服务端拦截器(验证soapHeader中的token):
package com.rpc.token;
import javax.xml.soap.SOAPException;
import javax.xml.soap.SOAPHeader;
import javax.xml.soap.SOAPMessage;
import org.apache.commons.lang.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.cxf.binding.soap.SoapMessage;
import org.apache.cxf.binding.soap.interceptor.AbstractSoapInterceptor;
import org.apache.cxf.binding.soap.saaj.SAAJInInterceptor;
import org.apache.cxf.interceptor.Fault;
import org.apache.cxf.phase.Phase;
import org.w3c.dom.NodeList;
import com.common.ws.AuthHeader;
public class CheckSOAPHeaderIntercepter extends AbstractSoapInterceptor {
Log logger = LogFactory.getLog(CheckSOAPHeaderIntercepter.class);
private AuthHeader authHeader;
private SAAJInInterceptor saaIn = new SAAJInInterceptor();
public CheckSOAPHeaderIntercepter() {
super(Phase.PRE_PROTOCOL);
getAfter().add(SAAJInInterceptor.class.getName());
}
public void handleMessage(SoapMessage message) throws Fault {
SOAPMessage mess = message.getContent(SOAPMessage.class);
if (mess == null) {
saaIn.handleMessage(message);
mess = message.getContent(SOAPMessage.class);
}
SOAPHeader head = null;
try {
head = mess.getSOAPHeader();
} catch (Exception e) {
logger.error("获取头信息出错" + e.getMessage(), e);
e.printStackTrace();
}
if (head == null) {
logger.error("head is null");
return;
}
NodeList nodes = head.getElementsByTagName(authHeader.getKey());
String token = "";
if (nodes != null) {
for (int i = 0; i < nodes.getLength(); i++) {
token += nodes.item(i).getTextContent();
}
}
token = StringUtils.trim(token);
// logger.info(authHeader.getTokenValue());
// logger.info(token);
if (StringUtils.isEmpty(token)) {
logger.error("Token null!");
SOAPException soapExc = new SOAPException("Token null!");
throw new Fault(soapExc);
}
if (!token.equals(authHeader.getTokenValue())) {
logger.error("认证失败!");
SOAPException soapExc = new SOAPException("Verify failed! Token wrong!");
throw new Fault(soapExc);
}
}
public void setAuthHeader(AuthHeader authHeader) {
this.authHeader = authHeader;
}
}
服务端配置:
<bean id="logIn" class="org.apache.cxf.interceptor.LoggingInInterceptor"/>
<bean id="logOut" class="org.apache.cxf.interceptor.LoggingOutInterceptor"/>
<bean id="authHeader" class="com.xx.common.ws.AuthHeader">
<property name="token" value="${xxx.ws.pcm.token}" />
<property name="key" value="${xxx.ws.pcm.key}" />
<property name="qName" value="${xxx.ws.pcm.qName}" />
<property name="seed" value="${xxx.ws.pcm.seed}" />
<property name="content" value="${xxx.ws.pcm.content}" />
</bean>
<bean id="tokenAuth" class="com.xx.xx.rpc.token.CheckSOAPHeaderIntercepter">
<property name="authHeader" ref="authHeader" />
</bean>
<bean id="addheader" class="com.xx.common.ws.SOAPHeaderIntercepter">
<property name="authHeader" ref="authHeader" />
</bean>
<bean id="userWebServiceBean" class="com.rpc.admin.impl.UserWebServiceImpl">
<property name="xxx" ref="xxx"/>
<property name="hhh" ref="hhh"/>
</bean>
<jaxws:server id="userWebService" serviceClass="com.rpc.admin.UserWebService" address="/userPcm">
<jaxws:serviceBean>
<ref bean="userWebServiceBean"/>
</jaxws:serviceBean>
<jaxws:inInterceptors>
<ref bean="logIn"/>
<ref bean="tokenAuth" />
</jaxws:inInterceptors>
<jaxws:outInterceptors>
<ref bean="logOut"/>
<ref bean="addheader"/>
</jaxws:outInterceptors>
</jaxws:server>
客户端拦截器(在soapHeader中增加token):
package com.common.ws;
import java.util.List;
import javax.xml.namespace.QName;
import org.apache.cxf.binding.soap.SoapHeader;
import org.apache.cxf.binding.soap.SoapMessage;
import org.apache.cxf.binding.soap.interceptor.AbstractSoapInterceptor;
import org.apache.cxf.helpers.DOMUtils;
import org.apache.cxf.interceptor.Fault;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
public class SOAPHeaderIntercepter extends AbstractSoapInterceptor
{
private AuthHeader authHeader;
public SOAPHeaderIntercepter()
{
super("write");
}
public void handleMessage(SoapMessage soapMessage) throws Fault
{
List headers = soapMessage.getHeaders();
headers.add(getHeader());
}
private Object getHeader() {
QName qName = new QName(this.authHeader.getqName(), this.authHeader.getKey(), "");
Document document = DOMUtils.createDocument();
Element element = document.createElementNS(this.authHeader.getqName(), this.authHeader.getKey());
Element token = document.createElement(this.authHeader.getToken());
token.setTextContent(this.authHeader.getTokenValue());
element.appendChild(token);
SoapHeader header = new SoapHeader(qName, element);
return header;
}
public AuthHeader getAuthHeader() {
return this.authHeader;
}
public void setAuthHeader(AuthHeader authHeader) {
this.authHeader = authHeader;
}
}
模拟客户端测试(方法一):
public void testGetUserByProjId() {
ClassPathXmlApplicationContext context = new ClassPathXmlApplicationContext(new String[] { "client-test.xml" });
UserWebService client = (UserWebService) context.getBean("userClient");
List<UserCms> response = client.getUserByProjId("19aee854de2442b8911c8144770a895c");
System.out.println("testuser Response: " + response.size());
}
方法一对应配置:
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:jaxws="http://cxf.apache.org/jaxws"
xsi:schemaLocation="
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://cxf.apache.org/jaxws http://cxf.apache.org/schema/jaxws.xsd">
<bean id="userClient" class="com.rpc.admin.UserWebService" factory-bean="userClientFactory" factory-method="create" />
<bean id="userClientFactory" class="org.apache.cxf.jaxws.JaxWsProxyFactoryBean">
<property name="serviceClass" value="com.xx.rpc.admin.UserWebService" />
<property name="address" value="http://localhost:8080/services/userPcm" />
<property name="outInterceptors">
<list>
<ref bean="domainSOAPHeader"/>
</list>
</property>
</bean>
<bean id="domainSOAPHeader" class="com.common.ws.SOAPHeaderIntercepter">
<property name="authHeader" ref="domainAuthHeader" />
</bean>
<bean id="domainAuthHeader" class="com.common.ws.AuthHeader">
<property name="qName" value="http://xxx.com"/>
<property name="seed" value="hhh"/>
<property name="content" value="www"/>
<property name="key" value="AuthenticationHeader"/>
<property name="token" value="Token"/>
</bean>
</beans>
客户端测试方法二:
public static void main(String args[]) throws Exception {
System.out.println("进入测试");
ClassPathXmlApplicationContext context = new ClassPathXmlApplicationContext("rpc-test.xml");
UserWebService client = (UserWebService) context.getBean("userClient");
List<UserCms> response = client.getUserByProjId("19aee854de2442b8911c8144770a895c");
System.out.println("Response :{}" + response.size());
}
方法二对应配置:
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:jaxws="http://cxf.apache.org/jaxws"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
http://cxf.apache.org/jaxws
http://cxf.apache.org/schemas/jaxws.xsd">
<bean id="authHeader" class="com.xx.common.ws.AuthHeader">
<property name="token" value="webtoken"/>
<property name="key" value="AuthenticationHeader"/>
<property name="qName" value="http://xxx.com"/>
<property name="seed" value="ggg"/>
<property name="content" value="gggg"/>
</bean>
<bean id="addheader" class="com.common.ws.SOAPHeaderIntercepter">
<property name="authHeader" ref="authHeader" />
</bean>
<!-- user test使用 -->
<jaxws:client id="userClient" serviceClass="com.rpc.admin.UserWebService" address="http://localhost:8080/services/userPcm" >
<jaxws:outInterceptors>
<ref bean="addheader"/>
</jaxws:outInterceptors>
</jaxws:client>
</beans>
认证头:
package com.common.ws;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.lang.StringUtils;
public class AuthHeader
{
private static final String QNAME = "http://www.xhx.com/";
private String KEY = "AuthenticationHeader";
private String TOKEN = "Token";
private String qName;
private String key;
private String token;
private String content;
private String seed;
public String getTokenValue()
{
if (StringUtils.isNotEmpty(this.content)) {
if (StringUtils.isNotEmpty(this.seed)) {
byte[] bb = MD5Util.md5(this.content + "-" + this.seed);
return new String(Base64.encodeBase64(bb));
}
return this.content;
}
return "";
}
public String getqName() {
if (StringUtils.isEmpty(this.qName)) {
this.qName = "http://www.360buy.com/";
}
return this.qName;
}
public void setqName(String qName) {
this.qName = qName;
}
public String getKey() {
if (StringUtils.isEmpty(this.key)) {
this.key = this.KEY;
}
return this.key;
}
public void setKey(String key) {
this.key = key;
}
public String getToken() {
if (StringUtils.isEmpty(this.token)) {
this.token = this.TOKEN;
}
return this.token;
}
public void setToken(String token) {
this.token = token;
}
public String getContent() {
return this.content;
}
public void setContent(String content) {
this.content = content;
}
public String getSeed() {
return this.seed;
}
public void setSeed(String seed) {
this.seed = seed;
}
}