CXF密码验证_服务端和客户端配置

1:服务端spring里的配置:

Java代码  

1. <bean id="Customer" class="org.web.HelloServiceImpl"></bean>  
2. lt;jaxws:endpoint  id="custom"  implementor="#Customer"   address="/web" >  
3.      <jaxws:inInterceptors>    
4.           <bean class="org.apache.cxf.interceptor.LoggingInInterceptor" />    
5.           <!--<bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor" />    
6.           -->  
7.           <bean class="org.web.soapHeader.ReadSoapHeader"></bean>  
8.           <!--<bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">    
9.               <constructor-arg>    
10.                   <map>    
11.                       <entry key="action" value="UsernameToken" />    
12.                       <entry key="passwordType"    
13.                           value="PasswordText" />    
14.                       <entry key="user" value="cxfServer" />    
15.                       <entry key="passwordCallbackRef">    
16.                           <ref bean="serverPasswordCallback" />    
17.                       </entry>    
18.                   </map>    
19.               </constructor-arg>    
20.           </bean> -->  
21.           </jaxws:inInterceptors>    
22. </jaxws:endpoint>  

这个里面是有注释的..区别上一个密码验证的示例!

关键代码就有一句: <bean class="org.web.soapHeader.ReadSoapHeader"></bean>

  这个是自己写的读取soap信息.查看密码是否正确!

2:soap读入信息的验证:ReadSoapHeader代码:

Java代码  

1. public class ReadSoapHeader extends AbstractPhaseInterceptor<SoapMessage> {  
2.     private SAAJInInterceptor saa=new SAAJInInterceptor();  
3.     public ReadSoapHeader(){  
4.         super(Phase.PRE_PROTOCOL);  
5.         getAfter().add(SAAJInInterceptor.class.getName());  
6.     }  
7.     public void handleMessage(SoapMessage message) throws Fault {  
8.         SOAPMessage mess=message.getContent(SOAPMessage.class);  
9.         if(mess==null){  
10.             saa.handleMessage(message);  
11.             mess=message.getContent(SOAPMessage.class);  
12.         }  
13.         SOAPHeader head=null;  
14.         try {  
15.             head = mess.getSOAPHeader();  
16.         } catch (SOAPException e) {  
17.             e.printStackTrace();  
18.         }  
19.         if(head==null){  
20.             return;  
21.         }  
22.         NodeList nodes=head.getElementsByTagName("tns:spId");  
23.         NodeList nodepass=head.getElementsByTagName("tns:spPassword");  
24.         if(nodes.item(0).getTextContent().indexOf("wdw")!=-1){  
25.             if(nodepass.item(0).getTextContent().equals("wdwsb")){  
26.                 System.out.println("认证成功");  
27.             }  
28.         }  
29.         else{  
30.             SOAPException soapExc=new SOAPException("认证错误");  
31.             throw new Fault(soapExc);  
32.         }  
33.     }  
34. }  

  功能:判断客户端传来的soap信息头是否有密码..有的话判断是否正确!

 

3:客户端spring的配置:

Java代码  

1. <bean id="webTest" class="org.web.HelloService" factory-bean="client" factory-method="create"/>  
2.  <bean id="client" class="org.apache.cxf.jaxws.JaxWsProxyFactoryBean" >  
3.         <property name="address" value="http://127.0.0.1:88/Hello/web/web"></property>  
4.         <property name="serviceClass" value="org.web.HelloService"></property>  
5.         <property name="outInterceptors">  
6.             <list>  
7.                 <bean class="org.apache.cxf.interceptor.LoggingOutInterceptor" />    
8.                 <!--<bean class="org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor" />  -->  
9.                 <bean class="org.web.soapHeader.AddSoapHeader"></bean>  
10.                 <!--<bean class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">    
11.                     <constructor-arg>    
12.                         <map>    
13.                             <entry key="action" value="UsernameToken" />    
14.                             <entry key="passwordType"  value="PasswordText" />    
15.                             <entry key="user" value="cxfClient" />    
16.                             <entry key="passwordCallbackRef">    
17.                                 <ref bean="clientPasswordCallback" />    
18.                             </entry>    
19.                         </map>    
20.                     </constructor-arg>    
21.                 </bean>    
22.             -->  
23.             </list>  
24.     </property>  
25.  </bean>  

  PS:注意注释>...重点是:

Java代码  

1. <bean class="org.web.soapHeader.AddSoapHeader"></bean>  

 4:对soap进行如入头信息.把密码加进去:AddSoapHeader代码:

Java代码  

1. public class AddSoapHeader extends AbstractSoapInterceptor {  
2.     private static String nameURI="http://127.0.0.1/Hello/web";  
3.       
4.     public AddSoapHeader(){  
5.         super(Phase.WRITE);  
6.     }  
7.     public void handleMessage(SoapMessage message) throws Fault {  
8.         SimpleDateFormat sd=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");  
9.         Date date=new Date();  
10.         String time =sd.format(date);  
11.         String spPassword="wdwsb";  
12.         String spName="wdw";  
13.           
14.         QName qname=new QName("RequestSOAPHeader");  
15.         Document doc=DOMUtils.createDocument();  
16.           
17.         Element spId=doc.createElement("tns:spId");  
18.         spId.setTextContent(spName);  
19.           
20.         Element spPass=doc.createElement("tns:spPassword");  
21.         spPass.setTextContent(spPassword);  
22.           
23.         Element root=doc.createElementNS(nameURI, "tns:RequestSOAPHeader");  
24.         root.appendChild(spId);  
25.         root.appendChild(spPass);  
26.           
27.         SoapHeader head=new SoapHeader(qname,root);  
28.         List<Header> headers=message.getHeaders();  
29.         headers.add(head);  
30.     }  
31. }  

  很简单的东西...现在密码已经加进去了...spring里也已经配置好了..

客户端就可以正常的请求了..对请求的内容会进行soap头处理.把密码加进去....

服务端通过了客户端的权限密码请求就可以了.