Security Token Service

最新推荐文章于 2021-12-01 13:34:33 发布
最新推荐文章于 2021-12-01 13:34:33 发布
阅读量309 收藏
点赞数
分类专栏： ESB 文章标签： ws trust security
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/graceglili/article/details/84252870
版权
[b]Introduction to WS-Trust[/b]
[u]Overview[/u]

The WS-Trust standard is based around a centralized security server (the [color=blue]Security Token Service[/color]), which is capable of authenticating clients and can issue tokens containing various kinds of authentication and authorization data.
[u]WS-Trust specification[/u]

The WS-Trust features of Artix are based on the WS-Trust standard from Oasis:

http://docs.oasis-open.org/ws-sx/ws-trust/v1.4/ws-trust.html

[u]Supporting specifications[/u]

Apart from the WS-Trust specification itself, several other specifications play an important role in the WS-Trust architecture, as follows:

WS-SecurityPolicy 1.2

SAML 2.0

Username Token Profile

X.509 Token Profile

SAML Token Profile

Kerberos Token Profile

[u]WS-Trust architecture[/u]

Figure 8.1 shows a general overview of the WS-Trust architecture.
[img]http://fusesource.com/docs/esb/4.4/cxf_security/images/ws_trust_01.gif[/img]

Figure 8.1. WS-Trust Architecture
WS-Trust Architecture

[u]Requestor[/u]

A requestor is an entity that tries to invoke a secure operation over a network connection. In practice, a requestor is typically a Web service client.

[u]Relying party[/u]

A relying party refers to an entity that has some services or resources that must be secured against unauthorized access. In practice, a relying party is typically a Web service.
[Note] Note

This is a term defined by the SAML specification, not by WS-Trust.
[u]Security token[/u]

A security token is a collection of security data that a requestor sends inside a request (typically embedded in the message header) in order to invoke a secure operation or to gain access to a secure resource. In the WS-Trust framework, the notion of a security token is quite general and can be used to describe any block of security data that might accompany a request.

In principle, WS-Trust can be used with the following kinds of security token:

SAML token.

UsernameToken token.

X.509 certificate token.

Kerberos token.

[u]SAML token[/u]

A SAML token is a particularly flexible kind of security token. The SAML specification defines a general-purpose XML schema that enables you to wrap almost any kind of security data and enables you to sign and encrypt part or all of the token.

SAML is a popular choice of token to use in the context of WS-Trust, because SAML has all of the necessary features to support typical WS-Trust authentication scenarios.
[u]Claims[/u]

A SAML security token is formally defined to consist of a collection of claims. Each claim typically contains a particular kind of security data.
[u]Policy[/u]

In WS-Trust scenarios, a policy can represent the security configuration of a participant in a secure application. The requestor, the relying party, and the security token service are all configured by policies. For example, a policy can be used to configure what kinds of authentication are supported and required.
[u]Security token service[/u]

The security token service (STS) lies at the heart of the WS-Trust security architecture. In the WS-Trust standard, the following bindings are defined (not all of which are supported by Apache CXF):

Issue binding—the specification defines this binding as follows: Based on the credential provided/proven in the request, a new token is issued, possibly with new proof information.

Validate binding—the specification defines this binding as follows: The validity of the specified security token is evaluated and a result is returned. The result may be a status, a new token, or both.

Renew binding—the specification defines this binding as follows: A previously issued token with expiration is presented (and possibly proven) and the same token is returned with new expiration semantics.

Cancel binding—the specification defines this binding as follows: When a previously issued token is no longer needed, the Cancel binding can be used to cancel the token, terminating its use.
graceglili
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
简单易懂的Security Token Service实例以及介绍
makeuknow
09-29 8289
首先我们来说说STS（Security Token Service）的最简生命周期，当然这是要基于WIF（Windows Identity Foundation）框架的。 一.  分析传入数据的可用性，并创建SignInRequestMessage WSFederationMessage提供CreateFromUri以及CreateFromNameValueCollection等简单的
[Cloud Computing]Mechanisms: Secure Token Service
zjysource的专栏
07-22 352
Secure Token Service A secure token service (STS) issues security tokens as a result of consumer requests for single sign-on (SSO) tokens. The STS authenticates the consumer and issues a security
[译] Security Token 生态 — 项目指南
weixin_34413103的博客
11-18 260
原文地址：Your Official Guide to the Security Token Ecosystem 原文作者：Tatiana Koffman 译文出自：掘金翻译计划 — 区块链分舵 本文永久链接：github.com/xitu/blockc… 译者：StellaBauhinia 通证的新纪元正在到来。如果 2017 是 Utility Token 的一年，那么 2018 年无...
Security Token Service-STS和SAML Token
06-14 772
sts的出现是为了解决server对client的信任问题。 sts引进了一个被信任的第三方来解决安全访问的问题。这个被信任的第三方就是STS服务器。我把这种通过引入第三方的方式称作“叫来一个神”。支付宝在交易时就是这样一个角色。 sts服务器是同时被client和server所信任的第三方。当client发出请求时，首先会被重定向到sts服务器，sts服务器校验过client的saml to
SpringSecurity6
最新发布
02-01
在本文中，我们将深入探讨如何使用SpringSecurity6实现用户登录认证，以及如何自定义用户名和密码登录认证，同时还会涉及自定义JWT（JSON Web Token）认证，包括AccessToken和RefreshToken的认证过程。 首先，...
Stopping, starting, or restarting VMware vCenter Server Appliance 6.x services
11-07
Stopping, starting, or restarting VMware vCenter Server Appliance 6.x services
springboot-token代码版eclipse
07-10
在Eclipse中开发这样的项目，你需要安装Spring Boot插件，设置项目的依赖，包括Spring Security和JWT库（如jjwt），编写对应的Controller、Service和Security配置类。调试和测试时，可以使用Postman这样的工具模拟...
awsb-token
03-12
AWSB令牌，全称为Amazon Web Services (AWS) Security Token Service (STS) 的临时凭证，是AWS提供的一种安全机制，用于短期访问AWS资源。在AWS环境中，长期凭据（如访问密钥ID和秘密访问密钥）可能会带来安全性风险...
Spring Security 把授权信息写入数据库
07-15
【Spring Security 把授权信息写入数据库】 Spring Security是一个强大的安全管理框架，用于处理Java应用程序的安全需求，包括认证和授权。在从Acegi安全框架转换到Spring Security 2.0时，一个重要的变化就是如何...
VMware vCenter突然无法正常登陆，出现[503 Service Unavailable]
荒野求生的博客
09-14 1万+
VMware vCenter突然无法正常登陆，出现[503 Service Unavailable] 文章目录 问题描述 问题分析 解决方案 参考资料 问题描述 客户的Veeam邮件通知每日备份失败，原因是用户与密码认证失败。鉴于是通过VMware vCenter实施虚拟化基盘整体备份的，那么VMware vCenter是否出现密码变更？ 通过远程检查发现情况如下： VMware vCenter Web界面出现异常信息 503 Service Unavailable (.
【登录】身份认证(用户名密码/accountToken)->用户授权(authToken)->换服务Token(serviceToken)
tuhuolong的专栏
05-30 1万+
检查 vCenter Server 上 STS 证书的过期日期 (79248)
zds_008的博客
12-01 2634
检查 vCenter Server 上 STS 证书的过期日期
webService----wss4j+cxf实现WS-Security(基于UsernameToken)
u012524790的博客
03-18 525
　　　 最近研究了下webservice，今天和大家分享一下wss4j+cxf基于UsernameToken的安全验证。名词解释：             cxf         : apache下的一个开源项目，用于发布webservice。      WSS4J  : Web Services Security for Java.  废话少说，直接上代码。    1. 首先，需要导入c...
ArcGIS Engine 10.2 如何发布服务
ArcGIS产品与技术专栏
12-17 1万+
1         ArcGIS Engine 10.2 如何发布服务 ArcGIS Engine的代码不能直接将MXD地图文档作为数据源进行发布，如果要发布的话，需要用ArcMap将MXD转成MSD，然后使用转换成功的MSD文档进行发布，代码如下：   public void Publish(string host,string username,string pass
Spring Security Oauth2系列（六）
索南杰夕的专栏
06-01 1303
摘要：每次测试和新的需求更改导致发生了bug，我都会持续更新相关系列文章。本文主要讲解前面系列文章的一个bug，当用户登录过后，立即关闭浏览器，反复操作，切记执行退出登录流程，会发生一个问题，登录不上，现在就来解决这个问题吧。直接关闭浏览器导致后续登录不上的原因：speingsecurity oauth2登录流程很重要的一个环节是token的校验，试想这样一个场景，立即登录过后，你的token还在...
简单解决VMware Authorization Service问题
热门推荐
qq_42812564的博客
03-23 2万+
简单解决VMware Authorization Service问题第一个问题：VMware Workstation 无法连接到虚拟机。请确保您有权运行该程序、访问该程序使用的所有目录以及访问所有临时文件目录。 VMware Authorization Service 当前未运行第二个问题 服务列表里并没有VMware Authorization Service第三个问题 如果以上你都做了，而然报...
spring security如何集成token请用代码说明
07-22
当使用Spring Security进行身份验证和授权时，可以通过集成令牌(token)来增强安全性。以下是一个示例代码，演示了如何集成基于令牌的身份验证和授权。 首先，需要添加相关的依赖项到项目的构建文件（例如pom.xml）中： ```xml <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency> <dependency> <groupId>io.jsonwebtoken</groupId> <artifactId>jjwt</artifactId> <version>0.9.1</version> </dependency> ``` 接下来，创建一个用于生成和解析令牌的TokenProvider类： ```java import io.jsonwebtoken.Claims; import io.jsonwebtoken.Jwts; import io.jsonwebtoken.SignatureAlgorithm; import org.springframework.beans.factory.annotation.Value; import org.springframework.stereotype.Component; import java.util.Date; @Component public class TokenProvider { @Value("${app.jwtSecret}") private String jwtSecret; @Value("${app.jwtExpirationInMs}") private int jwtExpirationInMs; public String generateToken(String username) { Date now = new Date(); Date expiryDate = new Date(now.getTime() + jwtExpirationInMs); return Jwts.builder() .setSubject(username) .setIssuedAt(new Date()) .setExpiration(expiryDate) .signWith(SignatureAlgorithm.HS512, jwtSecret) .compact(); } public String getUsernameFromToken(String token) { Claims claims = Jwts.parser() .setSigningKey(jwtSecret) .parseClaimsJws(token) .getBody(); return claims.getSubject(); } public boolean validateToken(String token) { try { Jwts.parser().setSigningKey(jwtSecret).parseClaimsJws(token); return true; } catch (Exception ex) { return false; } } } ``` 在上述代码中，TokenProvider类包含了生成令牌、解析令牌和验证令牌的方法。需要注意的是，需要在配置文件(application.properties或application.yml)中配置jwtSecret和jwtExpirationInMs属性。 然后，创建一个用于处理身份验证和授权的SecurityConfig类： ```java import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.http.HttpMethod; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity(prePostEnabled = true) public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private CustomUserDetailsService customUserDetailsService; @Autowired private JwtAuthenticationEntryPoint unauthorizedHandler; @Bean public JwtAuthenticationFilter jwtAuthenticationFilter() { return new JwtAuthenticationFilter(); } @Override public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception { authenticationManagerBuilder .userDetailsService(customUserDetailsService) .passwordEncoder(passwordEncoder()); } @Override protected void configure(HttpSecurity http) throws Exception { http .cors() .and() .csrf() .disable() .exceptionHandling() .authenticationEntryPoint(unauthorizedHandler) .and() .sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.STATELESS) .and() .authorizeRequests() .antMatchers("/api/auth/**").permitAll() .anyRequest().authenticated(); http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class); } @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } @Bean @Override public AuthenticationManager authenticationManagerBean() throws Exception { return super.authenticationManagerBean(); } } ``` 在上述代码中，SecurityConfig类继承了WebSecurityConfigurerAdapter，并覆盖了configure方法。通过配置HttpSecurity，我们可以定义哪些URL需要进行身份验证和授权。 最后，创建一个用于处理用户详情的CustomUserDetailsService类： ```java import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.stereotype.Service; @Service public class CustomUserDetailsService implements UserDetailsService { @Autowired private UserRepository userRepository; @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { User user = userRepository.findByUsername(username) .orElseThrow(() -> new UsernameNotFoundException("User not found with username: " + username)); return UserPrincipal.create(user); } } ``` 在上述代码中，CustomUserDetailsService类实现了UserDetailsService接口，并覆盖了loadUserByUsername方法。该方法根据用户名从数据库中加载用户信息。 这样，我们就完成了Spring Security与令牌的集成。可以使用TokenProvider类生成和解析令牌，使用SecurityConfig类配置身份验证和授权规则，使用CustomUserDetailsService类加载用户信息。

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值