axis2+rampart实现WS-Security

首先搭建基于axis2的ws服务端与客户端，发布成功并且客户端能够正常调用。
下面具体介绍axis2+rampart的配置。
1）、下载rampart-1.4.mar文件，下载地址：http://ws.apache.org/rampart/download/1.4/download.cgi
解压后把\modules\rampart-1.4.mar放入服务端与客户端的WebRoot\WEB-INF\module文件夹下。将\rampart-1.4\lib下的jar包放入服务端与客户端的lib中。
2）、用KEYTOOL生成一对JKS文件,service.jks和client.jks（具体方法请百度、Google）
service.jks存放了SERVICE的私钥和CLIENT的公钥。
client.jks存放了CLIENT的私钥和SERVICE的公钥。
3）、新建service.properties、client.properties文件
service.properties

Java代码  

1. org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin   
2. org.apache.ws.security.crypto.merlin.keystore.type=jks   
3. org.apache.ws.security.crypto.merlin.keystore.password=apache   
4. org.apache.ws.security.crypto.merlin.file=service.jks  

org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
org.apache.ws.security.crypto.merlin.keystore.type=jks
org.apache.ws.security.crypto.merlin.keystore.password=apache
org.apache.ws.security.crypto.merlin.file=service.jks

client.properties

Java代码  

1. org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin   
2. org.apache.ws.security.crypto.merlin.keystore.type=jks   
3. org.apache.ws.security.crypto.merlin.keystore.password=apache   
4. org.apache.ws.security.crypto.merlin.file=client.jks  

org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
org.apache.ws.security.crypto.merlin.keystore.type=jks
org.apache.ws.security.crypto.merlin.keystore.password=apache
org.apache.ws.security.crypto.merlin.file=client.jks

4）、将service.jks和service.properties放入服务端的src目录下，client.jks和client.properties放入客户端的src目录下
5）、在服务端的service.xml里面加入相应的安全属性；

Java代码  

1.  <module ref="rampart" />   
2.  <parameter name="InflowSecurity">   
3.    <action>   
4.        <items>Timestamp Signature</items>   
5.        <signaturePropFile>service.properties</signaturePropFile>   
6.    </action>   
7. </parameter>   
8. <parameter name="OutflowSecurity">   
9.    <action>   
10.        <items>Timestamp Signature</items>   
11.        <user>service</user>   
12.        <passwordCallbackClass>zzvcom.ws.PWCBHandler</passwordCallbackClass>   
13.        <signaturePropFile>service.properties</signaturePropFile>   
14.        <signatureKeyIdentifier>DirectReference</signatureKeyIdentifier>   
15.    </action>   
16. </parameter>  

     <module ref="rampart" />
     <parameter name="InflowSecurity">
       <action>
           <items>Timestamp Signature</items>
           <signaturePropFile>service.properties</signaturePropFile>
       </action>
    </parameter>
    <parameter name="OutflowSecurity">
       <action>
           <items>Timestamp Signature</items>
           <user>service</user>
           <passwordCallbackClass>zzvcom.ws.PWCBHandler</passwordCallbackClass>
           <signaturePropFile>service.properties</signaturePropFile>
           <signatureKeyIdentifier>DirectReference</signatureKeyIdentifier>
       </action>
    </parameter>

6）、在客户端的WebRoot\WEB-INF\conf\axis2.xml里面加入相应的安全属性，在声明客户端对象的时候要指明这个配置上下文，使得程序能够找到这个axis2.xml文件。

Java代码  

1. <module ref="rampart" />   
2.   
3.  <parameter name="OutflowSecurity">   
4.       <action>   
5.         <items>Timestamp Signature</items>   
6.         <user>client</user>   
7.         <signaturePropFile>client.properties</signaturePropFile>   
8.         <passwordCallbackClass>zzvcom.ws.PWCBHandler</passwordCallbackClass>          <signatureKeyIdentifier>DirectReference</signatureKeyIdentifier>   
9.       </action>   
10.     </parameter>   
11.     <parameter name="InflowSecurity">   
12.       <action>   
13.         <items>Timestamp Signature</items>   
14.         <signaturePropFile>client.properties</signaturePropFile>   
15.       </action>   
16.     </parameter>  

 <module ref="rampart" />

	 <parameter name="OutflowSecurity">
       <action>
         <items>Timestamp Signature</items>
         <user>client</user>
         <signaturePropFile>client.properties</signaturePropFile>
         <passwordCallbackClass>zzvcom.ws.PWCBHandler</passwordCallbackClass>          <signatureKeyIdentifier>DirectReference</signatureKeyIdentifier>
       </action>
     </parameter>
     <parameter name="InflowSecurity">
       <action>
         <items>Timestamp Signature</items>
         <signaturePropFile>client.properties</signaturePropFile>
       </action>
     </parameter>

7）、在客户端和服务器端写一个安全相关的callback类，一般客户端和服务器端的这两个类是一样的,就是把客户端和服务端的功能用一个类来实现了。

Java代码  

1. package zzvcom.ws;   
2.   
3. import java.io.IOException;   
4. import java.util.HashMap;   
5. import java.util.Map;   
6.   
7. import javax.security.auth.callback.Callback;   
8. import javax.security.auth.callback.CallbackHandler;   
9. import javax.security.auth.callback.UnsupportedCallbackException;   
10.   
11. import org.apache.ws.security.WSPasswordCallback;   
12.   
13. public class PWCBHandler implements CallbackHandler {   
14.     public void handle(Callback[] callbacks) throws IOException,UnsupportedCallbackException{   
15.           for (int i = 0; i < callbacks.length; i++){   
16.               WSPasswordCallback pwcb = (WSPasswordCallback)callbacks[i];   
17.               String id = pwcb.getIdentifer();   
18.               if("client".equals(id)){   
19.                   pwcb.setPassword("apache");   
20.               }else if("service".equals(id)){   
21.                   pwcb.setPassword("apache");   
22.               }else{   
23.                 throw new UnsupportedCallbackException(callbacks[i],   
24.                 "对不起，您不是授权用户，不能访问该WEB服务！");   
25.               }   
26.            }   
27.     }   
28. }  

package zzvcom.ws;

import java.io.IOException;
import java.util.HashMap;
import java.util.Map;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;

import org.apache.ws.security.WSPasswordCallback;

public class PWCBHandler implements CallbackHandler {
    public void handle(Callback[] callbacks) throws IOException,UnsupportedCallbackException{
          for (int i = 0; i < callbacks.length; i++){
              WSPasswordCallback pwcb = (WSPasswordCallback)callbacks[i];
              String id = pwcb.getIdentifer();
              if("client".equals(id)){
                  pwcb.setPassword("apache");
              }else if("service".equals(id)){
                  pwcb.setPassword("apache");
              }else{
                throw new UnsupportedCallbackException(callbacks[i],
                "对不起，您不是授权用户，不能访问该WEB服务！");
              }
           }
    }
}

8）、客户端代码

Java代码  

1. package zzvcom.ws;   
2.   
3. import java.io.File;   
4.   
5. import org.apache.axis2.context.ConfigurationContext;   
6. import org.apache.axis2.context.ConfigurationContextFactory;   
7. import org.apache.axis2.databinding.ADBBean;   
8.   
9. import zzvcom.ws.SampleServerStub.Echo;   
10.   
11. public class SampleClient {   
12.      public String testserver(String path) throws Exception {   
13.             String toEPR = "http://localhost:8080/axis2_server/services/SampleServer?wsdl";   
14.             ConfigurationContext configContext = null;   
15.             SampleServerStub serviceClient = null;   
16.             configContext = ConfigurationContextFactory   
17.                     .createConfigurationContextFromFileSystem(path+"/WebRoot/WEB-INF",path+"/WebRoot/WEB-INF/conf/axis2.xml");   
18.             serviceClient = new SampleServerStub(configContext, toEPR);   
19.             SampleServerStub.Echo echo = (Echo) getTestObject(Echo.class);   
20.             echo.setS("zzvcom");   
21.             return serviceClient.echo(echo).get_return();   
22.       }   
23.          
24.         public ADBBean getTestObject(Class type) throws Exception {   
25.             return (ADBBean) type.newInstance();   
26.         }   
27.            
28.         public static void main(String[] args) {   
29.             SampleClient sampleClient=new SampleClient();   
30.             try {   
31.                 File file=new File("");   
32.                 String path=file.getAbsolutePath();   
33.                 String resaultValue=sampleClient.testserver(path);   
34.                 System.out.println("从服务端返回内容为："+resaultValue);   
35.             } catch (Exception e) {   
36.                 e.printStackTrace();   
37.             }   
38.   
39.         }   
40. }  

package zzvcom.ws;

import java.io.File;

import org.apache.axis2.context.ConfigurationContext;
import org.apache.axis2.context.ConfigurationContextFactory;
import org.apache.axis2.databinding.ADBBean;

import zzvcom.ws.SampleServerStub.Echo;

public class SampleClient {
	 public String testserver(String path) throws Exception {
		    String toEPR = "http://localhost:8080/axis2_server/services/SampleServer?wsdl";
		    ConfigurationContext configContext = null;
		    SampleServerStub serviceClient = null;
	        configContext = ConfigurationContextFactory
	                .createConfigurationContextFromFileSystem(path+"/WebRoot/WEB-INF",path+"/WebRoot/WEB-INF/conf/axis2.xml");
	        serviceClient = new SampleServerStub(configContext, toEPR);
	        SampleServerStub.Echo echo = (Echo) getTestObject(Echo.class);
	        echo.setS("zzvcom");
		    return serviceClient.echo(echo).get_return();
	  }
	  
		public ADBBean getTestObject(Class type) throws Exception {
			return (ADBBean) type.newInstance();
		}
		
		public static void main(String[] args) {
			SampleClient sampleClient=new SampleClient();
			try {
				File file=new File("");
		    	String path=file.getAbsolutePath();
				String resaultValue=sampleClient.testserver(path);
				System.out.println("从服务端返回内容为："+resaultValue);
			} catch (Exception e) {
				e.printStackTrace();
			}

		}
}

9）、在客户端调用的代码中,注意

Java代码  

1. configContext = ConfigurationContextFactory   
2.                     .createConfigurationContextFromFileSystem(path+"/WebRoot/WEB-INF",path+"/WebRoot/WEB-INF/conf/axis2.xml");  

configContext = ConfigurationContextFactory
	                .createConfigurationContextFromFileSystem(path+"/WebRoot/WEB-INF",path+"/WebRoot/WEB-INF/conf/axis2.xml");

没有找到方法直接取得当前绝对路径，所以区分为2种情况
a）、main方法调用时传入的当前的绝对路径作为参数。

Java代码  

1. File file=new File("");   
2. String path=file.getAbsolutePath();   
3. configContext = ConfigurationContextFactory   
4.                     .createConfigurationContextFromFileSystem(path+"/WebRoot/WEB-INF",path+"/WebRoot/WEB-INF/conf/axis2.xml");  

File file=new File("");
String path=file.getAbsolutePath();
configContext = ConfigurationContextFactory
	                .createConfigurationContextFromFileSystem(path+"/WebRoot/WEB-INF",path+"/WebRoot/WEB-INF/conf/axis2.xml");

b）、客户端部署在web容器中，从页面或者action调用，传入request.getRealPath("/")作为参数，并且没有WebRoot目录。

Java代码  

1. configContext = ConfigurationContextFactory   
2.                     .createConfigurationContextFromFileSystem(path+"/WEB-INF",path+"/WEB-INF/conf/axis2.xml");  

configContext = ConfigurationContextFactory
	                .createConfigurationContextFromFileSystem(path+"/WEB-INF",path+"/WEB-INF/conf/axis2.xml");

转自：http://shiningwu.iteye.com/blog/510310