Question

我在Apache CXF中编写了一个拦截器并获得了SoapMessage。如何在不更改数据的情况下从SOAP消息中获取原始XML以损害数字签名的验证？

我指的是org.apache.cxf.binding.soap.SoapMessage：

import org.apache.cxf.binding.soap.SoapMessage;
import org.apache.cxf.binding.soap.interceptor.AbstractSoapInterceptor;
import org.apache.cxf.binding.soap.interceptor.EndpointSelectionInterceptor;
import org.apache.cxf.binding.soap.interceptor.ReadHeadersInterceptor;
import org.apache.cxf.interceptor.Fault;
import org.apache.cxf.phase.Phase;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
public class XmlSignatureVerifyInInterceptor extends AbstractSoapInterceptor {

    private static final Logger log = LogManager.getLogger(XmlSignatureVerifyInInterceptor.class);

    public XmlSignatureVerifyInInterceptor() {
        super(Phase.READ);
        log.entry();
        addAfter(ReadHeadersInterceptor.class.getName());
        addAfter(EndpointSelectionInterceptor.class.getName());
    }

    @Override
    public void handleMessage(SoapMessage soapMessage) throws Fault {
        log.entry(soapMessage);
    }

}

欢呼并提前感谢你！

火球

Answer 1

如果您要引用javax.xml.soap.SOAPMessage，并且希望获得XML的String结果，请使用ByteArrayOutputStream：

SOAPMessage message;
ByteArrayOutputStream out = new ByteArrayOutputStream();
String msg = "";
try {
    message.writeTo(out);
    msg = out.toString("UTF-8");
} catch (Exception e) {
    e.printStackTrace();
}

我使用UTF-8作为编码，您可以将其更改为任何其他。

如何验证SOAP调用的数字签名？

1 个答案: