xfire的webservice安全机制之加密(一)
xfire的webservice安全机制
在原来使用xfire和spring集成的基础上,需要加入下面的这些包
在集成到jboss的时候还出了一个问题,wss4j-1.5.0.jar这个包还死活找不到,不知道是什么原因,后来找了半天
发现jboss4.2这娃在这个路径上有些安全相关的jar吧,拷贝到这里后,jboss运行正常了
D:\tool\jboss-4.2\server\default\deploy\jbossws.sar
其他的包,都仍到WEB-INF/lib下面就可以了
commons-discovery-0.2.jar
bcprov-jdk15-133.jar
wss4j-1.5.0.jar
xalan-2.7.0.jar
先说server端如何配置和加入程序:
1、server端提供出来的webservice先写个接口,可以直接继承自原来的WS接口UserServiceEnc.java:
packagecom.megaeyes.ipcamera.service.webservice.iface;
publicinterfaceUserServiceEncextendsUserService{
}
2、写一个passwordHandler来校验用户名,PasswordHandler.java:
packagecom.megaeyes.ipcamera.service.webservice.tools;
importjava.util.HashMap;
importjava.util.Map;
importjavax.security.auth.callback.Callback;
importjavax.security.auth.callback.CallbackHandler;
importorg.apache.ws.security.WSPasswordCallback;
publicclassPasswordHandlerimplementsCallbackHandler{
privatefinalMappasswords=newHashMap();
@SuppressWarnings("unchecked")
publicPasswordHandler(){
passwords.put("safedv","safedv");
passwords.put("tianyi","tianyi");
}
publicvoidhandle(Callback[]callbacks){
WSPasswordCallbackcallback=(WSPasswordCallback)callbacks[0];
Stringid=callback.getIdentifer();
callback.setPassword((String)passwords.get(id));
}
}
3、写一个WSS4JTokenHandler对加密内容的操作的handler,WSS4JTokenHandler.java:
packagecom.megaeyes.ipcamera.service.webservice.tools;
importjava.security.cert.X509Certificate;
importjava.util.Vector;
importorg.apache.commons.logging.Log;
importorg.apache.commons.logging.LogFactory;
importorg.apache.ws.security.WSConstants;
importorg.apache.ws.security.WSSecurityEngineResult;
importorg.apache.ws.security.WSUsernameTokenPrincipal;
importorg.apache.ws.security.handler.WSHandlerConstants;
importorg.apache.ws.security.handler.WSHandlerResult;
importorg.codehaus.xfire.MessageContext;
importorg.codehaus.xfire.handler.AbstractHandler;
importsun.security.x509.X500Name;
publicclassWSS4JTokenHandlerextendsAbstractHandler{
privatestaticfinalLoglog=LogFactory.getLog(WSS4JTokenHandler.class);
publicvoidinvoke(MessageContextcontext)throwsException{
Vectorresult=(Vector)context.getProperty(WSHandlerConstants.RECV_RESULTS);
if(result==null){
log.error("ClientdoesnotcontainSecurityHeader,needWSSJOutHandler");
return;
}
for(inti=0;i<result.size();i++){
WSHandlerResultres=(WSHandlerResult)result.get(i);
for(intj=0;j<res.getResults().size();j++){
WSSecurityEngineResultsecRes=(WSSecurityEngineResult)res.getResults().get(j);
intaction=secRes.getAction();
//USERTOKEN
if((action&WSConstants.UT)>0){
WSUsernameTokenPrincipalprincipal=(WSUsernameTokenPrincipal)secRes
.getPrincipal();
//SetuserpropertytouserfromUTtoallowresponseencryption
context.setProperty(WSHandlerConstants.ENCRYPTION_USER,principal.getName());
log.info("Client'sUsername:"+principal.getName()+"Client'sPassword:"
+principal.getPassword()+"\n");
}
//SIGNATURE
if((action&WSConstants.SIGN)>0){
@SuppressWarnings("unused")
X509Certificatecert=secRes.getCertificate();
X500Nameprincipal=(X500Name)secRes.getPrincipal();
//Dosomethingwhithcert
log.info("Signaturefor:"+principal.getCommonName());
}
}
}
log.info("WSS4JTokenHandlerDone!");
}
}
4、applicationContext-webservice.xml服务端专门配置文件里面加入:
<beanname="userServiceEnc"parent="baseWebService">
<propertyname="serviceBean"ref="UserServiceImpl"/>
<propertyname="serviceClass"
value="com.megaeyes.ipcamera.service.webservice.iface.UserServiceEnc"/>
<propertyname="inHandlers">
<list>
<refbean="domInHandler"/>
<refbean="wss4jInHandlerEnc"/>
<refbean="validateUserTokenHandler"/>
</list>
</property>
</bean>
<beanid="domInHandler"class="org.codehaus.xfire.util.dom.DOMInHandler"/>
<beanid="wss4jInHandlerEnc"class="org.codehaus.xfire.security.wss4j.WSS4JInHandler">
<propertyname="properties">
<props>
<propkey="action">Encrypt</prop>
<propkey="decryptionPropFile">
insecurity_enc.properties
</prop>
<propkey="passwordCallbackClass">
com.megaeyes.ipcamera.service.webservice.tools.PasswordHandler
</prop>
</props>
</property>
</bean>
<beanid="validateUserTokenHandler"
class="com.megaeyes.ipcamera.service.webservice.tools.WSS4JTokenHandler"/>
4、在SRPING的配置文件里面的那个properties,放置到classpath下面就可以了insecurity_enc.properties:
#调用的类
org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
org.apache.ws.security.crypto.merlin.keystore.type=jks
#加密的密匙的打开密码
org.apache.ws.security.crypto.merlin.keystore.password=ipcamera
#私匙的名字
org.apache.ws.security.crypto.merlin.file=safedv_private.jks
5、在服务端的classpath里面要放置自己的私匙。关于这几个私匙的生成。后续会讲。以上5步服务端的配置就结束了。