Question

我使用netbeans 7和glassfish 3.1.2开发了jax-ws Web服务。我将Web服务配置为使用具有对称密钥安全性和默认密钥库的用户名身份验证。当我在localhost中测试我的Web服务时，一切正常，但是当我在远程测试服务器中部署它时它没有工作。首先我得到了关于Key used to decrypt EncryptedKey cannot be null的异常抱怨所以我将本地keystore.jks和cacerts.jks上传到了远程服务器。

现在我得到了那些例外：

服务器端：

WSITPVD0035: Error in Verifying Security in Inbound Message. com.sun.xml.wss.impl.PolicyViolationException: com.sun.xml.wss.impl.WssSoapFaultException: Invalid Security Header at 
com.sun.xml.wss.impl.policy.verifier.MessagePolicyVerifier.verifyPolicy(MessagePolicyVerifier.java:151) at 
com.sun.xml.ws.security.opt.impl.incoming.SecurityRecipient.createMessage(SecurityRecipient.java:1003) at 
com.sun.xml.ws.security.opt.impl.incoming.SecurityRecipient.validateMessage(SecurityRecipient.java:248) at 
com.sun.xml.wss.provider.wsit.WSITServerAuthContext.verifyInboundMessage(WSITServerAuthContext.java:588) at 
com.sun.xml.wss.provider.wsit.WSITServerAuthContext.validateRequest(WSITServerAuthContext.java:361) at 
com.sun.xml.wss.provider.wsit.WSITServerAuthContext.validateRequest(WSITServerAuthContext.java:264) at 
com.sun.enterprise.security.webservices.CommonServerSecurityPipe.processRequest(CommonServerSecurityPipe.java:173) at 
com.sun.enterprise.security.webservices.CommonServerSecurityPipe.process(CommonServerSecurityPipe.java:144) at 
com.sun.xml.ws.api.pipe.helper.PipeAdapter.processRequest(PipeAdapter.java:119) at 
com.sun.xml.ws.api.pipe.Fiber.__doRun(Fiber.java:961) at 
com.sun.xml.ws.api.pipe.Fiber._doRun(Fiber.java:910) at 
com.sun.xml.ws.api.pipe.Fiber.doRun(Fiber.java:873) at 
com.sun.xml.ws.api.pipe.Fiber.runSync(Fiber.java:775) at 
com.sun.xml.ws.server.WSEndpointImpl$2.process(WSEndpointImpl.java:386) at 
com.sun.xml.ws.transport.http.HttpAdapter$HttpToolkit.handle(HttpAdapter.java:640) at 
com.sun.xml.ws.transport.http.HttpAdapter.handle(HttpAdapter.java:263) at 
com.sun.xml.ws.transport.http.servlet.ServletAdapter.handle(ServletAdapter.java:163) at 
org.glassfish.webservices.Ejb3MessageDispatcher.handlePost(Ejb3MessageDispatcher.java:120) at 
org.glassfish.webservices.Ejb3MessageDispatcher.invoke(Ejb3MessageDispatcher.java:91) at 
org.glassfish.webservices.EjbWebServiceServlet.dispatchToEjbEndpoint(EjbWebServiceServlet.java:200) at 
org.glassfish.webservices.EjbWebServiceServlet.service(EjbWebServiceServlet.java:131) at 
javax.servlet.http.HttpServlet.service(HttpServlet.java:770) at 
com.sun.grizzly.http.servlet.ServletAdapter$FilterChainImpl.doFilter(ServletAdapter.java:1059) at 
com.sun.grizzly.http.servlet.ServletAdapter$FilterChainImpl.invokeFilterChain(ServletAdapter.java:999) at 
com.sun.grizzly.http.servlet.ServletAdapter.doService(ServletAdapter.java:434) at 
com.sun.grizzly.http.servlet.ServletAdapter.service(ServletAdapter.java:384) at 
com.sun.grizzly.tcp.http11.GrizzlyAdapter.service(GrizzlyAdapter.java:179) at 
com.sun.enterprise.v3.server.HK2Dispatcher.dispath(HK2Dispatcher.java:117) at 
com.sun.enterprise.v3.services.impl.ContainerMapper$Hk2DispatcherCallable.call(ContainerMapper.java:354) at 
com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:195) at 
com.sun.grizzly.http.ProcessorTask.invokeAdapter(ProcessorTask.java:849) at 
com.sun.grizzly.http.ProcessorTask.doProcess(ProcessorTask.java:746) at 
com.sun.grizzly.http.ProcessorTask.process(ProcessorTask.java:1045) at 
com.sun.grizzly.http.DefaultProtocolFilter.execute(DefaultProtocolFilter.java:228) at 
com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:137) at 
com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:104) at 
com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:90) at 
com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:79) at 
com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:54) at 
com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:59) at 
com.sun.grizzly.ContextTask.run(ContextTask.java:71) at 
com.sun.grizzly.util.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:532) at 
com.sun.grizzly.util.AbstractThreadPool$Worker.run(AbstractThreadPool.java:513) at 
java.lang.Thread.run(Thread.java:662) Caused by: com.sun.xml.wss.impl.WssSoapFaultException: Invalid Security Header at 
com.sun.xml.ws.security.opt.impl.util.SOAPUtil.newSOAPFaultException(SOAPUtil.java:159) at 
com.sun.xml.wss.impl.policy.verifier.MessagePolicyVerifier.processSecondaryPolicy(MessagePolicyVerifier.java:220) at 
com.sun.xml.wss.impl.policy.verifier.MessagePolicyVerifier.verifyPolicy(MessagePolicyVerifier.java:144) ... 43 more

客户端：

Exception in thread "AWT-EventQueue-0" javax.xml.ws.soap.SOAPFaultException: Invalid Security Header
    at com.sun.xml.ws.fault.SOAP11Fault.getProtocolException(SOAP11Fault.java:193)
    at com.sun.xml.ws.fault.SOAPFaultBuilder.createException(SOAPFaultBuilder.java:126)
    at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:123)
    at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:93)
    at com.sun.xml.ws.client.sei.SEIStub.invoke(SEIStub.java:144)

我该如何解决这个问题？

谢谢。

Answer 1

堆栈跟踪看起来并不熟悉，但可能是您的问题是证书本身。

创建证书时，应设置“服务器名称”。客户端将使用此选项来检查证书的“服务器名称”是否与URL“服务器名称”匹配。如果服务器名称与客户端不匹配，则应中止连接，因为它可能是一个被盗的证书！有关详细信息，请查看此tutorial

使用Java客户端的示例：如果您为'localhost'客户端创建证书当且仅当它使用URL访问Web服务时，验证才会通过比如'https://localhost/stuff...'。因此，如果您尝试使用相同的客户端访问相同的应用程序但使用'https://10.0.0.1/stuff...'之类的IP，则应出现验证错误。

注意：java Web服务客户端的默认配置会执行此检查，但如果您想绕过此客户端验证，请检查this post

尝试检查这是否是您遇到的问题。如果是这种情况，您有几种解决方案：

为要部署的服务器创建证书申请
禁用客户端验证

PS：我从未在服务器端做过一些特殊的事情来解决这类问题。安装正确的证书就足够了

Answer 2

就我而言，问题出在CommandMap中。需要在CommandMap中添加“application / ciphervalue”处理程序，因为WSIT在加载CVDataHandler类时只执行一次。

有关如何添加的详细信息，请参阅com.sun.xml.ws.security.opt.impl.util.CVDataHandler静态块。

使用对称密钥在本地但不在远程服务器中工作的用户名认证

2 个答案: