让Apache CXF支持WS-Security规范

接上例：http://blog.csdn.net/kunshan_shenbin/archive/2008/12/26/3613918.aspx

新建2个批处理文件用以生成服务端及客户端密钥文件。

generateKeyPair.bat

1. rem @echo off
2. echo alias %1
3. echo keypass %2
4. echo keystoreName %3
5. echo KeyStorePass %4
6. echo keyName %5
8. echo keyName %5
9. keytool -genkey -alias %1 -keypass %2 -keystore %3 -storepass %4  -dname "cn=%1" -keyalg RSA
10. keytool -selfcert -alias %1 -keystore %3 -storepass %4 -keypass %2
11. keytool -export -alias %1 -file %5 -keystore %3 -storepass %4

generateServerKey.bat

1. call generateKeyPair.bat serverAlias aliaspass serverStore.jks keystorePass serverKey.rsa
2. call generateKeyPair.bat client-344-839  client344Password  clientStore.jks keystorePass clientKey.rsa
3. keytool -import -alias serverAlias -file serverKey.rsa -keystore clientStore.jks -storepass keystorePass -noprompt
4. keytool -import -alias client-344-839 -file clientKey.rsa -keystore serverStore.jks -storepass keystorePass -noprompt

注意：

生成的密钥文件中包含的信息：

服务端 账户：serverAlias / aliaspass

客户端 账户：client-344-839 / client344Password

依次运行后生成serverStore.jks和clientStore.jks这2个文件待用。

 

如下图所示建立工程：

所需lib包一览：

XmlSchema-1.4.2.jar
commons-logging-1.1.1.jar
cxf-2.0.9.jar
jaxb-impl-2.0.5.jar
jaxws-api-2.0.jar
neethi-2.0.4.jar
opensaml-1.1.jar
saaj-api-1.3.jar
saaj-impl-1.3.jar
serializer-2.7.1.jar
spring-beans-2.0.8.jar
spring-context-2.0.8.jar
spring-core-2.0.8.jar
spring-web-2.0.8.jar
wsdl4j-1.6.2.jar
wss4j-1.5.4.jar
xalan-2.7.1.jar
xml-resolver-1.2.jar
xmlsec-1.4.0.jar

 

代码如下：

TestServiceClient.java

1. package jp.co.apm.client;
3. import jp.co.apm.service.TestService;
5. import org.springframework.context.ApplicationContext;
6. import org.springframework.context.support.ClassPathXmlApplicationContext;
8. public class TestServiceClient {
10.     public static void main(String[] args) {
11.         
12.         ApplicationContext context = new ClassPathXmlApplicationContext(
13.                 new String[] { "jp/co/apm/client/clientApplicationContext.xml" });
14.         TestService service = (TestService) context.getBean("client");
15.         System.out.println(service.sayHello());
16.     }
17. }

clientApplicationContext.xml

1. <beans xmlns="http://www.springframework.org/schema/beans"
2.     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3.     xmlns:jaxws="http://cxf.apache.org/jaxws"
4.     xsi:schemaLocation="
5.     http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
6.     http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd">
8.     <bean id="client" class="jp.co.apm.service.impl.TestServiceImpl" factory-bean="clientFactory" factory-method="create"/>
10.     <bean id="clientFactory" class="org.apache.cxf.jaxws.JaxWsProxyFactoryBean">
11.         <property name="serviceClass" value="jp.co.apm.service.TestService">
12.         </property>
13.         <property name="address"
14.             value="http://localhost:8080/APM_CXF/services/test">
15.         </property>
16.         <property name="outInterceptors">
17.             <list>
18.                 <bean class="org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor" />
19.                 <ref bean="wss4jOutConfiguration" />
20.             </list>
21.         </property> 
22.     </bean>
24.     <bean id="wss4jOutConfiguration" class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
25.         <property name="properties">
26.             <map>
27.                 <entry key="action" value="Signature" />
28.                 <entry key="user" value="client-344-839" />
29.                 <entry key="passwordType" value="PasswordDigest" />
30.                 <entry key="signatureKeyIdentifier" value="IssuerSerial" />
31.                 <entry key="signaturePropFile" value="jp/co/apm/client/outsecurity_sign.properties" />
32.                 <entry>
33.                     <key>
34.                         <value>passwordCallbackRef</value>
35.                     </key>
36.                     <ref bean="passwordCallback" />
37.                 </entry>
38.             </map>
39.         </property>
40.     </bean>
41.     
42.     <bean id="passwordCallback" class="jp.co.apm.security.PasswordCallbackHandler"/>
44. </beans>

outsecurity_sign.properties

1. org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
2. org.apache.ws.security.crypto.merlin.keystore.type=jks
3. org.apache.ws.security.crypto.merlin.keystore.password=keystorePass
4. org.apache.ws.security.crypto.merlin.alias.password=client344Password
5. org.apache.ws.security.crypto.merlin.keystore.alias=client-344-839
6. org.apache.ws.security.crypto.merlin.file=jp/co/apm/client/clientStore.jks

以下是服务端代码：

PasswordCallbackHandler.java

1. package jp.co.apm.security;
3. import java.io.IOException;
4. import java.util.HashMap;
5. import java.util.Map;
7. import javax.security.auth.callback.Callback;
8. import javax.security.auth.callback.CallbackHandler;
9. import javax.security.auth.callback.UnsupportedCallbackException;
11. import org.apache.ws.security.WSPasswordCallback;
13. public class PasswordCallbackHandler implements CallbackHandler {
15.     private Map<String, String> passwords = new HashMap<String, String>();
17.     public PasswordCallbackHandler() {
18.         passwords.put("serveralias", "aliaspass");
19.         passwords.put("client-344-839", "client344Password");
20.     }
21.     
22.     public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
23.         WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
24.         String id = pc.getIdentifer();
25.         pc.setPassword((String) passwords.get(id));
26.     }
27. }

TestServiceImpl.java

1. package jp.co.apm.service.impl;
3. import javax.jws.WebService;
5. import jp.co.apm.service.TestService;
7. @WebService
8. public class TestServiceImpl implements TestService {
10.     public String sayHello() {
11.         
12.         return "Hello, Shen Bin";
13.     }
14. }

TestService.java

1. package jp.co.apm.service;
3. import javax.jws.WebService;
5. @WebService
6. public interface TestService {
8.     public String sayHello();
9. }

server_insecurity_sign.properties

1. org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
2. org.apache.ws.security.crypto.merlin.keystore.type=jks
3. org.apache.ws.security.crypto.merlin.keystore.password=keystorePass
4. #org.apache.ws.security.crypto.merlin.alias.password=aliaspass
5. org.apache.ws.security.crypto.merlin.keystore.alias=serveralias
6. org.apache.ws.security.crypto.merlin.file=serverStore.jks

cxf-servlet.xml

1. <beans xmlns="http://www.springframework.org/schema/beans"
2.     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3.     xmlns:jaxws="http://cxf.apache.org/jaxws"
4.     xsi:schemaLocation="
5.     http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
6.     http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd">
8.     <import resource="classpath:META-INF/cxf/cxf.xml" />
9.     <import resource="classpath:META-INF/cxf/cxf-extension-soap.xml" />
10.     <import resource="classpath:META-INF/cxf/cxf-servlet.xml" />
12.     <jaxws:endpoint id="testservice" implementor="jp.co.apm.service.impl.TestServiceImpl" address="/test">
13.         <jaxws:features>
14.             <bean class="org.apache.cxf.feature.LoggingFeature"/>
15.         </jaxws:features>
16.         <jaxws:inInterceptors>
17.             <bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor"/>   
18.             <ref bean="wss4jInConfiguration"/>
19.         </jaxws:inInterceptors>
20.     </jaxws:endpoint>
22.     <bean id="wss4jInConfiguration" class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
23.         <property name="properties">
24.             <map>
25.                 <entry key="action" value="Signature"/>
26.                 <!--  
27.                 <entry key="user" value="client-344-839" />
28.                 <entry key="passwordType" value="PasswordDigest" />
29.                 -->
30.                 <entry key="signaturePropFile" value="server_insecurity_sign.properties"/>
31.                 <entry>
32.                     <key>
33.                         <value>passwordCallbackRef</value>
34.                     </key>
35.                     <ref bean="passwordCallback"/>
36.                 </entry>
37.             </map>
38.         </property>
39.     </bean>
40.     
41.     <bean id="passwordCallback" class="jp.co.apm.security.PasswordCallbackHandler"/>
42.     
43. </beans>

web.xml

1. <?xml version="1.0" encoding="UTF-8"?>
2. <web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
3.     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4.     xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
5.     http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
7.     <display-name>APM</display-name>
8.     <description>APM</description>
9.     
10.     <context-param>
11.         <param-name>contextConfigLocation</param-name>
12.         <param-value>WEB-INF/cxf-servlet.xml</param-value>
13.     </context-param>
15.     <listener>
16.         <listener-class>
17.             org.springframework.web.context.ContextLoaderListener
18.         </listener-class>
19.     </listener>
20.     
21.     <servlet>
22.         <servlet-name>APM</servlet-name>
23.         <servlet-class>
24.             org.apache.cxf.transport.servlet.CXFServlet
25.         </servlet-class>
26.         <load-on-startup>2</load-on-startup>
27.     </servlet>
28.     
29.     <servlet-mapping>
30.         <servlet-name>APM</servlet-name>
31.         <url-pattern>/services/*</url-pattern>
32.     </servlet-mapping>
33.     
34.     <session-config>
35.         <session-timeout>60</session-timeout>
36.     </session-config>
37.     
38. </web-app>

差点忘了一个最重要的环节，就是要在java.security中追加一个解密算法的支持：

/jre/lib/security/java.security文件中，追加类似如下语句：

.....

security.provider.5=sun.security.jgss.SunProvider
security.provider.6=com.sun.security.sasl.Provider
security.provider.7=org.bouncycastle.jce.provider.BouncyCastleProvider