xfire的webservice安全机制之加密(一)

xfire的webservice安全机制

在原来使用xfire和spring集成的基础上，需要加入下面的这些包
在集成到jboss的时候还出了一个问题，wss4j-1.5.0.jar这个包还死活找不到，不知道是什么原因，后来找了半天
发现jboss4.2这娃在这个路径上有些安全相关的jar吧，拷贝到这里后，jboss运行正常了
D:\tool\jboss-4.2\server\default\deploy\jbossws.sar
其他的包，都仍到WEB-INF/lib下面就可以了
commons-discovery-0.2.jar
bcprov-jdk15-133.jar
wss4j-1.5.0.jar
xalan-2.7.0.jar

先说server端如何配置和加入程序：
1、server端提供出来的webservice先写个接口，可以直接继承自原来的WS接口UserServiceEnc.java:
package com.megaeyes.ipcamera.service.webservice.iface;

public interface UserServiceEnc extends UserService {

}

2、写一个passwordHandler来校验用户名，PasswordHandler.java:
package com.megaeyes.ipcamera.service.webservice.tools;

import java.util.HashMap;
import java.util.Map;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;

import org.apache.ws.security.WSPasswordCallback;

public class PasswordHandler implements CallbackHandler {

private final Map passwords = new HashMap();

@SuppressWarnings("unchecked")
public PasswordHandler() {
passwords.put("safedv", "safedv");
passwords.put("tianyi", "tianyi");
}

public void handle(Callback[] callbacks) {
WSPasswordCallback callback = (WSPasswordCallback) callbacks[0];
String id = callback.getIdentifer();
callback.setPassword((String) passwords.get(id));
}
}

3、写一个WSS4JTokenHandler对加密内容的操作的handler，WSS4JTokenHandler.java:
package com.megaeyes.ipcamera.service.webservice.tools;

import java.security.cert.X509Certificate;
import java.util.Vector;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.ws.security.WSConstants;
import org.apache.ws.security.WSSecurityEngineResult;
import org.apache.ws.security.WSUsernameTokenPrincipal;
import org.apache.ws.security.handler.WSHandlerConstants;
import org.apache.ws.security.handler.WSHandlerResult;
import org.codehaus.xfire.MessageContext;
import org.codehaus.xfire.handler.AbstractHandler;
import sun.security.x509.X500Name;

public class WSS4JTokenHandler extends AbstractHandler {
private static final Log log = LogFactory.getLog(WSS4JTokenHandler.class);

public void invoke(MessageContext context) throws Exception {
Vector result = (Vector) context.getProperty(WSHandlerConstants.RECV_RESULTS);

if (result == null) {
log.error("Client does not contain Security Header, need WSSJOutHandler");
return;
}

for (int i = 0; i < result.size(); i++) {
WSHandlerResult res = (WSHandlerResult) result.get(i);
for (int j = 0; j < res.getResults().size(); j++) {
WSSecurityEngineResult secRes = (WSSecurityEngineResult) res.getResults().get(j);
int action = secRes.getAction();
// USER TOKEN
if ((action & WSConstants.UT) > 0) {
WSUsernameTokenPrincipal principal = (WSUsernameTokenPrincipal) secRes
.getPrincipal();
// Set user property to user from UT to allow response encryption
context.setProperty(WSHandlerConstants.ENCRYPTION_USER, principal.getName());
log.info("Client's Username: " + principal.getName() + " Client's Password: "
+ principal.getPassword() + "\n");
}
// SIGNATURE
if ((action & WSConstants.SIGN) > 0) {
@SuppressWarnings("unused")
X509Certificate cert = secRes.getCertificate();
X500Name principal = (X500Name) secRes.getPrincipal();
// Do something whith cert
log.info("Signature for : " + principal.getCommonName());
}
}
}
log.info("WSS4JTokenHandler Done!");
}
}

4、applicationContext-webservice.xml服务端专门配置文件里面加入：
<bean name="userServiceEnc" parent="baseWebService">
<property name="serviceBean" ref="UserServiceImpl" />
<property name="serviceClass"
value="com.megaeyes.ipcamera.service.webservice.iface.UserServiceEnc" />
<property name="inHandlers">
<list>
<ref bean="domInHandler" />
<ref bean="wss4jInHandlerEnc" />
<ref bean="validateUserTokenHandler" />
</list>
</property>
</bean>

<bean id="domInHandler" class="org.codehaus.xfire.util.dom.DOMInHandler"/>

<bean id="wss4jInHandlerEnc" class="org.codehaus.xfire.security.wss4j.WSS4JInHandler">
<property name="properties">
<props>
<prop key="action">Encrypt</prop>
<prop key="decryptionPropFile">
insecurity_enc.properties
</prop>
<prop key="passwordCallbackClass">
com.megaeyes.ipcamera.service.webservice.tools.PasswordHandler
</prop>
</props>
</property>
</bean>

<bean id="validateUserTokenHandler"
class="com.megaeyes.ipcamera.service.webservice.tools.WSS4JTokenHandler"/>

4、在SRPING的配置文件里面的那个properties，放置到classpath下面就可以了insecurity_enc.properties：
#调用的类
org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
org.apache.ws.security.crypto.merlin.keystore.type=jks
#加密的密匙的打开密码
org.apache.ws.security.crypto.merlin.keystore.password=ipcamera
#私匙的名字
org.apache.ws.security.crypto.merlin.file=safedv_private.jks

5、在服务端的classpath里面要放置自己的私匙。关于这几个私匙的生成。后续会讲。以上5步服务端的配置就结束了。