Question

我正在尝试编写一个groovy脚本（也欢迎java代码;）），这应该允许我执行摘要式身份验证。需要的是能够在SOAPUI中使用Digest auth，因为SOAP不支持本机这种身份验证。

为了测试我的脚本，我使用了一个网址：https://postman-echo.com/digest-auth

首先，我通过网络浏览器访问该页面以获取WWW-Authenticate标头。 Digest realm =“Users”，nonce =“81lEQmJGxRb3Us9jVJPYlDpjw11On7zW”，qop =“auth”

然后我输入正确的用户名+密码并检查Web浏览器计算的授权标头。结果如下：

Digest username="postman", realm="Users", nonce="81lEQmJGxRb3Us9jVJPYlDpjw11On7zW", uri="/digest-auth", response="82884fe7c55a19e80e8c8dea7ba1aece", qop=auth, nc=00000001, cnonce="89aa538367b9069a"

然后我使用相同的数据来使用我的脚本执行响应数据的计算。结果如下：

Digest username="postman", realm="Users", nonce="81lEQmJGxRb3Us9jVJPYlDpjw11On7zW", uri="/digest-auth", response="a6767f0a78d17e0cab90df65ec2ace5c", qop=auth,nc="00000001",cnonce="03d476861afd384510f2cb80ccfa8511"

我的回答与网络浏览器计算的响应不同。

我做错了什么？

这是我的剧本：

import org.apache.commons.codec.digest.DigestUtils
import com.eviware.soapui.impl.wsdl.actions.teststep.RunFromTestStepAction


// URL: https://postman-echo.com/digest-auth

wwwAuthHeader = "Digest realm=\"Users\",    nonce=\"81lEQmJGxRb3Us9jVJPYlDpjw11On7zW\", qop=\"auth\""

def realmArray = wwwAuthHeader.split(",")

def realm = realmArray[0].split("=")[1]
def nonce = realmArray[1].split("=")[1]
def qop = realmArray[2].split("=")[1]

def uri = "/digest-auth"
def user = "postman"
def pass = "password"
def method ="GET"



def resp = md5(user,realm,pass,method,uri,nonce)

log.info "resp: "+resp

def cnonce = DigestUtils.md5Hex(user)

def authorizationString = "Digest username=\"$user\", realm=$realm,         nonce=$nonce, uri=\"$uri\", response=\"$resp\", qop=auth,nc=\"00000001\",cnonce=\"$cnonce\""

log.info "authorizationString: " + authorizationString

// methods

def md5(user, realm, pass, method, String uri, nonce) {

    def A1 = DigestUtils.md5Hex ("$user:$realm:$pass")
    def A2 = DigestUtils.md5Hex ("$method:$uri")

    return DigestUtils.md5Hex ("$A1:$nonce:$A2")
}

Answer 1

如果您只想编写一个groovy脚本（也欢迎使用java代码，正如您的问题所示），它允许您执行摘要式身份验证，这里有一些供您参考：

@Grab(group='org.apache.httpcomponents', module='httpclient', version='4.5.3')

import org.apache.http.auth.UsernamePasswordCredentials;
import org.apache.http.client.CredentialsProvider;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.BasicCredentialsProvider;
import org.apache.http.auth.AuthScope;
import org.apache.http.HttpResponse;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.util.EntityUtils;

CredentialsProvider credsProvider = new BasicCredentialsProvider();
credsProvider.setCredentials(
        new AuthScope(AuthScope.ANY_HOST, AuthScope.ANY_PORT),
        new UsernamePasswordCredentials("postman", "password"));

CloseableHttpClient httpClient = HttpClients.custom()
        .setDefaultCredentialsProvider(credsProvider)
        .build();

HttpGet httpGet = new HttpGet("https://postman-echo.com/digest-auth");
HttpResponse httpResponse = httpClient.execute(httpGet);
String content = EntityUtils.toString(httpResponse.getEntity());
println content;

运行它，输出如下：

{"authenticated":true}

Groovy Digest身份验证

1 个答案: