我正在尝试创建一个CXF soap Web服务客户端,以使用Kerberos身份验证的SharePoint实例进行soap调用。
我导入以下内容:
这是我的Java程序。
import crawler.common.sharepoint.stubs.lists.Lists;
import crawler.common.sharepoint.stubs.lists.ListsSoap;
import org.apache.cxf.configuration.jsse.TLSClientParameters;
import org.apache.cxf.configuration.security.AuthorizationPolicy;
import org.apache.cxf.endpoint.Client;
import org.apache.cxf.frontend.ClientProxy;
import org.apache.cxf.transport.http.HTTPConduit;
import org.apache.cxf.transport.http.asyncclient.AsyncHTTPConduit;
import org.apache.cxf.transport.http.auth.HttpAuthHeader;
import org.apache.cxf.transports.http.configuration.HTTPClientPolicy;
import org.apache.cxf.ws.security.wss4j.KerberosTokenInterceptor;
import javax.xml.ws.BindingProvider;
import javax.xml.ws.Service;
public class SharepointKerberosTesterClient {
public static void main(String[] args) {
System.setProperty("java.security.krb5.conf", "/home/ndipiazza/xxxx/spnego-http-client/krb5.conf");
System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
System.setProperty("java.security.auth.login.config", "/home/ndipiazza/xxxx/spnego-http-client/login.conf");
String endpoint = "http://win-qbfsb933r5p/_vti_bin/Lists.asmx";
Service service = Service.create(Lists.SERVICE);
ListsSoap soap = service.getPort(ListsSoap.class);
BindingProvider bindingProvider = (BindingProvider) soap;
bindingProvider.getRequestContext().put(AsyncHTTPConduit.USE_ASYNC,
Boolean.TRUE);
bindingProvider.getRequestContext().put(
BindingProvider.ENDPOINT_ADDRESS_PROPERTY, endpoint);
Client client = ClientProxy.getClient(bindingProvider);
client.getEndpoint().put("org.apache.cxf.stax.maxChildElements", System.getProperty("org.apache.cxf.stax.maxChildElements") != null
? System.getProperty("org.apache.cxf.stax.maxChildElements") : "5000000");
HTTPConduit http = (HTTPConduit) client.getConduit();
AuthorizationPolicy authorization = new AuthorizationPolicy();
authorization.setAuthorization("SharePoint");
authorization.setAuthorizationType(HttpAuthHeader.AUTH_TYPE_NEGOTIATE);
http.setAuthorization(authorization);
HTTPClientPolicy httpClientPolicy = new HTTPClientPolicy();
httpClientPolicy.setAllowChunking(false);
httpClientPolicy.setAutoRedirect(true);
TLSClientParameters tlsClientParameters = new TLSClientParameters();
tlsClientParameters.setDisableCNCheck(true);
http.setTlsClientParameters(tlsClientParameters);
http.setClient(httpClientPolicy);
System.out.println("Size of lists: " + soap.getListCollection().getContent().size());
}
}
如果您查看此示例,http://cxf.apache.org/docs/jaxrs-kerberos.html#JAXRSKerberos-AuthorizationPolicy有一个特殊的类KerberosAuthOutInterceptor
,可以根据需要添加协商授权标头。
但是在3.1.x和3.2.x版本的CXF中似乎不存在。
但是我不知道如何使用拦截器提供程序。有人知道如何与CXF的程序化(非xml)声明一起使用吗?
答案 0 :(得分:1)
SharePoint已部署在IIS上,并且IIS绝对可以进行Kerberos身份验证。因此,我怀疑这是一个SharePoint问题-您能否分享您对为什么的看法?我调试的方式是,我将使用标志-Dsun.security.krb5.debug=true
启动您的客户端(不是肯定的,它将与您正在使用的类一起使用)。但是尝试监听标头,服务器应该发送WWW-Authenticate。客户端提供的响应(您可以在SharePoint服务器上的调试日志中查看)可以是Kerberos的YII或NTLM的TIRM。因此,如果以TIRM开头的Kerberos配置会遇到问题。您可能必须通过IIS启用连接调试才能查看此信息。