JDK1.6自带的Jax-Ws详解（含权限检查完整解决方案）

       最近参与开发一个防火墙项目，主要负责Web Services，因为实际情况选用了JDK1.6自带的Jax-Ws，它比当前比较主流的CXF(已经替代了以前的XFIRE)轻量,不依赖任何容器，一个简单的Java Application就可以发布Web Services,这是一件多么令人兴奋的事，但是权限检查却非常费力，查看了很多解决方案，他们大多数是针对容器上部署的Web Services的权限检查......最后终于在官网文档（https://xwss.dev.java.net/Securing_JAVASE6_WebServices.html）上找到了解决思路，通过不断尝试得到一个比较完整的Jax-Ws权限检查方案.

       要使用Jax-Ws,首先得引入相关Jar包（webservices-api.jar、webservices-rt.jar、webservices-tools.jar），下面是一个简单定义Web Services接口的实现类：import javax.annotation.Resource; import javax.jws.WebMethod; import javax.jws.WebParam; import javax.jws.WebResult; import javax.jws.WebService; import javax.jws.WebParam.Mode; import javax.jws.soap.SOAPBinding; import javax.xml.ws.WebServiceContext; import com.sun.xml.wss.SubjectAccessor; @WebService(name="Processor",targetNamespace="http://www.qingyh.fimas.command",serviceName="Processor") @SOAPBinding(style=SOAPBinding.Style.RPC) public class Processor { @Resource WebServiceContext context; @WebMethod(operationName="start",action="start",exclude=false) @WebResult(name="returnStart") public String start() { try { System.out.println("/nRequester Subject " + SubjectAccessor.getRequesterSubject(context)); } catch (Exception e) { throw new RuntimeException(e); } //................To Achieve In Detail..................... return "数据"; } @WebMethod(operationName="getListernerByFw",action="getListernerByFw",exclude=false) @WebResult(name="returnGetListernerByFw") public String getListernerByFw(@WebParam(partName="id",mode=Mode.IN)String id,@WebParam(partName="type",mode=Mode.IN)String type) { try { System.out.println("/nRequester Subject " + SubjectAccessor.getRequesterSubject(context)); } catch (Exception e) { throw new RuntimeException(e); } //................To Achieve In Detail..................... return type+"=。。。。。。"; } @WebMethod(operationName="executeCMD",action="executeCMD",exclude=false) @WebResult(name="returnExecuteCMD") public String execute(@WebParam(partName="ucmd",mode=Mode.IN)String ucmd,@WebParam(partName="firewallID",mode=Mode.IN)String firewallID) { try { System.out.println("/nRequester Subject " + SubjectAccessor.getRequesterSubject(context)); } catch (Exception e) { throw new RuntimeException(e); } //................To Achieve In Detail..................... return "Congratulations,your"+ucmd+"has executed successfully on firewall"+firewallID; } }

然后是发布Web Services的main方法：import java.util.LinkedList; import java.util.List; import javax.xml.ws.Binding; import javax.xml.ws.Endpoint; import javax.xml.ws.handler.Handler; public class StartServer { public static void main(String[] args) { Endpoint endpoint = Endpoint.create(new Processor()); Binding binding = endpoint.getBinding(); List<Handler> handlerChain = new LinkedList<Handler>(); handlerChain.add(new SecurityHandler("server")); binding.setHandlerChain(handlerChain); endpoint.publish("http://192.168.1.109:8888/fimas"); System.out.println("Fimas is Working:http://192.168.1.109:8888/fimas"); } }

其中192.168.1.109为本机的IP，8888为发布Web Services的端口号，一般运行这个main方法（加上下文的权限检查文件后），你的Web Services就算发布成功了（通过浏览器访问http://192.168.1.109:8888/fimas?wsdl即可看到wsdl文件，说明发布成功），但是如果你的接口类Processor里使用了自定义的异常类，则还得操作如下生成异常Bean（运行main才不会出错）：首先在你的java项目根目录下新建一个文件夹（名字为wsdl，它和src同级）存放wsdl文件，然后通过cmd----》cd   XXXXXXXXXX进入你的java项目根路径，然后执行命令：wsgen -cp ./bin -r ./wsdl -s ./src -d ./bin -wsdl Processor的包名.Processor

,这样通过JDK自带的wsgen工具就会自动在项目中生成异常Bean类和wsdl文件，这样Web Services就会成功发布了.

       下面才是重点关于权限检查： import java.io.IOException; import javax.security.auth.callback.Callback; import javax.security.auth.callback.CallbackHandler; import javax.security.auth.callback.UnsupportedCallbackException; import com.sun.xml.wss.impl.callback.PasswordCallback; import com.sun.xml.wss.impl.callback.PasswordValidationCallback; import com.sun.xml.wss.impl.callback.UsernameCallback; public class SecurityEnvironmentHandler implements CallbackHandler { private static final UnsupportedCallbackException unsupported = new UnsupportedCallbackException( null, "Unsupported Callback Type Encountered&