Question

我们目前正在开展一个项目，我们需要在使用基于声明的身份验证的Sharepoint 2016网站中访问Sharepoint Foundation Web服务API。用于提供声明的安全令牌服务是托管在Win2k12服务器上的ADFS 2.0。用户需要提供其电子邮件地址，以便进行身份验证并获取安全令牌以进行进一步操作。

注意：由于这是一个开发设置，我们使用ADFS端点的自签名证书

我们使用Apache CXF 2.7.12和JDK 8作为访问此Web服务的客户端开发堆栈。当我们请求令牌时，在警告级别记录与HttpsToken断言失败相关的异常，然后没有任何反应。呼叫未完成，我们必须终止该过程。

这是我们第一次使用CXF;请求获得有关如何解决此问题的一些帮助和指导。我们已经提到以下网站进行初步调查，但它们似乎都没有帮助我们解决这个特殊问题：

Using Apache CXF to connect CRM Dynamics

Apache CXF Client Configuration options

以下是URL

上提供的Sharepoint站点的WS-Policy

<wsp:Policy wsu:Id="UserNameWSTrustBinding_IWSTrust13Async_policy">
<wsp:ExactlyOne>
<wsp:All>
<sp:TransportBinding>
<wsp:Policy>
<sp:TransportToken>
<wsp:Policy>
<sp:HttpsToken/>
</wsp:Policy>
</sp:TransportToken>
<sp:AlgorithmSuite>
<wsp:Policy>
<sp:Basic256/>
</wsp:Policy>
</sp:AlgorithmSuite>
<sp:Layout>
<wsp:Policy>
<sp:Strict/>
</wsp:Policy>
</sp:Layout>
<sp:IncludeTimestamp/>
</wsp:Policy>
</sp:TransportBinding>
<sp:SignedEncryptedSupportingTokens>
<wsp:Policy>
<sp:UsernameToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
<wsp:Policy>
<sp:WssUsernameToken10/>
</wsp:Policy>
</sp:UsernameToken>
</wsp:Policy>
</sp:SignedEncryptedSupportingTokens>
<sp:EndorsingSupportingTokens>
<wsp:Policy>
<sp:KeyValueToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never" wsp:Optional="true"/>
<sp:SignedParts>
<sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/>
</sp:SignedParts>
</wsp:Policy>
</sp:EndorsingSupportingTokens>
<sp:Wss11>
<wsp:Policy/>
</sp:Wss11>
<sp:Trust13>
<wsp:Policy>
<sp:MustSupportIssuedTokens/>
<sp:RequireClientEntropy/>
<sp:RequireServerEntropy/>
</wsp:Policy></sp:Trust13>
<wsaw:UsingAddressing/>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>

我们现在按如下方式配置STSClient：

STSClient spSTSClient = new STSClient(bus);
spSTSClient.setTrust(new Trust10(SP12Constants.INSTANCE));
spSTSClient.setSoap12();


//would we also also need to set the token type and key type?

// spSTSClient.setTokenType("urn:oasis:names:tc:SAML:2.0:assertion");
//spSTSClient.setKeyType("http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer");        

spSTSClient.setWsdlLocation("https://myadfsserver.com/adfs/services/trust/mex");
spSTSClient.setServiceName("{http://schemas.microsoft.com/ws/2008/06/identity/securitytokenservice}SecurityTokenService");
    spSTSClient.setEndpointName("{http://schemas.microsoft.com/ws/2008/06/identity/securitytokenservice}UserNameWSTrustBinding_IWSTrust13Async");
            spSTSClient.setAddressingNamespace("http://www.w3.org/2005/08/addressing");    String sharePointUsername = “user@mysharepoint.COM";
String sharePointPassword = “foobar#”;

SecurityToken secToken = spsSTSClient.requestSecurityToken("http://mysharepointsite.com/_trust");

requestSecurityToken调用会抛出一个警告，如下所示：

WARNING: Interceptor for {http://schemas.microsoft.com/ws/2008/06/identity/securitytokenservice}SecurityTokenService#{http://schemas.microsoft.com/ws/2008/06/identity/securitytokenservice}Trust13IssueAsync has thrown exception, unwinding now
org.apache.cxf.ws.policy.PolicyException: Assertion of type {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}HttpsToken could not be asserted: Not an HTTPs connection
    at org.apache.cxf.ws.security.policy.interceptors.HttpsTokenInterceptorProvider$HttpsTokenOutInterceptor.assertHttps(HttpsTokenInterceptorProvider.java:144)
    at org.apache.cxf.ws.security.policy.interceptors.HttpsTokenInterceptorProvider$HttpsTokenOutInterceptor.handleMessage(HttpsTokenInterceptorProvider.java:87)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:272)
    at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:570)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:479)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:382)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:335)

Answer 1

WSDL要求使用TransportBinding，但您没有使用＆＃34; https＆＃34;网址，例如：＆＃34; http://mysharepointsite.com/_trust＆＃34;

基于声明的Sharepoint站点和Apache CXF STSClient通信

1 个答案: