Apache CXF策略异常(WS安全性) - 无法检测到安全配置

时间:2016-06-21 12:52:01

标签: java soap cxf jax-ws ws-security

真的可以帮上这个,因为我已经在砖墙上撞了好几天了。

我使用Apache CXF实现了一个非常简单的JAX-WS服务,我正在尝试添加WS-SecurityPolicies来加密和签署消息体,但客户端我得到以下异常:

org.apache.cxf.ws.policy.PolicyException: Security configuration could not be detected. Potential cause: Make sure jaxws:client element with name attribute value matching endpoint port is defined as well as a security.signature.properties element within it.
    at org.apache.cxf.ws.security.wss4j.policyhandlers.AbstractCommonBindingHandler.unassertPolicy(AbstractCommonBindingHandler.java:92)
    at org.apache.cxf.ws.security.wss4j.policyhandlers.AbstractBindingBuilder.getSignatureBuilder(AbstractBindingBuilder.java:1797)
    at org.apache.cxf.ws.security.wss4j.policyhandlers.AsymmetricBindingHandler.doSignature(AsymmetricBindingHandler.java:693)
    at org.apache.cxf.ws.security.wss4j.policyhandlers.AsymmetricBindingHandler.doSignBeforeEncrypt(AsymmetricBindingHandler.java:171)
    at org.apache.cxf.ws.security.wss4j.policyhandlers.AsymmetricBindingHandler.handleBinding(AsymmetricBindingHandler.java:110)
    at org.apache.cxf.ws.security.wss4j.PolicyBasedWSS4JOutInterceptor$PolicyBasedWSS4JOutInterceptorInternal.handleMessageInternal(PolicyBasedWSS4JOutInterceptor.java:190)
    at org.apache.cxf.ws.security.wss4j.PolicyBasedWSS4JOutInterceptor$PolicyBasedWSS4JOutInterceptorInternal.handleMessage(PolicyBasedWSS4JOutInterceptor.java:109)
    at org.apache.cxf.ws.security.wss4j.PolicyBasedWSS4JOutInterceptor$PolicyBasedWSS4JOutInterceptorInternal.handleMessage(PolicyBasedWSS4JOutInterceptor.java:96)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
    at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:514)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:423)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:324)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:277)
    at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:96)
    at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:139)

这是我的applicationContext.xml客户端:

<bean id="passwordCallback"
        class="com.example.payment.engine.soap.service.ClientPasswordCallback"></bean>

<jaxws:client
    name="{http://service.soap.engine.payment.example.com/}HelloWorldImplService"
    createdFromAPI="true" id="helloClient"
    serviceClass="com.example.payment.engine.soap.service.HelloWorld"
    address="http://localhost:8080/payment-engine/api/soap/hello">
    <jaxws:properties>
        <entry key="ws-security.callback-handler" value-ref="passwordCallback" />
        <entry key="ws-security.encryption.properties" value="crypto.properties" />
        <entry key="ws-security.signature.properties" value="crypto.properties" />
        <entry key="ws-security.encryption.username" value="server" />
    </jaxws:properties>
</jaxws:client>

这是客户端crypto.properties

org.apache.ws.security.crypto.merlin.keystore.file=client-keystore.jks
org.apache.ws.security.crypto.merlin.keystore.password=client-pass
org.apache.ws.security.crypto.merlin.keystore.private.password=key-pass
org.apache.ws.security.crypto.merlin.keystore.alias=client

最后这是WSDL:

<wsdl:definitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
    xmlns:tns="http://service.soap.engine.payment.example.com/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
    xmlns:ns1="http://schemas.xmlsoap.org/soap/http" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"
    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" name="HelloWorldImplService"
    targetNamespace="http://service.soap.engine.payment.example.com/">
    <wsdl:types>
        <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:tns="http://service.soap.engine.payment.example.com/"
            elementFormDefault="unqualified" targetNamespace="http://service.soap.engine.payment.example.com/" version="1.0">
            <xs:element name="sayHello" type="tns:sayHello" />
            <xs:element name="sayHelloResponse" type="tns:sayHelloResponse" />
            <xs:complexType name="sayHello">
                <xs:sequence />
            </xs:complexType>
            <xs:complexType name="sayHelloResponse">
                <xs:sequence>
                    <xs:element minOccurs="0" name="return" type="xs:string" />
                </xs:sequence>
            </xs:complexType>
        </xs:schema>
    </wsdl:types>
    <wsdl:message name="sayHelloResponse">
        <wsdl:part element="tns:sayHelloResponse" name="parameters"></wsdl:part>
    </wsdl:message>
    <wsdl:message name="sayHello">
        <wsdl:part element="tns:sayHello" name="parameters"></wsdl:part>
    </wsdl:message>
    <wsdl:portType name="HelloWorld">
        <wsdl:operation name="sayHello">
            <wsdl:input message="tns:sayHello" name="sayHello"></wsdl:input>
            <wsdl:output message="tns:sayHelloResponse" name="sayHelloResponse"></wsdl:output>
        </wsdl:operation>
    </wsdl:portType>
    <wsdl:binding name="HelloWorldImplServiceSoapBinding" type="tns:HelloWorld">
    <wsp:PolicyReference URI="#HelloWorldBindingPolicy"/>
        <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http" />
        <wsdl:operation name="sayHello">
            <soap:operation soapAction="" style="document" />
            <wsdl:input name="sayHello">
                <wsp:PolicyReference URI="#HelloWorldInputBindingPolicy" />
                <soap:body use="literal" />
            </wsdl:input>
            <wsdl:output name="sayHelloResponse">
                <wsp:PolicyReference URI="#HelloWorldOutputBindingPolicy" />
                <soap:body use="literal" />
            </wsdl:output>
        </wsdl:operation>
    </wsdl:binding>
    <wsdl:service name="HelloWorldImplService">
        <wsdl:port binding="tns:HelloWorldImplServiceSoapBinding" name="HelloWorldImplPort">
            <soap:address location="http://localhost:8080/payment-engine/api/soap/hello" />
        </wsdl:port>
    </wsdl:service>
    <wsp:Policy wsu:Id="HelloWorldBindingPolicy">
        <wsp:ExactlyOne>
            <wsp:All>
                <sp:AsymmetricBinding>
                    <wsp:Policy>
                        <sp:InitiatorToken>
                            <wsp:Policy>
                                <sp:X509Token sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
                                    <wsp:Policy>
                                        <sp:WssX509V3Token11 />
                                    </wsp:Policy>
                                </sp:X509Token>
                            </wsp:Policy>
                        </sp:InitiatorToken>
                        <sp:RecipientToken>
                            <wsp:Policy>
                                <sp:X509Token sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Never">
                                    <wsp:Policy>
                                        <sp:WssX509V3Token11 />
                                        <sp:RequireIssuerSerialReference />
                                    </wsp:Policy>
                                </sp:X509Token>
                            </wsp:Policy>
                        </sp:RecipientToken>
                        <sp:Layout>
                            <wsp:Policy>
                                <sp:Strict />
                            </wsp:Policy>
                        </sp:Layout>
                        <sp:IncludeTimestamp />
                        <sp:OnlySignEntireHeadersAndBody />
                        <sp:AlgorithmSuite>
                            <wsp:Policy>
                                <sp:Basic128 />
                            </wsp:Policy>
                        </sp:AlgorithmSuite>
                        <sp:EncryptSignature />
                    </wsp:Policy>
                </sp:AsymmetricBinding>
                <sp:Wss11>
                    <wsp:Policy>
                        <sp:MustSupportRefIssuerSerial />
                    </wsp:Policy>
                </sp:Wss11>
            </wsp:All>
        </wsp:ExactlyOne>
    </wsp:Policy>
    <wsp:Policy wsu:Id="HelloWorldInputBindingPolicy">
        <wsp:ExactlyOne>
            <wsp:All>
                <sp:EncryptedParts>
                    <sp:Body />
                </sp:EncryptedParts>
                <sp:SignedParts>
                    <sp:Body />
                </sp:SignedParts>
            </wsp:All>
        </wsp:ExactlyOne>
    </wsp:Policy>
    <wsp:Policy wsu:Id="HelloWorldOutputBindingPolicy">
        <wsp:ExactlyOne>
            <wsp:All>
                <sp:EncryptedParts>
                    <sp:Body />
                </sp:EncryptedParts>
                <sp:SignedParts>
                    <sp:Body />
                </sp:SignedParts>
            </wsp:All>
        </wsp:ExactlyOne>
    </wsp:Policy>
</wsdl:definitions>

任何帮助都会非常感激!

2 个答案:

答案 0 :(得分:2)

我花了几天时间解决这个以及Apache CXF 3.1.4的其他问题。事实上,CXF中的错误消息很少提供有关修复内容的真实线索。关键的一个是非常典型的:它讲述了一个未找到的名称,但没有提供查找的实际值,其次,这不是我的上下文中的问题。

我从基于XML / Spring的CXF总线/策略配置开始,在test和prod中工作了一年多,并且像:

SpringBusFactory bf = new SpringBusFactory();
URL busFile = MyClient.class.getResource("/wssec_policy.xml");
Bus bus = bf.createBus(busFile);
BusFactory.setDefaultBus(bus);

其中wssec_policy.xml包含jaxws:client定义,如下所示:

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:cxf="http://cxf.apache.org/core" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jaxws="http://cxf.apache.org/jaxws" xsi:schemaLocation="...etc...">
<bean id="logOutbound" class="MyLoggingOutInterceptor"/>
<bean id="logInbound" class="MyLoggingInInterceptor"/>
<cxf:bus>
    <cxf:outInterceptors><ref bean="logOutbound"/></cxf:outInterceptors>
    <cxf:inInterceptors><ref bean="dumpMessageInterceptor"/><ref bean="logInbound"/></cxf:inInterceptors>
    <cxf:features><cxf:logging/></cxf:features>
</cxf:bus>
<jaxws:client name="{http://some.domain/webservices}servicioSoap" createdFromAPI="true">
        <jaxws:properties>
            <entry key="security.encryption.properties" value="etc/Client_Encrypt.properties"/>
            <entry key="security.signature.properties" value="etc/Client_Sign.properties"/>
        </jaxws:properties>
    </jaxws:client>
</beans>

以及encryption和signature.properties包含WSS4J properties的位置。

我的挑战只是在JRE 8上使用CXF 3.1.4,BouncyCastle 1.52,Spring 4.2.4;哪个没有,先敲定你引用的错误。

我在POJO客户端组装代码并开始深入研究CXF源代码以找到真正的原因,并发现上面的默认总线设置(之前工作)不再提供jaxws:client元数据到WSS4J层。没有数据,因此错误。 Apache CXF提供了三种配置WS- *堆栈的方法(显式拦截器,基于策略的XML和基于策略的Java API)。 为了解决您的问题,我通过java API切换到基于策略的配置,如下所示:

serviceGDS = new WSDL2Java_generated_Service();
portGDS = serviceGDS.getServiceGdsSoap();
Map<String, Object> ctx = ((javax.xml.ws.BindingProvider)portGDS).getRequestContext();
Properties encProps = new Properties();
encProps.load(new FileInputStream("etc/Client_Encrypt.properties"));
ctx.put("security.encryption.properties", encProps);
Properties signProps = new Properties();
signProps.load(new FileInputStream("etc/Client_Sign.properties"));
ctx.put("security.signature.properties", signProps);
// setting the props below once helped solving the error at stake
ctx.put("security.signature.username","test_keypair");
ctx.put("security.encryption.username","gds_test_cert");

最后两个属性曾经需要进行调试,解决由于缺少密钥别名导致的错误的密钥长度错误!但最后,我注意到它没有它们就可以了! (它们实际上复制了Client_Encrypt和Client_Sign属性中的密钥库别名。)

然后我通过从Client_Encrypt和Client_Sign属性中抑制“org.apache.ws.security.crypto.merlin.keystore.provider = BC”解决了没有找到加密错误的证书(但是在过去的版本)。

我通过从 pkcs12 密钥库类型切换到 jks 来解决缺少证书错误。我发现keystore.load()没有获取所有包含的证书...使用相同的p12密钥库我根据调用它的上下文得到不同的结果...确实错误。

我通过观察在实时服务器(在我的情况下是JBoss EAP7)中的重新部署从未起作用,但是当部署的应用程序与服务器一起启动时(因此在之后),解决了不支持AsymmetricBinding 服务器重启),它的工作原理。我强烈怀疑类加载器问题。

让我补充一点,我曾经切换回JRE 7(遗留运行正常)并且错误明显不同(我怀疑JRE中的策略配置文件)。

另一个主要困难是所有错误,无论是处理请求的客户端异常,还是响应,以及服务器端错误,都被CXF包装为肥皂错误,并带有简洁的错误消息,这使得它很难理解真正发生了什么。允许我继续前进的唯一方法是在POJO中组装所需的客户端代码并在CXF和WSS4J源代码库的帮助下调试它(Eclipse / Maven在您使用调试器时向您提取源代码并向下钻取...高效!)

答案 1 :(得分:0)

使用以下

管理以使这一半工作
    HelloWorldImplService service = new HelloWorldImplService();
    HelloWorld port = service.getHelloWorldImplPort();

    Map<String, Object> ctx = ((BindingProvider) port).getRequestContext();
    ctx.put("ws-security.callback-handler", "com.example.payment.engine.soap.service.ClientPasswordCallback");
    ctx.put("ws-security.encryption.properties", "config/crypto.properties");
    ctx.put("ws-security.signature.properties", "config/crypto.properties");
    ctx.put("ws-security.encryption.username", "server");

    System.out.println(port.sayHello());