webservice的安全问题

1 身份校验

1 在需要进行验证的接口中加入拦截器

2 对拦截器进行配置，对调用接口的身份进行拦截

3 usernameToken

2 信息加密

Wssj=webservice security for java

Wss4j安全策略

安全令牌Cxf-usernameToken
usernameToken用户调用ws接口时候，携带的安全令牌
原理：用户在发送请求的时候，在Soap head中加入自己的用户名以及密码，接受请求的Service通过之前与Client建立的共享密码来验证密码的合法性从而实现鉴别用户的功能。

公钥与私钥

Cxf往期jar包截图

Cxf版本问题

•Cxf2.0可以直接使用wss4j写ws的usernametoken安全令牌程序

•Cxf3.0以后去掉了wss4j的集成

•Cxf3.0以后需要单独引入 Cxf-rt-ws-security

•Cxf目前目前最流行版本是3.0.5

接口安全:客户端ws-callback

接口安全:服务器ws-callback

soap请求消息格式

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:myus="http://myUserWebService/"><soapenv:Header/><soapenv:Body><myus:login><!--Optional:--><arg0><!--Optional:--><email>?</email><id>?</id><!--Optional:--><name>?</name><!--Optional:--><password>?</password><!--Optional:--><telphone>?</telphone><!--Optional:--><user_name>?</user_name></arg0></myus:login></soapenv:Body>
</soapenv:Envelope>

•Soap的 head标签中Type的类型
明文密码

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:myus="http://myUserWebService/"><soapenv:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken >
<wsse:Username>cxf</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">123</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</soapenv:Header><soapenv:Body><myus:SelectDemo/></soapenv:Body>
</soapenv:Envelope>

非明文密码

<wsse:UsernameToken> <wsse:Username>NNK</wsse:Username> <wsse:Password Type="...#PasswordDigest"> weYI3nXd8LjMNVksCKFV8t3rgHh3Rw== </wsse:Password> <wsse:Nonce>WScqanjCEAC4mQoBE07sAQ==</wsse:Nonce> <wsu:Created>2003-07-16T01:24:32Z</wsu:Created>
</wsse:UsernameToken>

PasswordText
PasswordDigest

使用了PasswordDigest类型的Password不使用明文密码
wsse:Nonce和wsu:Created两个元素：
这样做是为了避免重放(Replay)攻击
Digest计算公式如下
Password_Digest = Base64 ( SHA-1 ( nonce + created + password ) )

接口安全:服务器安全拦截

三个参数是什么

•验证方式：usernameToken

WS-Security目前所支持的Security Token

•密码类型：

passwordType/ PasswordDigest

明文密码/密码加密算法

•回调验证函数

passwordCallbackRef

demo展示

服务端的配置

pom的依赖

        <dependency><groupId>org.apache.cxf</groupId><artifactId>cxf-rt-ws-security</artifactId><version>3.0.5</version></dependency><dependency><groupId>org.apache.ws.security</groupId><artifactId>wss4j</artifactId><version>1.5.2</version></dependency>

TestServerInf.java

package com.atguigu.server;import javax.jws.WebService;@WebService
public interface TestServerInf {public String ping(String hello);
}

TestServerImp.java

package com.atguigu.server;public class TestServerImp implements TestServerInf {@Overridepublic String ping(String hello) {System.out.println("cxf接口调用：" + hello);return "pong";}}

applicationContext.xml

<bean id="myCallback" class="com.atguigu.util.MyCallback"></bean><bean id="in" class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor"><constructor-arg><map key-type="java.lang.String"><entry key="action" value="UsernameToken"></entry><entry key="passwordType" value="PasswordText"></entry><entry key="passwordCallbackRef" value-ref="myCallback" ></entry></map></constructor-arg></bean><jaxws:endpoint address="/ws" implementorClass="com.atguigu.server.TestServerInf"><jaxws:inInterceptors><ref bean="in"/></jaxws:inInterceptors><jaxws:implementor><bean class="com.atguigu.server.TestServerImp"></bean></jaxws:implementor></jaxws:endpoint>

MyCallback.java

package com.atguigu.util;import java.io.IOException;import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.apache.wss4j.dom.handler.WSHandlerConstants;public class MyCallback implements CallbackHandler {@Overridepublic void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {// 配置username/password的代码WSPasswordCallback wsc = (WSPasswordCallback) callbacks[0];String user = wsc.getIdentifier();String password = "";// 查询数据库或者配置文件// 配置私人的加密协议if (user.equals("cxf")) {password = "123";}wsc.setPassword(password);}}

客户端的配置

ws.properties

login_url=http://localhost:8888/mall_user/login?wsdl
test_url=http://localhost:8888/mall_user/ws?wsdl

applicationContext.xml

<bean id="testServerInf" class="com.atguigu.util.MyWsFactoryBean"><property name="url" value="${test_url}"></property><property name="t" value="com.atguigu.server.TestServerInf"></property>
</bean>

TestServerInf.java

package com.atguigu.server;import javax.jws.WebService;@WebService
public interface TestServerInf {public String ping(String hello);
}

MyFactoryBean.java

package com.atguigu.util;import java.util.HashMap;import org.apache.commons.collections.map.HashedMap;
import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;
import org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor;
import org.apache.wss4j.dom.handler.WSHandlerConstants;
import org.springframework.beans.factory.FactoryBean;import com.atguigu.server.LoginServerInf;
import com.mchange.v2.codegen.bean.ClassInfo;public class MyFactoryBean<T> implements FactoryBean<T> {private String url;private Class<T> t;public static <T> T getMyWs(String url, Class<T> t){JaxWsProxyFactoryBean jwfb = new JaxWsProxyFactoryBean();jwfb.setAddress(url);jwfb.setServiceClass(t);//加入安全协议if(t.getSimpleName().equals("TestServerInf")) {HashMap<String, Object> hashMap = new HashMap<String, Object>();hashMap.put(WSHandlerConstants.ACTION, WSHandlerConstants.USERNAME_TOKEN);hashMap.put(WSHandlerConstants.PASSWORD_TYPE, "PasswordText");hashMap.put("user", "username");hashMap.put(WSHandlerConstants.PW_CALLBACK_CLASS, MyCallback.class.getName());WSS4JOutInterceptor wss4jOutInterceptor = new WSS4JOutInterceptor(hashMap);jwfb.getOutFaultInterceptors().add(wss4jOutInterceptor);}T bean = (T)jwfb.create();return bean;}@Overridepublic T getObject() throws Exception {// TODO Auto-generated method stubreturn getMyWs(url, this.t);}@Overridepublic Class<?> getObjectType() {// TODO Auto-generated method stubreturn this.t;}@Overridepublic boolean isSingleton() {// TODO Auto-generated method stubreturn false;}public String getUrl() {return url;}public void setUrl(String url) {this.url = url;}public Class<T> getT() {return t;}public void setT(Class<T> t) {this.t = t;}}

MyCallback.java

package com.atguigu.util;import java.io.IOException;import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.apache.wss4j.dom.handler.WSHandlerConstants;public class MyCallback implements CallbackHandler {@Overridepublic void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {// 配置username/password的代码WSPasswordCallback wsc = (WSPasswordCallback) callbacks[0];wsc.setIdentifier("cxf");String password = "123";// 查询数据库或者配置文件wsc.setPassword(password);}}

Controller类

@Autowired
TestServerInf testServerInf;@RequestMapping("sayHello")
public String sayHello(String hello){testServerInf.ping(hello);
}