WebService开发笔记 3 -- 增强访问 WebService 的安全性

在WebService开发笔记 1中我们创建了一个WebService简单实例,下面我们通过一个简单的用户口令验证机制来加强一下WebService的安全性: 

1.修改WebService 服务端 spring 配置文件 ws-context.xml 

<beans xmlns="http://www./schema/beans"
    xmlns:xsi="http://www./2001/XMLSchema-instance"
    xmlns:jaxws="http://cxf./jaxws"
    xsi:schemaLocation="http://cxf./jaxws http://cxf./schemas/jaxws.xsd http://www./schema/beans  http://www./schema/beans/spring-beans.xsd"
    default-autowire="byName" default-lazy-init="true">

    <jaxws:endpoint id="webServiceSample"
        address="/WebServiceSample" implementor="cn.org.coral.biz.examples.webservice.WebServiceSampleImpl">

        <jaxws:inInterceptors>
            <bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor" />
            <bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
                <constructor-arg>
                    <map>
                        <entry key="action" value="UsernameToken" />
                        <entry key="passwordType" value="PasswordText" />
                        <entry key="passwordCallbackClass" value="cn.org.coral.biz.examples.webservice.handler.WsAuthHandler" />
                    </map>
                </constructor-arg>
            </bean>
        </jaxws:inInterceptors>

    </jaxws:endpoint>

</beans>

2.服务端添加passwordCallbackClass回调类,该类进行用户口令验证: 

package cn.org.coral.biz.examples.webservice.handler;

import java.io.IOException;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;

import org.apache.ws.security.WSPasswordCallback;

public class WsAuthHandler  implements CallbackHandler{

    public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
        WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
        if (pc.getIdentifer().equals("ws-client")){
            if (!pc.getPassword().equals("admin")) {
                throw new SecurityException("wrong password");
           }
        }else{
            throw new SecurityException("wrong username");
        }
    }

}

3.客户端修改spring 配置文件 wsclient-context.xml 如下: 

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www./schema/beans"
    xmlns:xsi="http://www./2001/XMLSchema-instance"
    xmlns:jaxws="http://cxf./jaxws"
    xsi:schemaLocation="http://cxf./jaxws http://cxf./schemas/jaxws.xsd http://www./schema/beans  http://www./schema/beans/spring-beans.xsd"
    default-autowire="byName" default-lazy-init="true">


    <!-- ws clinet -->
    <bean id="webServiceSampleClient" class="cn.org.coral.biz.examples.webservice.WebServiceSample"
        factory-bean="webServiceSampleClientFactory" factory-method="create" />


    <bean id="webServiceSampleClientFactory"
        class="org.apache.cxf.jaxws.JaxWsProxyFactoryBean">
        <property name="serviceClass"
            value="cn.org.coral.biz.examples.webservice.WebServiceSample" />
        <property name="address"
            value="http://88.148.29.54:8080/aio/services/WebServiceSample" />
        <property name="outInterceptors">
            <list>
                <bean
                    class="org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor" />
                <ref bean="wss4jOutConfiguration" />
            </list>
        </property>
    </bean>

    <bean id="wss4jOutConfiguration"
        class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">
        <property name="properties">
            <map>
                <entry key="action" value="UsernameToken" />
                <entry key="user" value="ws-client" />
                <entry key="passwordType" value="PasswordText" />
                <entry>
                    <key>
                        <value>passwordCallbackRef</value>
                    </key>
                    <ref bean="passwordCallback" />
                </entry>
            </map>
        </property>
    </bean>
    <bean id="passwordCallback"
        class="cn.org.coral.biz.examples.webservice.handler.WsClinetAuthHandler">
    </bean>

</beans>

4.客户端添加passwordCallback类,通过该类设置访问口令 

package cn.org.coral.biz.examples.webservice.handler;

import java.io.IOException;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;

import org.apache.ws.security.WSPasswordCallback;

public class WsClinetAuthHandler  implements CallbackHandler{


    public void handle(Callback[] callbacks) throws IOException,
                    UnsupportedCallbackException {
            for (int i = 0; i < callbacks.length; i++) {
                    WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
                    int usage = pc.getUsage();


                    System.out.println("identifier: " + pc.getIdentifer());
                    System.out.println("usage: " + pc.getUsage());
                    if (usage == WSPasswordCallback.USERNAME_TOKEN) {
                            // username token pwd...
                            pc.setPassword("admin");

                    } else if (usage == WSPasswordCallback.SIGNATURE) {
                            // set the password for client's keystore.keyPassword
                            pc.setPassword("keyPassword");
                    }
            }
    }

}

5.junit单元测试程序: 

package cn.org.coral.biz.examples.webservice;

import org.springframework.test.AbstractDependencyInjectionSpringContextTests;
import org.springframework.util.Assert;

public class TestWebService extends AbstractDependencyInjectionSpringContextTests {
    WebServiceSample webServiceSampleClient;

    @Override
    protected String[] getConfigLocations() {
        setAutowireMode(AUTOWIRE_BY_NAME);
        return new String[] { "classpath:/cn/org/coral/biz/examples/webservice/wsclient-context.xml" };
    }

    /**
     * @param webServiceSampleClient the webServiceSampleClient to set
     */
    public void setWebServiceSampleClient(WebServiceSample webServiceSampleClient) {
        this.webServiceSampleClient = webServiceSampleClient;
    }

    public void testSay(){
        String result = webServiceSampleClient.say(" world");
        Assert.hasText(result);
    }
}