schema/beans/spring-beans.xsd 
		http://cxf.apache.org/jaxws 
		http://cxf.apache.org/schemas/jaxws.xsd
		http://cxf.apache.org/transports/http/configuration 
		http://cxf.apache.org/schemas/configuration/http-conf.xsd">
	
	<import resource="classpath:META-INF/cxf/cxf.xml" />
	<import resource="classpath:META-INF/cxf/cxf-extension-*.xml" />
	<import resource="classpath:META-INF/cxf/cxf-servlet.xml" />
	
	<!-- 发布服务 -->
	<bean id="obj" class="com.cumce.spring.service.Hi" />
	<jaxws:endpoint id="hi" implementor="#obj" address="/hiService">
		<jaxws:inInterceptors>
			<bean class="org.apache.cxf.interceptor.LoggingInInterceptor" />
			<bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor" />
			<bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
				<constructor-arg>
					<map>
						<entry key="action" value="UsernameToken" />
						<entry key="passwordType" value="PasswordDigest" />
						<entry key="passwordCallbackRef">
							<ref bean="serverPasswordCallback" />
                        </entry>
					</map>
				</constructor-arg>
			</bean>  
		</jaxws:inInterceptors>
	</jaxws:endpoint>
	<bean id="serverPasswordCallback" class="com.cumce.spring.handler.ServerPasswordCallback" />
	
</beans>

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
	id="WebApp_ID" version="2.5">
	<display-name>SPN</display-name>
	
	<!-- Spring -->
	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>classpath*:application-context.xml</param-value>
	</context-param>
	<listener>
		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>
	
	<!-- CXF -->
	<servlet>
		<servlet-name>CXFServlet</servlet-name>
		<servlet-class>org.apache.cxf.transport.servlet.CXFServlet</servlet-class>
		<load-on-startup>1</load-on-startup>
	</servlet>
	<servlet-mapping>
		<servlet-name>CXFServlet</servlet-name>
		<url-pattern>/*</url-pattern>
	</servlet-mapping>
	
	<welcome-file-list>
		<welcome-file>index.jsp</welcome-file>
	</welcome-file-list>
</web-app>

启动Tomcat服务，发布WebService，略...

客户端代码

ClientPasswordCallback.java

package com.cumce.spring.handler;

import java.io.IOException;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;

import org.apache.ws.security.WSPasswordCallback;

/**
 * ClientPasswordCallback.java
 * 
 * @author
 * @version 1.0, 2012-2-26
 * @since   JDK1.5
 */
public class ClientPasswordCallback implements CallbackHandler {

	/* (non-Javadoc)
	 * @see javax.security.auth.callback.CallbackHandler#handle(javax.security.auth.callback.Callback[])
	 */
	@Override
	public void handle(Callback[] callbacks) throws IOException,
			UnsupportedCallbackException {

		WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
		// Identifier和Password不能为空,否则无法通过验证
		pc.setIdentifier("user_name"); // username
		pc.setPassword("password"); // password

	}

}

application-client.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
	xmlns:jaxws="http://cxf.apache.org/jaxws"
	xmlns:http-conf="http://cxf.apache.org/transports/http/configuration"
	xsi:schemaLocation="http://www.springframework.org/schema/beans 
		http://www.springframework.org/schema/beans/spring-beans.xsd 
		http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd
		http://cxf.apache.org/transports/http/configuration 
		http://cxf.apache.org/schemas/configuration/http-conf.xsd">
	
	<import resource="classpath:META-INF/cxf/cxf.xml" />
	<import resource="classpath:META-INF/cxf/cxf-extension-*.xml" />
	<import resource="classpath:META-INF/cxf/cxf-servlet.xml" />
	
	<bean id="propertyConfigurer" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
		<property name="locations">
			<list>
				<value>classpath:webservice_security.properties</value>
			</list>
		</property>
	</bean>

	<!-- 查找服务 -->
	<jaxws:client id="client" address="http://localhost:8080/spring/hiService" 
		serviceClass="com.cumce.spring.service.IHi">
		<jaxws:outInterceptors>
			<bean class="org.apache.cxf.interceptor.LoggingOutInterceptor" />
            <bean class="org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor" />
            <bean class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
            	<constructor-arg>
            		<map>
            			<entry key="action" value="UsernameToken" />
						<entry key="passwordType" value="PasswordDigest" />
						<entry key="user" value="user_name" />
            			<entry key="passwordCallbackRef">
                            <ref bean="clientPasswordCallback" />
                        </entry>
            		</map>
            	</constructor-arg>
            </bean>
		</jaxws:outInterceptors>
	</jaxws:client>
	<bean id="clientPasswordCallback" class="com.cumce.spring.handler.ClientPasswordCallback" />
	
</beans>

SpringClient.java

package com.cumce.spring.client;

import javax.xml.ws.soap.SOAPFaultException;

import org.springframework.context.ApplicationContext;
import org.springframework.context.support.ClassPathXmlApplicationContext;

import com.cumce.spring.service.IHi;
import com.cumce.spring.service.pojo.IPersonService;

/**
 * SpringClient.java
 * 
 * @author 
 * @version 1.0, 2012-2-26
 * @since   JDK1.5
 */
public class SpringClient {

	/**
	 * Application entry point.
	 */
	public static void main(String[] args) {

		ApplicationContext context = new ClassPathXmlApplicationContext("application-client.xml");
		try {
			IHi hi = (IHi) context.getBean("client");
			System.out.println(hi.call("CXF Client"));
		} catch (SOAPFaultException ex) {
			ex.printStackTrace();
		}
	}

}