WebService开发笔记 3 -- 增强访问 WebService 的安全性

在[url="http://lib.iteye.com/blog/170620"]WebService开发笔记 1[/url]中我们创建了一个WebService简单实例,下面我们通过一个简单的用户口令验证机制来加强一下WebService的安全性:

1.修改WebService 服务端 spring 配置文件 ws-context.xml

<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:jaxws="http://cxf.apache.org/jaxws"
	xsi:schemaLocation="http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/beans  http://www.springframework.org/schema/beans/spring-beans.xsd"
	default-autowire="byName" default-lazy-init="true">

	<jaxws:endpoint id="webServiceSample"
		address="/WebServiceSample" implementor="cn.org.coral.biz.examples.webservice.WebServiceSampleImpl">

		<jaxws:inInterceptors>
			<bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor" />
			<bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
				<constructor-arg>
					<map>
						<entry key="action" value="UsernameToken" />
						<entry key="passwordType" value="PasswordText" />
						<entry key="passwordCallbackClass" value="cn.org.coral.biz.examples.webservice.handler.WsAuthHandler" />
					</map>
				</constructor-arg>
			</bean>
		</jaxws:inInterceptors>	

	</jaxws:endpoint>

</beans>

2.服务端添加passwordCallbackClass回调类,该类进行用户口令验证:

package cn.org.coral.biz.examples.webservice.handler;

import java.io.IOException;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;

import org.apache.ws.security.WSPasswordCallback;

public class WsAuthHandler  implements CallbackHandler{

	public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
		WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
        if (pc.getIdentifer().equals("ws-client")){
            if (!pc.getPassword().equals("admin")) {
                throw new SecurityException("wrong password");
           }
        }else{
        	throw new SecurityException("wrong username");
        }
	}

}

3.客户端修改spring 配置文件 wsclient-context.xml 如下:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:jaxws="http://cxf.apache.org/jaxws"
	xsi:schemaLocation="http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/beans  http://www.springframework.org/schema/beans/spring-beans.xsd"
	default-autowire="byName" default-lazy-init="true">


	<!-- ws clinet -->
	<bean id="webServiceSampleClient" class="cn.org.coral.biz.examples.webservice.WebServiceSample"
		factory-bean="webServiceSampleClientFactory" factory-method="create" />


	<bean id="webServiceSampleClientFactory"
		class="org.apache.cxf.jaxws.JaxWsProxyFactoryBean">
		<property name="serviceClass"
			value="cn.org.coral.biz.examples.webservice.WebServiceSample" />
		<property name="address"
			value="http://88.148.29.54:8080/aio/services/WebServiceSample" />
		<property name="outInterceptors">
			<list>
				<bean
					class="org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor" />
				<ref bean="wss4jOutConfiguration" />
			</list>
		</property>
	</bean>

	<bean id="wss4jOutConfiguration"
		class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
		<property name="properties">
			<map>
				<entry key="action" value="UsernameToken" />
				<entry key="user" value="ws-client" />
				<entry key="passwordType" value="PasswordText" />
				<entry>
					<key>
						<value>passwordCallbackRef</value>
					</key>
					<ref bean="passwordCallback" />
				</entry>
			</map>
		</property>
	</bean>
	<bean id="passwordCallback"
		class="cn.org.coral.biz.examples.webservice.handler.WsClinetAuthHandler">
	</bean>

</beans>

4.客户端添加passwordCallback类,通过该类设置访问口令

package cn.org.coral.biz.examples.webservice.handler;

import java.io.IOException;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;

import org.apache.ws.security.WSPasswordCallback;

public class WsClinetAuthHandler  implements CallbackHandler{


    public void handle(Callback[] callbacks) throws IOException, 
                    UnsupportedCallbackException { 
            for (int i = 0; i < callbacks.length; i++) { 
                    WSPasswordCallback pc = (WSPasswordCallback) callbacks[0]; 
                    int usage = pc.getUsage(); 


                    System.out.println("identifier: " + pc.getIdentifer()); 
                    System.out.println("usage: " + pc.getUsage()); 
                    if (usage == WSPasswordCallback.USERNAME_TOKEN) { 
                            // username token pwd... 
                            pc.setPassword("admin"); 

                    } else if (usage == WSPasswordCallback.SIGNATURE) { 
                            // set the password for client's keystore.keyPassword 
                            pc.setPassword("keyPassword"); 
                    } 
            } 
    } 

}

5.junit单元测试程序:

package cn.org.coral.biz.examples.webservice;

import org.springframework.test.AbstractDependencyInjectionSpringContextTests;
import org.springframework.util.Assert;

public class TestWebService extends AbstractDependencyInjectionSpringContextTests {
	WebServiceSample webServiceSampleClient;

	@Override
	protected String[] getConfigLocations() {
		setAutowireMode(AUTOWIRE_BY_NAME);
		return new String[] { "classpath:/cn/org/coral/biz/examples/webservice/wsclient-context.xml" };
	}

	/**
	 * @param webServiceSampleClient the webServiceSampleClient to set
	 */
	public void setWebServiceSampleClient(WebServiceSample webServiceSampleClient) {
		this.webServiceSampleClient = webServiceSampleClient;
	}

	public void testSay(){
		String result = webServiceSampleClient.say(" world");
		Assert.hasText(result);		
	}
}