使用 Spring4 + CXF3 + WS-Security 开发 WebService

说明

目前运维的平台需要和其他类型相似的平台进行数据对接，由于数据量不大，基本上不存在对接时的性能问题，所以选择使用 WebService 进行数据对接。综合来看，Spring + CXF 的技术实现方式是现在的主流，有较多的技术支持，因此选择这种方式来开发 WebService。

（一）开发环境

选用 JDK1.7 + Maven3.3.9 + Spring4.3.10 + CXF3.1.12 + Tomcat7.0 来进行开发。

（二） WebService 服务端开发

1. 新建 Maven 项目，添加 Maven 依赖

<dependency>
  <groupId>junit</groupId>
  <artifactId>junit</artifactId>
  <version>4.12</version>
</dependency>
<!--cxf-->
<dependency>
  <groupId>org.apache.cxf</groupId>
  <artifactId>cxf-rt-frontend-jaxws</artifactId>
  <version>3.1.12</version>
</dependency>
<dependency>
  <groupId>org.apache.cxf</groupId>
  <artifactId>cxf-rt-transports-http</artifactId>
  <version>3.1.12</version>
</dependency>
<dependency>
  <groupId>org.apache.cxf</groupId>
  <artifactId>cxf-rt-ws-security</artifactId>
  <version>3.1.12</version>
</dependency>
<!--spring-->
<dependency>
  <groupId>org.springframework</groupId>
  <artifactId>spring-context</artifactId>
  <version>4.3.10.RELEASE</version>
</dependency>
<dependency>
  <groupId>org.springframework</groupId>
  <artifactId>spring-web</artifactId>
  <version>4.3.10.RELEASE</version>
</dependency>

2. 创建一个 JAX-WS 注解的 Service类
定义一个接口及其实现类

package demo.ws.soap_spring_cxf;

import javax.jws.WebParam;
import javax.jws.WebService;

@WebService
public interface HelloService {

    String say(@WebParam(name = "name") String name);
}

package demo.ws.soap_spring_cxf;

import org.springframework.stereotype.Component;
import javax.jws.WebService;

@WebService
@Component
public class HelloServiceImpl implements HelloService {

    public String say(String name) {
        return "hello " + name;
    }
}

定义好 WebService 服务类，再进行适当的配置，就可以准备发布服务了。

3. 配置 CXF 与 Spring
在发布服务之前，我们需要在 web.xml 中配置监听器，加载 Spring 配置文件；添加 CXF Servlet，处理请求

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
          http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
  <display-name>webserviceDemo</display-name>
  <!--spring-->
  <context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>classpath:spring.xml</param-value>
  </context-param>
  <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> 

  <!--cxf-->
  <servlet>
    <servlet-name>cxf</servlet-name>
    <servlet-class>org.apache.cxf.transport.servlet.CXFServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>cxf</servlet-name>
    <url-pattern>/ws/*</url-pattern>
  </servlet-mapping>

</web-app>

spring.xml 中<context:component-scan>配置需要扫描的包，同时使用 <import> 标签引入其他配置文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context
        http://www.springframework.org/schema/context/spring-context.xsd">

    <context:component-scan base-package="demo.ws"/>

    <import resource="spring-cxf.xml"/>

    <import resource="spring-beans.xml"/>

</beans>

spring-cxf.xml 用于发布服务，spring-beans.xml 用于配置验签信息

4. 使用 CXF’s XML 发布服务
使用 XML 发布服务，在 spring-cxf.xml 中添加代码

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:cxf="http://cxf.apache.org/core"
       xmlns:jaxws="http://cxf.apache.org/jaxws"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
        http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd
        http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd">

    <!--发布服务-->
    <jaxws:endpoint id="helloService" implementor="demo.ws.soap_spring_cxf.HelloServiceImpl" address="/soap/hello">
    </jaxws:endpoint>

    <cxf:bus>
        <cxf:features>
            <cxf:logging/>
        </cxf:features>
    </cxf:bus>

</beans>

<cxf:logging> 标签用于开启服务日志。启动服务后，访问 http://localhost:8080/ws/soap/hello?wsdl ，显示如下信息即表示服务发布成功。

<wsdl:definitions xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:tns="http://soap_spring_cxf.ws.demo/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:ns1="http://schemas.xmlsoap.org/soap/http" name="HelloServiceImplService" targetNamespace="http://soap_spring_cxf.ws.demo/">  
  ...
  <wsdl:message name="say"> 
    <wsdl:part element="tns:say" name="parameters"/> 
  </wsdl:message>  
  <wsdl:message name="sayResponse"> 
    <wsdl:part element="tns:sayResponse" name="parameters"/> 
  </wsdl:message>  
  <wsdl:portType name="HelloService"> 
    <wsdl:operation name="say"> 
      <wsdl:input message="tns:say" name="say"/>  
      <wsdl:output message="tns:sayResponse" name="sayResponse"/> 
    </wsdl:operation> 
  </wsdl:portType>  
  <wsdl:binding name="HelloServiceImplServiceSoapBinding" type="tns:HelloService"> 
    <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>  
    <wsdl:operation name="say"> 
      <soap:operation soapAction="" style="document"/>  
      <wsdl:input name="say"> 
        <soap:body use="literal"/> 
      </wsdl:input>  
      <wsdl:output name="sayResponse"> 
        <soap:body use="literal"/> 
      </wsdl:output> 
    </wsdl:operation> 
  </wsdl:binding>  
  <wsdl:service name="HelloServiceImplService"> 
    <wsdl:port binding="tns:HelloServiceImplServiceSoapBinding" name="HelloServiceImplPort"> 
      <soap:address location="http://localhost:8080/ws/soap/hello"/> 
    </wsdl:port> 
  </wsdl:service> 
</wsdl:definitions>

（三）完善 WebService ，使用签名和加密

在数据传输过程中，往往会有加密的需求，这里使用 WS-Security 来实现签名和加密，它提供了 WSS4J interceptors 。而在 CXF2.2 之后可以使用 WS-SecurityPolicy，这种方式更简单也更标准。

1. 生成公钥和私钥
在配置拦截器之前，需要生成公钥和私钥，用于签名加密以及验签解密。CXF 官方文档中使用 X.509 证书来生成公钥和私钥，但是官方文档提示说这种方式不适合生产环境。

keytool -genkey -alias ciecc -keypass cieccPassword -keyalg RSA -keysize 1024 -validity 3650 -keystore privatestore.jks -storepass keyStorePassword -dname "cn=ciecc" 
keytool -selfcert -alias ciecc -keystore privatestore.jks -storepass keyStorePassword -keypass cieccPassword
keytool -importkeystore -alias ciecc -deststorepass keyStorePassword -destkeypass cieccPassword -destkeystore publicstore.jks -srckeystore privatestore.jks -srcstorepass keyStorePassword

keytool 是 JDK 自带的命令，ciecc 是私钥的别名，cieccPassword 是私钥的密码，keyStorePassword 是秘钥库的密码。keytool 具体使用方法可以自行查找。使用以上命令会在当前目录下生成 publicstore.jks 和 privatestore.jks 两个文件，公钥和私钥分别保存在这两个文件中。

2. 配置拦截器（Interceptor）
对于服务端来说，需要在 spring-cxf.xml 中配置 WSS4JInInterceptor，对接收到的信息进行验签并解密。对于客户端的话，配置 WSS4JOutInterceptor，对要发送的请求进行签名和加密。这里是从服务端的角度来配置的，客户端的配置会在后面讲到。

<bean id="wss4jInInterceptor" class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
    <constructor-arg>
        <map>
            <entry key="action" value="Signature Encrypt"/>
            <!-- 提供公钥的密码 -->
            <entry key="passwordCallbackRef" value-ref="serverPasswordCallback"/>
            <entry key="signatureVerificationPropFile" value="server.properties"/>
            <entry key="decryptionPropFile" value="server.properties"/>
        </map>
    </constructor-arg>
</bean>

其中 signatureVerificationPropFile 和 decryptionPropFile 属性的配置信息都来自 server.properties 文件，这个配置文件中的内容如下：

org.apache.wss4j.crypto.provider=org.apache.wss4j.common.crypto.Merlin
org.apache.wss4j.crypto.merlin.keystore.type=jks
org.apache.wss4j.crypto.merlin.keystore.password=keyStorePassword
org.apache.wss4j.crypto.merlin.keystore.file=publicstore.jks

而 passwordCallbackRef 这个 bean 根据签名用户提供对应的密钥密码，代码如下：

package demo.ws.soap_spring_cxf_wss4j;

import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
import java.io.IOException;

@Component
public class ServerPasswordCallback implements CallbackHandler {

    @Autowired
    private SignatureUser user;

    public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {

        WSPasswordCallback callback = (WSPasswordCallback) callbacks[0];

        String clientUsername = callback.getIdentifier();
        String serverPassword = user.getUserMap().get(clientUsername);
        if (serverPassword != null) {
            callback.setPassword(serverPassword);
        }

    }
}

SignatureUser 类提供了用户及密码信息

package demo.ws.soap_spring_cxf_wss4j;

import org.springframework.stereotype.Component;

import java.util.Map;

@Component
public class SignatureUser {

    private Map<String, String> userMap;

    public Map<String, String> getUserMap() {
        return userMap;
    }

    public void setUserMap(Map<String, String> userMap) {
        this.userMap = userMap;
    }
}

密码信息通过 Spring 注入，即 spring-beans.xml 文件中的 signatureUser bean

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd">

    <bean id="signatureUser" class="demo.ws.soap_spring_cxf_wss4j.SignatureUser">
        <property name="userMap">
            <map>
                <entry key="ciecc" value="cieccPassword"/>
            </map>
        </property>
    </bean>

</beans>

3. 签名和加密
完成以上工作后，对数据进行验签只需要在发布服务的时候添加 inInterceptors 即可

<!--发布服务-->
<jaxws:endpoint id="helloService" implementor="demo.ws.soap_spring_cxf.HelloServiceImpl" address="/soap/hello">
    <jaxws:inInterceptors>
        <ref bean="wss4jInInterceptor"/>
    </jaxws:inInterceptors>
</jaxws:endpoint>

（四）生成客户端进行测试

1. 生成客户端
使用 Java 自带的 wsimport 命令可以很方便地根据 wsdl 文档生成客户端。

wsimport -s . -encoding utf-8 http://localhost:8080/ws/soap/hello?wsdl

执行命令，会在当前目录下生成客户端源码。下一步是配置客户端调用服务

2. 调用服务
新建 Maven 项目，添加和服务端相同的 Maven 依赖，将客户端源码导入到 src 目录下，配置 spring-client.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:jaxws="http://cxf.apache.org/jaxws"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
        http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">

    <context:component-scan base-package="ws"/>

    <jaxws:client id="helloService" serviceClass="demo.ws.soap_spring_cxf.HelloServiceImplService"
                  address="http://localhost:8080/ws/soap/hello?wsdl">
        <jaxws:outInterceptors>
            <ref bean="wss4jOutInterceptor"/>
        </jaxws:outInterceptors>
    </jaxws:client>

    <!--客户端发送请求拦截器-->
    <bean id="wss4jOutInterceptor" class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
        <constructor-arg>
            <map>
                <!--签名（使用自己的私钥）-->
                <entry key="action" value="Signature Encrypt"/>
                <entry key="user" value="ciecc"/>
                <entry key="passwordCallbackClass" value="ws.ClientPasswordCallback"/>
                <entry key="signaturePropFile" value="client.properties"/>
                <!-- 加密 -->
                <entry key="encryptionPropFile" value="client.properties"/>
            </map>
        </constructor-arg>
    </bean>
</beans>

上面的配置方式基本上和服务端一致，只不过用到的是 WSS4JOutInterceptor，其中 user 的值必须是私钥的别名，即 ciecc，passwordCallbackClass 的类使用回调方法提供私钥密码来使用私钥进行签名。

package ws;

import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.springframework.stereotype.Component;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
import java.io.IOException;

@Component
public class ClientPasswordCallback implements CallbackHandler {

    public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
        WSPasswordCallback callback = (WSPasswordCallback) callbacks[0];
        callback.setPassword("cieccPassword"); //key 的密码
    }
}

signaturePropFile 和 encryptionPropFile 所需要的签名属性文件和加密属性文件都是 client.properties，其配置如下：

org.apache.wss4j.crypto.provider=org.apache.wss4j.common.crypto.Merlin
org.apache.wss4j.crypto.merlin.keystore.type=jks
org.apache.wss4j.crypto.merlin.keystore.password=keyStorePassword
org.apache.wss4j.crypto.merlin.keystore.alias=ciecc
org.apache.wss4j.crypto.merlin.keystore.file=privatestore.jks

3. 测试
使用 Junit 测试客户端签名加密及服务端验签解密

package ws;

import demo.ws.soap_spring_cxf.HelloService;
import org.junit.Test;
import org.springframework.context.ApplicationContext;
import org.springframework.context.support.ClassPathXmlApplicationContext;

public class Client {

    @Test
    public void testHello() {

        ApplicationContext context = new ClassPathXmlApplicationContext("spring-client.xml");

        HelloService service = context.getBean("helloService", HelloService.class);
        String result = service.say("world");
        System.out.println(result);
    }

}

客户端调用服务，发送 “word”，服务端接收到如下信息：

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Header>
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" soap:mustUnderstand="1">
      <xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="EK-d18f673f-6ecc-4a2c-a21d-570bb1effcd6">
        <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
          <wsse:SecurityTokenReference>
            <ds:X509Data>
              <ds:X509IssuerSerial>
                <ds:X509IssuerName>CN=ciecc</ds:X509IssuerName>
                <ds:X509SerialNumber>67874909</ds:X509SerialNumber>
              </ds:X509IssuerSerial>
            </ds:X509Data>
          </wsse:SecurityTokenReference>
        </ds:KeyInfo>
        <xenc:CipherData>
          <xenc:CipherValue>xE9E5Z6CwRfcovG8RI8qUVtdUe/jSJwsUORC8Q3EkOmBVSXt1/+YZI7XuXcTYcFfREKyKynxSSrC0lCk7O0/0yQU56SS+E7tWfxYzxRyJANE7w9EMEksFm4J7REbYo0kpvfjFk4guudYn8T3VHO372BR9etAEanD1CK8jABUxrk=</xenc:CipherValue>
        </xenc:CipherData>
        <xenc:ReferenceList>
          <xenc:DataReference URI="#ED-3a49d5cb-149d-4424-beaa-1170c25ee7b9"/>
        </xenc:ReferenceList>
      </xenc:EncryptedKey>
      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="SIG-21b77015-5a76-4bac-87c2-51a424195467">
        <ds:SignedInfo>
          <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
            <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="soap"></ec:InclusiveNamespaces>
          </ds:CanonicalizationMethod>
          <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
          <ds:Reference URI="#id-4e904297-6fbd-4218-813b-1c15756111f9">
            <ds:Transforms>
              <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            </ds:Transforms>
            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
            <ds:DigestValue>2IVsqcAWoiKks6D7+SgN5dE+oi0=</ds:DigestValue>
          </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>zKeU6h2BPznK/YokHZrLafToI8A5cp2Nzgx89ZfgdBYmeGQtF/7Dy7BridVS00ftNPHp5OdrWRQ9504J//qOUzYAam0V+5CjyMBwldbRL1gG/57jlOxg+prsIotEmHg4Zo+KcK0vHO5Q+zrK3k/kDehHJ3XML6w/MbEEsOWnq2U=</ds:SignatureValue>
        <ds:KeyInfo Id="KI-678fba15-f90f-4215-98c4-e33c2d06c93c">
          <wsse:SecurityTokenReference wsu:Id="STR-ca6c19eb-7eed-476c-9867-f8a27c05241a">
            <ds:X509Data>
              <ds:X509IssuerSerial>
                <ds:X509IssuerName>CN=ciecc</ds:X509IssuerName>
                <ds:X509SerialNumber>67874909</ds:X509SerialNumber>
              </ds:X509IssuerSerial>
            </ds:X509Data>
          </wsse:SecurityTokenReference>
        </ds:KeyInfo>
      </ds:Signature>
    </wsse:Security>
  </soap:Header>
  <soap:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="id-4e904297-6fbd-4218-813b-1c15756111f9">
    <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="ED-3a49d5cb-149d-4424-beaa-1170c25ee7b9" Type="http://www.w3.org/2001/04/xmlenc#Content">
      <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey">
          <wsse:Reference URI="#EK-d18f673f-6ecc-4a2c-a21d-570bb1effcd6"/>
        </wsse:SecurityTokenReference>
      </ds:KeyInfo>
      <xenc:CipherData>
        <xenc:CipherValue>1by/ysWb1wtB4i+HdqzvAJalQwZNeSn50+Z1SH+s/wfAe14TpJANAqukPFPn3gP3hi2K85nhCNuS+BMtJGawpm/LgtkxGaXQAenqMTCygzMhv58yvQ0jxnCoI9yxJn0AALHt3C0vfVaBWURoBNoX3Q==</xenc:CipherValue>
      </xenc:CipherData>
    </xenc:EncryptedData>
  </soap:Body>
</soap:Envelope>

可见客户端发送的信息都经过了加密。服务端接收信息后，能成功返回“hello world”则表明服务端成功验签解密并提供了服务。

参考文档：
CXF User’s Guide：http://cxf.apache.org/docs/index.html
CXF WS-Security：http://cxf.apache.org/docs/ws-security.html
《架构探险 从零开始写javaweb框架》：https://my.oschina.net/huangyong/blog