java cxf 安全,CXF客户端安全

I am creating a client to a Java soap web service, but am having trouble figuring out how to properly pass the password. Here is my "hardcoded" password example:

@Test

public void exploratorySecurityTest() {

String username = "user";

String password = "pwd";

UserStoryService service = new UserStoryService();

UserStoryServiceSoap port = service.getUserStoryServiceSoap();

//initialize security

org.apache.cxf.endpoint.Client client = ClientProxy.getClient(port);

org.apache.cxf.endpoint.Endpoint cxfEndpoint = client.getEndpoint();

Map outProps = new HashMap();

outProps.put(WSHandlerConstants.ACTION, WSHandlerConstants.USERNAME_TOKEN);

outProps.put(WSHandlerConstants.USER, username);

outProps.put(WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_TEXT);

outProps.put(WSHandlerConstants.PW_CALLBACK_CLASS, ClientPasswordCallback.class.getName());

WSS4JOutInterceptor wssOut = new WSS4JOutInterceptor(outProps);

cxfEndpoint.getOutInterceptors().add(wssOut);

int storyId = 33401;

UserStoryDTO userStoryDTO = port.getByID(storyId);

//success if no error

}

public class ClientPasswordCallback implements CallbackHandler {

@Override

public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {

WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];

pc.setPassword("pwd");

}}

What I really want to do is to pass the password into the callback handler. The examples that I have seen in the CXF documentation implement the callback either "hardcoded" (as I did in this example) or as a function of the username:

if (pc.getIdentifier().equals("user"))

pc.setPassword("pwd");

Neither of these meet my needs. Is there a way that I can do something like the following:

@Test

public void exploratorySecurityTest() {

String username = "user";

String password = "pwd";

UserStoryService service = new UserStoryService();

UserStoryServiceSoap port = service.getUserStoryServiceSoap();

//initialize security

org.apache.cxf.endpoint.Client client = ClientProxy.getClient(port);

org.apache.cxf.endpoint.Endpoint cxfEndpoint = client.getEndpoint();

Map outProps = new HashMap();

outProps.put(WSHandlerConstants.ACTION, WSHandlerConstants.USERNAME_TOKEN);

outProps.put(WSHandlerConstants.USER, username);

//pass the password here?

outProps.put("password", password);

outProps.put(WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_TEXT);

outProps.put(WSHandlerConstants.PW_CALLBACK_CLASS, ClientPasswordCallback.class.getName());

WSS4JOutInterceptor wssOut = new WSS4JOutInterceptor(outProps);

cxfEndpoint.getOutInterceptors().add(wssOut);

// ...

}

解决方案

Use PW_CALLBACK_REF instead PW_CALLBACK_CLASS, and pass an instantiated object, instead of the static class. You can inject the password in said object.

Something like:

outProps.put(WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_TEXT);

CXFClientPasswordHandler handler = new CXFClientPasswordHandler();

handler.setPassword(password);

outProps.put(WSHandlerConstants.PW_CALLBACK_REF, handler);