Spring+XFire+WSS4J的基本配置

http://www.blogjava.net/security/archive/2006/08/08/xfire_wss4j.html
Java代码
1. 鉴于很多系统需要实施WS-Security的标准，我们在SpringSide中提供了XFire+WSS4J的Demo，本文介绍SpringSide中Spring+XFire+WSS4J的基本配置 
2.  
3. [WebService Server端配置] 
4. 第一，创建一个基本的BookService 
5. public interface BookService { 
6.     /** *//**
7.      * 按书名模糊查询图书
8.      */ 
9.     List findBooksByName(String name); 
10.  
11.     /** *//**
12.      * 查找目录下的所有图书
13.      *
14.      * @param categoryId 如果category为null或“all”， 列出所有图书。
15.      */ 
16.     List findBooksByCategory(String categoryId); 
17.  
18.     /** *//**
19.      * 列出所有分类.
20.      *
21.      * @return List<Category>，或是null。
22.      */ 
23.     List getAllCategorys(); 
24. } 
25. 第二，接口扩展，即Extend基本的BookService，在XFire中，不同的WSS4J策略需要针对不同的ServiceClass，否则<inHandlers>里面的定义会Overlap。 public interface BookServiceWSS4JEnc  extends BookService { 
26.  
27. } 
28. public interface BookServiceWSS4JSign  extends BookService { 
29.  
30. } 
31. 第三，配置Spring的ApplicationContext文件 
32.     <!--BookService 基类--> 
33.     <bean id="baseWebService" class="org.codehaus.xfire.spring.remoting.XFireExporter" abstract="true"> 
34.         <property name="serviceFactory" ref="xfire.serviceFactory"/> 
35.         <property name="xfire" ref="xfire"/> 
36.     </bean> 
37.  
38.     <bean class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping"> 
39.         <property name="mappings"> 
40.             <value> 
41.                 /BookService=bookService 
42.                 /BookServiceWSS4J=bookServiceWSS4J 
43.                 /BookServiceWSS4JEnc=bookServiceWSS4JEnc 
44.                 /BookServiceWSS4JSign=bookServiceWSS4JSign 
45.             </value> 
46.         </property> 
47.     </bean> 
48.  
49.    <!--(1)BookWebService 不需要认证--> 
50.     <bean id="bookService" class="org.codehaus.xfire.spring.remoting.XFireExporter"> 
51.         <property name="serviceFactory" ref="xfire.serviceFactory"/> 
52.         <property name="xfire" ref="xfire"/> 
53.         <property name="serviceBean" ref="bookManager"/> 
54.         <property name="serviceClass" value="org.springside.bookstore.plugins.xfire.service.BookService"/> 
55.     </bean> 
56.  
57.     <!--  (3)BookWebService 使用 WSS4J验证--> 
58.     <bean id="bookServiceWSS4J" class="org.codehaus.xfire.spring.remoting.XFireExporter"> 
59.         <property name="serviceBean" ref="bookManager"/> 
60.         <property name="serviceClass" value="org.springside.bookstore.plugins.xfire.service.BookServiceWSS4J"/> 
61.         <property name="inHandlers"> 
62.             <list> 
63.                 <ref bean="domInHandler"/> 
64.                 <ref bean="wss4jInHandler"/> 
65.                 <ref bean="validateUserTokenHandler"/> 
66.             </list> 
67.         </property> 
68.     </bean> 
69.  
70.     <bean id="domInHandler" class="org.codehaus.xfire.util.dom.DOMInHandler"/> 
71.  
72.     <bean id="wss4jInHandler" class="org.codehaus.xfire.security.wss4j.WSS4JInHandler"> 
73.         <property name="properties"> 
74.             <props> 
75.                 <prop key="action">UsernameToken</prop> 
76.                 <prop key="passwordCallbackClass">org.springside.bookstore.plugins.xfire.wss4j.PasswordHandler</prop> 
77.             </props> 
78.         </property> 
79.     </bean> 
80.  
81.     <bean id="validateUserTokenHandler" class="org.springside.bookstore.plugins.xfire.wss4j.WSS4JTokenHandler"/> 
82.      
83.     <!--  (4)BookWebService 使用 WSS4J验证 Encrypt模式--> 
84.     <bean id="bookServiceWSS4JEnc" class="org.codehaus.xfire.spring.remoting.XFireExporter"> 
85.         <property name="serviceBean" ref="bookManager"/> 
86.         <property name="serviceClass" value="org.springside.bookstore.plugins.xfire.service.BookServiceWSS4JEnc"/> 
87.         <property name="inHandlers"> 
88.             <list> 
89.                 <ref bean="domInHandler"/> 
90.                 <ref bean="wss4jInHandlerEnc"/> 
91.                 <ref bean="validateUserTokenHandler"/> 
92.             </list> 
93.         </property> 
94.     </bean> 
95.          
96.     <bean id="wss4jInHandlerEnc" class="org.codehaus.xfire.security.wss4j.WSS4JInHandler"> 
97.         <property name="properties"> 
98.           <props> 
99.             <prop key="action">Encrypt</prop> 
100.             <prop key="decryptionPropFile">org/springside/bookstore/plugins/xfire/wss4j/insecurity_enc.properties</prop> 
101.             <prop key="passwordCallbackClass">org.springside.bookstore.plugins.xfire.wss4j.PasswordHandler</prop> 
102.           </props> 
103.         </property> 
104.     </bean> 
105.      
106.     <!--  (5)BookWebService 使用 WSS4J验证 Signature模式--> 
107.     <bean id="bookServiceWSS4JSign" class="org.codehaus.xfire.spring.remoting.XFireExporter"> 
108.         <property name="serviceBean" ref="bookManager"/> 
109.         <property name="serviceClass" value="org.springside.bookstore.plugins.xfire.service.BookServiceWSS4JSign"/> 
110.         <property name="inHandlers"> 
111.             <list> 
112.                 <ref bean="domInHandler"/> 
113.                 <ref bean="wss4jInHandlerSign"/> 
114.                 <ref bean="validateUserTokenHandler"/> 
115.             </list> 
116.         </property> 
117.     </bean> 
118.      
119.     <bean id="wss4jInHandlerSign" class="org.codehaus.xfire.security.wss4j.WSS4JInHandler"> 
120.         <property name="properties"> 
121.           <props> 
122.             <prop key="action">Signature</prop> 
123.             <prop key="signaturePropFile">org/springside/bookstore/plugins/xfire/wss4j/insecurity_sign.properties</prop> 
124.             <prop key="passwordCallbackClass">org.springside.bookstore.plugins.xfire.wss4j.PasswordHandler</prop> 
125.           </props> 
126.         </property> 
127.     </bean> 
128.      
129. </beans> 
130.  
131. 第四，配置insecurity_enc.properties和insecurity_sign.properties两个密钥库配置文件 
132. insecurity_enc.properties： 
133. org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin 
134. org.apache.ws.security.crypto.merlin.keystore.type=jks 
135. org.apache.ws.security.crypto.merlin.keystore.password=SpringSide 
136. org.apache.ws.security.crypto.merlin.alias.password=SpringSide 
137. org.apache.ws.security.crypto.merlin.keystore.alias=david 
138. org.apache.ws.security.crypto.merlin.file=org/springside/bookstore/plugins/xfire/wss4j/springside_private.jks 
139. outsecurity_sign.properties： 
140. org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin 
141. org.apache.ws.security.crypto.merlin.keystore.type=jks 
142. org.apache.ws.security.crypto.merlin.keystore.password=SpringSide 
143. org.apache.ws.security.crypto.merlin.keystore.alias=david 
144. org.apache.ws.security.crypto.merlin.file=org/springside/bookstore/plugins/xfire/wss4j/springside_public.jks 
145. 第五，使用SecureX生成了两个keystore文件 
146. springside_private.jks 
147. 别名名称： david 
148. 创建日期： 2006-8-6 
149. 输入类型：KeyEntry 
150. 认证链长度： 1 
151. 认证 [1]: 
152. Owner: CN=david, OU=SpringSide, O=org, L=gz, ST=gd, C=cn 
153. 发照者： CN=david, OU=SpringSide, O=org, L=gz, ST=gd, C=cn 
154. 序号： 44d4cdcd 
155. 有效期间： Sun Aug 06 00:56:45 CST 2006 至： Mon Aug 06 00:56:45 CST 2007 
156. 认证指纹： 
157.          MD5：  CF:97:13:0C:70:D0:4D:B6:B4:27:0F:1A:0B:CF:D9:F2 
158.          SHA1： 8E:8E:E8:BC:64:39:C8:43:E4:F7:1B:3B:CE:48:1D:6B:A0:2B:58:B5 
159. springside_public.jks 
160. 别名名称： david 
161. 创建日期： 2006-8-6 
162. 输入类型： trustedCertEntry 
163.  
164. Owner: CN=david, OU=SpringSide, O=org, L=gz, ST=gd, C=cn 
165. 发照者： CN=david, OU=SpringSide, O=org, L=gz, ST=gd, C=cn 
166. 序号： 44d4cdcd 
167. 有效期间： Sun Aug 06 00:56:45 CST 2006 至： Mon Aug 06 00:56:45 CST 2007 
168. 认证指纹： 
169.          MD5：  CF:97:13:0C:70:D0:4D:B6:B4:27:0F:1A:0B:CF:D9:F2 
170.          SHA1： 8E:8E:E8:BC:64:39:C8:43:E4:F7:1B:3B:CE:48:1D:6B:A0:2B:58:B5 
171. 第五，新版本SpringSide需要 
172. http://www.bouncycastle.org/download/bcprov-jdk15-133.jar 
173. 并且要配置java.security 
174. 另外,还要使用jdk加密增强策略 
175. http://www.blogjava.net/openssl/archive/2006/03/08/34381.html 
176.  
177. 用户要使用WSS4J，需要配置Bouncycastle这个SecurityProvider，否则 
178. 运行Enc模式的XFire认证的时候，会抛出异常： 
179. org.apache.ws.security.WSSecurityException: An unsupported signature or encryption algorithm was used unsupported key 
180. 配合java.security也是非常简单: 
181. 在最后加入BouncycastleProvider。 
182. security.provider.1=sun.security.provider.Sun 
183. security.provider.2=com.sun.net.ssl.internal.ssl.Provider 
184. security.provider.3=com.sun.rsajca.Provider 
185. security.provider.4=com.sun.crypto.provider.SunJCE 
186. security.provider.5=sun.security.jgss.SunProvider 
187. security.provider.6=org.bouncycastle.jce.provider.BouncyCastleProvider 
188.  
189. [WebService Client端配置] 
190. 1，Encrypt模式的Client是在客户端用david的公钥加密Soap里面的usernameToken，然后发送到Web服务，Web服务用david的私钥来验证。这种模式需要客户端预先知道服务器端的公钥。 
191.  
192. 在Encrypt模式中，需要这样配置ClientHandler： 
193.         Service serviceModel = new ObjectServiceFactory().create(BookServiceWSS4JEnc.class); 
194.         XFireProxyFactory factory = new XFireProxyFactory(getXFire()); 
195.  
196.         BookService service = (BookService) factory.create(serviceModel, "xfire.local://BookServiceWSS4JEnc"); 
197.  
198.         Client client = ((XFireProxy) Proxy.getInvocationHandler(service)).getClient(); 
199.         //挂上WSS4JOutHandler，提供认证 
200.         client.addOutHandler(new DOMOutHandler()); 
201.         Properties properties = new Properties(); 
202.         configureOutProperties(properties); 
203.         client.addOutHandler(new WSS4JOutHandler(properties)); 
204.  
205.         List list = service.getAllCategorys(); configureOutProperties函数负责指定Client使用何种安全策略，没错，使用 outsecurity_enc.properties，这个properties是跟Server端的 insecurity_enc.properties一起使用的。 
206.     protected void configureOutProperties(Properties config) { 
207.         config.setProperty(WSHandlerConstants.ACTION, WSHandlerConstants.ENCRYPT); 
208.         config.setProperty(WSHandlerConstants.USER, "david"); 
209.         //config.setProperty(WSHandlerConstants.PW_CALLBACK_CLASS, PasswordHandler.class.getName()); 
210.         //Configuration of public key used to encrypt message goes to properties file. 
211.         config.setProperty(WSHandlerConstants.ENC_PROP_FILE, 
212.                                "org/springside/bookstore/plugins/xfire/outsecurity_enc.properties"); 
213.     } 
214.  
215. outsecurity_enc.properties： 
216. org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin 
217. org.apache.ws.security.crypto.merlin.keystore.type=jks 
218. org.apache.ws.security.crypto.merlin.keystore.password=SpringSide 
219. org.apache.ws.security.crypto.merlin.keystore.alias=david 
220. org.apache.ws.security.crypto.merlin.file=org/springside/bookstore/plugins/xfire/wss4j/springside_public.jks 
221.  
222. 2, Sign模式的Client同样也是很简单，这种模式是Client端用自己的私钥为usernameToken签名，服务器端用Client的公钥来验证签名，因此，服务器端需要预先知道客户端的公钥。 
223. 对应于Encrypt模式，这里的configureOutProperties需要这样来配置： 
224.     protected void configureOutProperties(Properties properties) { 
225.         properties.setProperty(WSHandlerConstants.ACTION,WSHandlerConstants.SIGNATURE); 
226.         // User in keystore 
227.         properties.setProperty(WSHandlerConstants.USER, "david"); 
228.         // This callback is used to specify password for given user for keystore 
229.         properties.setProperty(WSHandlerConstants.PW_CALLBACK_CLASS, PasswordHandler.class.getName()); 
230.         // Configuration for accessing private key in keystore 
231.         properties.setProperty(WSHandlerConstants.SIG_PROP_FILE,"org/springside/bookstore/plugins/xfire/outsecurity_sign.properties"); 
232.         properties.setProperty(WSHandlerConstants.SIG_KEY_ID,"IssuerSerial"); 
233.     } 
234.  
235.  
236. outsecurity_sign.properties： 
237. org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin 
238. org.apache.ws.security.crypto.merlin.keystore.type=jks 
239. org.apache.ws.security.crypto.merlin.keystore.password=SpringSide 
240. org.apache.ws.security.crypto.merlin.alias.password=SpringSide 
241. org.apache.ws.security.crypto.merlin.keystore.alias=david 
242. org.apache.ws.security.crypto.merlin.file=org/springside/bookstore/plugins/xfire/wss4j/springside_private.jks