Question

我在Spring中托管了Apache CXF服务。我正在使用WSS4J拦截器来验证用户名/密码安全性以访问服务器。验证工作正常，如果我从SoapUI发送错误的凭据我不能按预期使用该服务。如果我发送正确的凭据，服务没有问题。这是我在spring上下文文件中的配置。

<bean id="myPasswordCallback" class="cu.datys.sias.custom.ServerPasswordCallback"/>

<jaxws:endpoint id="siasEndpoint"
                implementor="#siasImpl"
                address="/sias">
    <jaxws:features>
        <!-- Soporte WS-Addressing -->
        <!--<wsa:addressing xmlns:wsa="http://cxf.apache.org/ws/addressing" addressingRequired="true" usingAddressingAdvisory="true" allowDuplicates="true"/>-->
    </jaxws:features>
    <jaxws:inInterceptors>
        <bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
            <constructor-arg>
                <map>
                    <entry key="action" value="UsernameToken" />
                    <entry key="passwordType" value="PasswordText" />
                    <entry key="passwordCallbackRef"
                           value-ref="myPasswordCallback" />
                </map>
            </constructor-arg>
        </bean>
    </jaxws:inInterceptors>
</jaxws:endpoint>

现在我需要能够在我的服务方法中访问我的经过身份验证的用户，如下所示：

@WebResult(name = "UpdatePatternResponse", targetNamespace = "http://test.com/schemas/xsd/myservice/", partName = "UpdatePatternResponse")
@WebMethod(operationName = "UpdatePattern", action = "UpdatePattern")
@Generated(value = "org.apache.cxf.tools.wsdlto.WSDLToJava", date = "2015-02-19T12:49:59.491-05:00")
public test.com.schemas.xsd.myservice.UpdatePatternResponse updatePattern(
    @WebParam(partName = "UpdatePatternRequest", name = "UpdatePatternRequest", targetNamespace = "http://test.com/schemas/xsd/myservice/")
    test.com.schemas.xsd.myservice.UpdatePatternRequest updatePatternRequest
) throws SIASFaultMessage{
    .
    .
    User myAuthenticatedUser = //HOW TO GET THE USER???
    .....
    .
    .
    .
}

如何在Apache CXF服务方法中获取经过身份验证的用户？

Answer 1

我发现这是与这样一个重要主题有关的唯一问题，所以我想分享我为CXF 3.1.x找到的内容。

基本思想与@ alfredo-a相同。这是代码：

Message message=PhaseInterceptorChain.getCurrentMessage();
SecurityContext context=message.get(SecurityContext.class);
String userName=context.getUserPrincipal().getName();

我希望这对某人有帮助。

干杯！

Answer 2

我终于明白了，感谢这个链接：

Is there a way to access the CXF message exchange from a JAX-RS REST Resource within CXF?

这是使用WSSJ4拦截器获取用户名的方法：

@WebResult(name = "UpdatePatternResponse", targetNamespace = "http://test.com/schemas/xsd/myservice/", partName = "UpdatePatternResponse")
@WebMethod(operationName = "UpdatePattern", action = "UpdatePattern")
@Generated(value = "org.apache.cxf.tools.wsdlto.WSDLToJava", date = "2015-02-19T12:49:59.491-05:00")
public test.com.schemas.xsd.myservice.UpdatePatternResponse updatePattern(
    @WebParam(partName = "UpdatePatternRequest", name = "UpdatePatternRequest", targetNamespace = "http://test.com/schemas/xsd/myservice/")
    test.com.schemas.xsd.myservice.UpdatePatternRequest updatePatternRequest
) throws SIASFaultMessage{
    .
    .
    Message message = PhaseInterceptorChain.getCurrentMessage();
    WSUsernameTokenPrincipal principal = (WSUsernameTokenPrincipal)message.get("wss4j.principal.result");
    String userName = principal.getName();
    .
    .
    .
}

如何使用WSS4J拦截器在Web服务方法中获取经过身份验证的用户

2 个答案: