WebService开发笔记 3 -- 增强访问 WebService 的安全性
在WebService开发笔记 1中我们创建了一个WebService简单实例,下面我们通过一个简单的用户口令验证机制来加强一下WebService的安全性:
1.修改WebService 服务端 spring 配置文件 ws-context.xml
<beans xmlns="http://www.springframework.org/schema/beans"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xmlns:jaxws="http://cxf.apache.org/jaxws"xsi:schemaLocation="http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd"default-autowire="byName" default-lazy-init="true"><jaxws:endpoint id="webServiceSample"address="/WebServiceSample" implementor="cn.org.coral.biz.examples.webservice.WebServiceSampleImpl"><jaxws:inInterceptors><bean /><bean value="UsernameToken" /><entry key="passwordType" value="PasswordText" /><entry key="passwordCallbackClass" value="cn.org.coral.biz.examples.webservice.handler.WsAuthHandler" /></map></constructor-arg></bean></jaxws:inInterceptors></jaxws:endpoint></beans>
package cn.org.coral.biz.examples.webservice.handler;import java.io.IOException;import javax.security.auth.callback.Callback;import javax.security.auth.callback.CallbackHandler;import javax.security.auth.callback.UnsupportedCallbackException;import org.apache.ws.security.WSPasswordCallback;public class WsAuthHandler implements CallbackHandler{public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {WSPasswordCallback pc = (WSPasswordCallback) callbacks[0]; if (pc.getIdentifer().equals("ws-client")){ if (!pc.getPassword().equals("admin")) { throw new SecurityException("wrong password"); } }else{ throw new SecurityException("wrong username"); }}}<?xml version="1.0" encoding="UTF-8"?><beans xmlns="http://www.springframework.org/schema/beans"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xmlns:jaxws="http://cxf.apache.org/jaxws"xsi:schemaLocation="http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd"default-autowire="byName" default-lazy-init="true"><!-- ws clinet --><bean id="webServiceSampleClient" factory-method="create" /><bean id="webServiceSampleClientFactory"/><property name="address"value="http://88.148.29.54:8080/aio/services/WebServiceSample" /><property name="outInterceptors"><list><bean/><ref bean="wss4jOutConfiguration" /></list></property></bean><bean id="wss4jOutConfiguration"value="UsernameToken" /><entry key="user" value="ws-client" /><entry key="passwordType" value="PasswordText" /><entry><key><value>passwordCallbackRef</value></key><ref bean="passwordCallback" /></entry></map></property></bean><bean id="passwordCallback"name="code">package cn.org.coral.biz.examples.webservice.handler;import java.io.IOException;import javax.security.auth.callback.Callback;import javax.security.auth.callback.CallbackHandler;import javax.security.auth.callback.UnsupportedCallbackException;import org.apache.ws.security.WSPasswordCallback;public class WsClinetAuthHandler implements CallbackHandler{ public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException { for (int i = 0; i < callbacks.length; i++) { WSPasswordCallback pc = (WSPasswordCallback) callbacks[0]; int usage = pc.getUsage(); System.out.println("identifier: " + pc.getIdentifer()); System.out.println("usage: " + pc.getUsage()); if (usage == WSPasswordCallback.USERNAME_TOKEN) { // username token pwd... pc.setPassword("admin"); } else if (usage == WSPasswordCallback.SIGNATURE) { // set the password for client's keystore.keyPassword pc.setPassword("keyPassword"); } } } }package cn.org.coral.biz.examples.webservice;import org.springframework.test.AbstractDependencyInjectionSpringContextTests;import org.springframework.util.Assert;public class TestWebService extends AbstractDependencyInjectionSpringContextTests {WebServiceSample webServiceSampleClient;@Overrideprotected String[] getConfigLocations() {setAutowireMode(AUTOWIRE_BY_NAME);return new String[] { "classpath:/cn/org/coral/biz/examples/webservice/wsclient-context.xml" };}/** * @param webServiceSampleClient the webServiceSampleClient to set */public void setWebServiceSampleClient(WebServiceSample webServiceSampleClient) {this.webServiceSampleClient = webServiceSampleClient;}public void testSay(){String result = webServiceSampleClient.say(" world");Assert.hasText(result);}} 1 楼 sskhnje 2008-08-19 你好, 我也看了CXF的文档, 怎么我除了配helloworld外什么都没学到, 请问你是怎么学的?