标签: ws-security

我使用Java和WS-Security在我们的产品中公开了几个Web服务.我们的一位客户希望使用ColdFusion来使用Web服务.ColdFusion是否支持WS-Security？我可以通过编写Java客户端并在ColdFusion中使用它来解决它吗？

(我对ColdFusion不太了解).

我正在为网络服务创建客户端。我不断收到以下错误：

AxisFault
    faultCode: {http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}InvalidSecurity
    faultSubcode:
    faultString:
        Security Data : General security error (WSSecurityEngine: Callback supplied no password for: TestMerchant)
    faultActor: 
    faultNode: 
    faultDetail: {http://xml.apache.org/axis/}
    stackTrace:
        Security Data : General security error (WSSecurityEngine: Callback supplied no password for: TestMerchant)

这是我这里的环境：

• Intellij IDEA 集成开发环境
• 阿帕奇轴
• 阿帕奇 WSS4J 1.5.1
• Apache XML 安全性 1.4.0
• JDK 1.6
• 最大操作系统X

虽然在互联网上搜索提供了很多如何通过 XML 配置将安全标头添加到请求中的示例，但我的要求是通过程序动态地执行此操作。所以这是我的代码：

public class AxisClient implements CallbackHandler {

    ServerEnvironment environment;

    AxisClient(ServerEnvironment environment) {
        this.environment = environment;
    }

    public enum ServerEnvironment {
        LIVE("https://ics2ws.ic3.com/commerce/1.x/transactionProcessor"),
        TEST("https://ics2wstest.ic3.com/commerce/1.x/transactionProcessor");

        String url;

        ServerEnvironment (String …

我正在尝试将当前的应用程序升级到CXF 3和WSS4J 2.这让我非常头疼.

客户端的当前应用程序代码:

private void secureWebService( Client client, final Credentials credentials ) {

  // set some WS-Security information
  Map<String,Object> outProps = new HashMap<String,Object>();
  outProps.put( WSHandlerConstants.ACTION, WSHandlerConstants.USERNAME_TOKEN );
  outProps.put( WSHandlerConstants.USER, credentials.getUsername() );
  outProps.put( WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_TEXT );

  // Callback used to retrieve password for given user.
  outProps.put( WSHandlerConstants.PW_CALLBACK_REF, new CallbackHandler() {
     @Override
     public void handle( Callback[] callbacks ) throws IOException, UnsupportedCallbackException {
        WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
        pc.setPassword( credentials.getPassword() );
     }
  });

  WSS4JOutInterceptor wssOut = new WSS4JOutInterceptor( outProps );
  client.getOutInterceptors().clear();
  client.getOutInterceptors().add( …

x509证书具有：a）信息，b）公钥，c）由哈希（a）+（b）生成的签名值，然后使用私钥加密

x509令牌概要文件包括digestValue和signatureValue元素，如本示例所示：http : //publib.boulder.ibm.com/infocenter/cicsts/v3r1/index.jsp?topic=/com.ibm.cics.ts31.doc /dfhws/wsSecurity/dfhws_soapmsg_signed.htm

我的问题是，signatureValue的值是否与c）相同？摘要值是a）+ b）的哈希吗？如果是这样，为什么会有冗余？还是我不了解某事？谢谢。

我正在尝试更改当前如下所示的 Web 服务调用标头的 wsdl2apex 代码：
<env:Header>
<Security xmlns="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd">
<UsernameToken Id="UsernameToken-4">
<Username>test</Username>
<Password>test</Password>
</UsernameToken>
</Security>
</env:Header>

看起来像这样：
<soapenv:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken wsu:Id="UsernameToken-4" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:Username>Test</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">Test</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
</soapenv:Header>

一个问题是我无法弄清楚如何更改元素的命名空间（或者即使它们的名称很重要）。第二个问题是将 Type 属性放在 Password 元素上。

任何人都可以提供任何可能有帮助的信息吗？

谢谢

我知道我可以通过代码使用来做到这一点

myClient.ClientCredentials.UserName.UserName = "User";
myClient.ClientCredentials.UserName.Password = "Password";

是否可以通过配置为客户端提供相同的功能？

我有这样的代码：

private WSSecurityEngine engine = new WSSecurityEngine();
private CallbackHandler callbackHandler = new UsernamePasswordCallbackHandler();

@Test
public void testWss4jEngine() {

    InputStream in = getClass().getClassLoader().getResourceAsStream("soap/soapWithUsernameTokenRequest.xml");

    DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
    DocumentBuilder docBuilder;
    Document doc = null;
    try {
        docBuilder = builderFactory.newDocumentBuilder();

        doc = docBuilder.parse(in);

    } catch (Exception e) {
        LOG.error("Error parsing incoming request. Probably it is not a valid XML/SOAP message.", e);

        return;
    }

    List<WSSecurityEngineResult> results = null;

    try {
        results = engine.processSecurityHeader(doc, null, callbackHandler, null);
    } catch (WSSecurityException e) {
        // TODO Auto-generated …

尝试在Axis2中使用Rampart实现WS-Security时,我收到以下错误.

org.apache.axis2.AxisFault: Unable to engage module : rampart
at org.apache.axis2.client.ServiceClient.engageModule(ServiceClient.java:358)

我在嵌入模式下使用轴(在我耳中).没有安全实现,服务正常工作.我已将该策略包含在services.xml中以及WSDL中.使用Jboss和JDK6请查看下面的文件.

Axis2.xml

<wsdl:definitions xmlns:ns1="http://org.apache.axis2/xsd" xmlns:ns="http://service" xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:http="http://schemas.xmlsoap.org/wsdl/http/" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:mime="http://schemas.xmlsoap.org/wsdl/mime/" xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/" targetNamespace="http://service">
<wsdl:types>
<xs:schema attributeFormDefault="qualified" elementFormDefault="qualified" targetNamespace="http://service">
<xs:element name="echo">
<xs:complexType>
<xs:sequence>
<xs:element minOccurs="0" name="args0" nillable="true" type="xs:string"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="echoResponse">
<xs:complexType>
<xs:sequence>
<xs:element minOccurs="0" name="return" nillable="true" type="xs:string"/>
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:schema>
</wsdl:types>
<wsdl:message name="echoRequest">
<wsdl:part name="parameters" element="ns:echo"></wsdl:part>
</wsdl:message>
<wsdl:message name="echoResponse">
<wsdl:part name="parameters" element="ns:echoResponse"></wsdl:part>
</wsdl:message>
<wsdl:portType name="SimpleServicePortType">
<wsdl:operation name="echo">
<wsdl:input message="ns:echoRequest" wsaw:Action="urn:echo"></wsdl:input>
<wsdl:output message="ns:echoResponse" wsaw:Action="urn:echoResponse"></wsdl:output>
</wsdl:operation>
</wsdl:portType>
<wsdl:binding name="SimpleServiceSoap11Binding" …

经过几天google -ing /尝试/失去头发后,我仍然无法找到解决方案,所以请帮忙:)

简短信息:
我需要使用PHP(SOAP客户端)的WCF服务.它使用wsHttpBinding(ws-security),无法设置basicHttpBinding.一切都在VPN背后,所以我无法为您提供webservice的链接.此外,数据被视为机密(来自客户的请求),因此我无法向您提供完整信息,只能提供一些"常见"信息.这是WS配置:

<configuration>
<system.serviceModel>
    <bindings>
        <wsHttpBinding>
            <binding name="WSHttpBinding_IServices" closeTimeout="00:01:00"
                openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
                bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
                maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">
                <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
                <reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" />
                <security mode="TransportWithMessageCredential">
                    <transport clientCredentialType="None" proxyCredentialType="None" realm="" />
                    <message clientCredentialType="UserName" negotiateServiceCredential="true" algorithmSuite="Default" />
                </security>
            </binding>
        </wsHttpBinding>
    </bindings>
    <client>
        <endpoint address="https://topSecert.url/Service.svc"
            binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IServices"
            contract="IServices" name="WSHttpBinding_IServices" />
    </client>
</system.serviceModel>

我的尝试:
1)基本的PHP Soap客户端不起作用.它总是挂起,直到达到最大执行时间(没有生成错误).我后来发现PHP Soap客户端不支持wsHttpBinding(想哭)
2)一些SoapClient扩展类但没有成功,请求仍然挂起.
3)使用SOAPAction头尝试"自生成"CURL请求.最后我得到了一些错误(我用wse类生成了请求):

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"
xmlns:a="http://www.w3.org/2005/08/addressing">
<s:Header>
    <a:Action s:mustUnderstand="1">http://www.w3.org/2005/08/addressing/soap/fault</a:Action>
</s:Header>
<s:Body>
    <s:Fault>
        <s:Code> …

我有以下用于发出SOAP请求的Java客户端:

package com.example.petstore.test;

import java.util.GregorianCalendar;

import javax.xml.datatype.DatatypeConfigurationException;
import javax.xml.datatype.DatatypeFactory;
import javax.xml.datatype.XMLGregorianCalendar;

import org.apache.cxf.jaxws.JaxWsProxyFactoryBean;

import com.example.petstore.schema.ProcessUpdateResponse;
import com.example.petstore.schema.SyncProcessDAO;

public class TestUtility {

    public static void main(String[] args) {

        JaxWsProxyFactoryBean factory = new JaxWsProxyFactoryBean();        

        // Use the URL defined in the soap address portion of the WSDL
        factory.setAddress("http://192.168.1.4:8080/MySyncService/services/SyncProcessDAOPort"); 

        // Utilize the class which was auto-generated by Apache CXF wsdl2java
        factory.setServiceClass(SyncProcessDAO.class);        

        Object client = factory.create();

        try {        

            // Call the Web Service to perform an operation
            GregorianCalendar gregory = new GregorianCalendar();
            XMLGregorianCalendar xmlgregory …