CXF学习笔记(4)-HelloWorld!-安全认证

最新推荐文章于 2020-12-30 02:22:03 发布

SQZHAO

最新推荐文章于 2020-12-30 02:22:03 发布

阅读量568

点赞数

分类专栏： Java

Java 专栏收录该内容

97 篇文章

订阅专栏

本文介绍如何在Web服务中引入基于用户名和密码的认证机制，以确保只有授权客户端可以调用服务，通过配置拦截器实现客户端与服务器共享的用户名密码验证流程。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

前3节中介绍了如何发布一个webservice和客户端如何调用，一切貌似都正常，但存在着安全隐患-这样导致任意的客户端都可以调用我们的webservice服务，接下来将介绍如何采用基于用户名和密码认证的方式来实现客户端调用

1.服务器端配置

a.在发布service的时候为该service添加一个WSS4JInInterceptor 拦截器

表示我们的service需要用户提供用户名和密码认证后才能调用

[java] view plain copy print ?

package com.crazycoder2010.webservice.cxf.server;
import java.util.HashMap;
import java.util.Map;
import javax.servlet.ServletConfig;
import org.apache.cxf.endpoint.Endpoint;
import org.apache.cxf.endpoint.Server;
import org.apache.cxf.frontend.ServerFactoryBean;
import org.apache.cxf.service.invoker.BeanInvoker;
import org.apache.cxf.transport.servlet.CXFNonSpringServlet;
import org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor;
import org.apache.ws.security.WSConstants;
import org.apache.ws.security.handler.WSHandlerConstants;
import com.crazycoder2010.webservice.cxf.server.HelloWorldServiceImpl;
public class WebServiceServlet extends CXFNonSpringServlet {
private static final long serialVersionUID = -5314312869027558456L;
@Override
protected void loadBus(ServletConfig servletConfig) {
super.loadBus(servletConfig);
System.out.println("#####################");
ServerFactoryBean svrFactory = new ServerFactoryBean();
svrFactory.setServiceClass(HelloWorldService.class);
svrFactory.setAddress("/passportService");
svrFactory.setInvoker(new BeanInvoker(new HelloWorldServiceImp()));
Server server = svrFactory.create();
Endpoint cxfEndpoint = server.getEndpoint();
Map<String, Object> inProps = new HashMap<String, Object>();
inProps.put(WSHandlerConstants.ACTION,
WSHandlerConstants.USERNAME_TOKEN);
inProps.put(WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_DIGEST);
inProps.put(WSHandlerConstants.PW_CALLBACK_CLASS,
ServerPasswordHandler.class.getName());
cxfEndpoint.getInInterceptors().add(new WSS4JInInterceptor(inProps));
}
}

package com.crazycoder2010.webservice.cxf.server;  
  
import java.util.HashMap;
import java.util.Map;

import javax.servlet.ServletConfig;

import org.apache.cxf.endpoint.Endpoint;
import org.apache.cxf.endpoint.Server;
import org.apache.cxf.frontend.ServerFactoryBean;
import org.apache.cxf.service.invoker.BeanInvoker;
import org.apache.cxf.transport.servlet.CXFNonSpringServlet;
import org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor;
import org.apache.ws.security.WSConstants;
import org.apache.ws.security.handler.WSHandlerConstants;  
  
<span><span class="keyword"></span></span>import com.crazycoder2010.webservice.cxf.server.HelloWorldServiceImpl;  
  
public class WebServiceServlet extends CXFNonSpringServlet {  
    private static final long serialVersionUID = -5314312869027558456L;  
  
    @Override  
    protected void loadBus(ServletConfig servletConfig) {  
        super.loadBus(servletConfig);  
        System.out.println("#####################");  
        ServerFactoryBean svrFactory = new ServerFactoryBean();
        svrFactory.setServiceClass(HelloWorldService.class);
        svrFactory.setAddress("/passportService");
        svrFactory.setInvoker(new BeanInvoker(new HelloWorldServiceImp()));
        Server server = svrFactory.create();
        Endpoint cxfEndpoint = server.getEndpoint();
        Map<String, Object> inProps = new HashMap<String, Object>();
        inProps.put(WSHandlerConstants.ACTION,
                WSHandlerConstants.USERNAME_TOKEN);
        inProps.put(WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_DIGEST);
        inProps.put(WSHandlerConstants.PW_CALLBACK_CLASS,
                ServerPasswordHandler.class.getName());
        cxfEndpoint.getInInterceptors().add(new WSS4JInInterceptor(inProps));
    }  
}

b.处理用户名和密码的逻辑

添加一个ServerPasswordHandler类，该类实现CallbackHandler接口，user='kevin',password='111111'为该service的访问用户名密码

[java] view plain copy print ?

public class ServerPasswordHandler implements CallbackHandler{
private String user = "kevin";
private String password = "111111";
@Override
public void handle(Callback[] callbacks) throws IOException,
UnsupportedCallbackException {
WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
if(user.equals(pc.getIdentifier())){
pc.setPassword(password);
}
}
}

public class ServerPasswordHandler implements CallbackHandler{
	private String user = "kevin";
	private String password = "111111";
	@Override
	public void handle(Callback[] callbacks) throws IOException,
			UnsupportedCallbackException {
		WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
		if(user.equals(pc.getIdentifier())){
			pc.setPassword(password);
		}
	}
}

2.客户端配置

a.配置WSS4JOutInterceptor拦截器，表示发出请求的时候将以提供的用户名和密码信息提交到服务器端认证

[java] view plain copy print ?

public class WebServiceFactory {
public static PassportService getHelloWorldService(){
Map<String,Object> outProps = new HashMap<String,Object>();
outProps.put(WSHandlerConstants.ACTION, WSHandlerConstants.USERNAME_TOKEN);
outProps.put(WSHandlerConstants.USER, "kevin");//这个用户即服务器端配置的用户名
outProps.put(WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_DIGEST);
outProps.put(WSHandlerConstants.PW_CALLBACK_CLASS, ClientPasswordHandler.class.getName());//这个类用来获取客户端认证用户名密码信息
JaxWsProxyFactoryBean bean = new JaxWsProxyFactoryBean();
bean.getInInterceptors().add(new LoggingInInterceptor());
bean.getInFaultInterceptors().add(new LoggingOutInterceptor());
bean.setServiceClass(PassportService.class);
bean.setAddress("http://localhost:8080/CXF-Server/webservice/helloWorldService");
HelloWorldService helloWorldService = (HelloWorldService)bean.create();
ClientProxy clientProxy = (ClientProxy)Proxy.getInvocationHandler(passportService);
Client client = clientProxy.getClient();
client.getOutInterceptors().add(new WSS4JOutInterceptor(outProps));//配置拦截器
return helloWorldService;
}
}

public class WebServiceFactory {
	public static PassportService getHelloWorldService(){
	Map<String,Object> outProps = new HashMap<String,Object>();
	outProps.put(WSHandlerConstants.ACTION, WSHandlerConstants.USERNAME_TOKEN);
	outProps.put(WSHandlerConstants.USER, "kevin");//这个用户即服务器端配置的用户名
	outProps.put(WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_DIGEST);
	outProps.put(WSHandlerConstants.PW_CALLBACK_CLASS, ClientPasswordHandler.class.getName());//这个类用来获取客户端认证用户名密码信息
	JaxWsProxyFactoryBean bean = new JaxWsProxyFactoryBean();  
        bean.getInInterceptors().add(new LoggingInInterceptor());  
        bean.getInFaultInterceptors().add(new LoggingOutInterceptor()); 
        bean.setServiceClass(PassportService.class);
        bean.setAddress("http://localhost:8080/CXF-Server/webservice/helloWorldService"); 
        HelloWorldService helloWorldService = (HelloWorldService)bean.create();
        ClientProxy clientProxy = (ClientProxy)Proxy.getInvocationHandler(passportService);
        Client client = clientProxy.getClient();
        client.getOutInterceptors().add(new WSS4JOutInterceptor(outProps));//配置拦截器
        return helloWorldService;
	}
}

b.配置客户端认证信息类

[java] view plain copy print ?

public class ClientPasswordHandler implements CallbackHandler{
@Override
public void handle(Callback[] callbacks) throws IOException,
UnsupportedCallbackException {
WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
pc.setPassword("kevin");//这个地方的用户名和密码与服务器端保持一致
pc.setIdentifier("111111");
}
}

public class ClientPasswordHandler implements CallbackHandler{
	@Override
	public void handle(Callback[] callbacks) throws IOException,
			UnsupportedCallbackException {
	WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
        pc.setPassword("kevin");//这个地方的用户名和密码与服务器端保持一致	
        pc.setIdentifier("111111");
	}
}

c.客户端调用

[java] view plain copy print ?

public class DemoClient {
public static void main(String[] args) {
<PRE class=java name="code"> HelloWorldService helloWorldService = WebServiceFactory.getHelloWorldService();
helloWorldService.sayHello("John");
}
}</PRE>
<PRE></PRE>
<PRE></PRE>
小结：
这种方式利用服务器端与客户端共享同一用户名密码的方式实现了webservice的安全访问，流程图如下
<IMG style="WIDTH: 433px" alt="" src="http://hi.youkuaiyun.com/attachment/201108/17/0_13135751629tGv.gif" jQuery17013429473743959463="1">
参考资料：<A href="http://cxf.apache.org/docs/ws-security.html" target=_blank>http://cxf.apache.org/docs/ws-security.html</A>