Question

我正在开发一个Spring-WS项目，正在尝试使用某种SOAP服务，但是请求的Header标记出现了一些问题。
PS：我在SOAP UI上运行了相同的请求，它运行良好。

这是我运行的代码：

JAXBElement<ChangeOtherIDsRequestType> request = createRequestBody();

    WebServiceTemplate template = new WebServiceTemplate(marshaller);
    template.setDefaultUri(URI);
    @SuppressWarnings({ "unchecked" })
    JAXBElement<ChangeOtherIDsResponseType> response = (JAXBElement<ChangeOtherIDsResponseType>) template
            .marshalSendAndReceive(request, new WebServiceMessageCallback() {

                @Override
                public void doWithMessage(WebServiceMessage message) {
                    Instant instant = Instant.now();

                    SaajSoapMessage saajSoapMessage = (SaajSoapMessage) message;
                    SOAPMessage soapMessage = saajSoapMessage.getSaajMessage();
                    SOAPPart soapPart = soapMessage.getSOAPPart();
                    try {
                        SOAPEnvelope soapEnvelope = soapPart.getEnvelope();
                        SOAPHeader soapHeader = soapEnvelope.getHeader();
                        Name headerElementName = soapEnvelope.createName("Security", "wsse",
                                "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");

                        // Add "Security" soapHeaderElement to soapHeader
                        SOAPHeaderElement soapHeaderElement = soapHeader.addHeaderElement(headerElementName);
                        soapHeaderElement.setMustUnderstand(true);
                        soapHeaderElement.addNamespaceDeclaration("wsu",
                                "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd");

                        // Add usernameToken to "Security" soapHeaderElement
                        SOAPElement usernameTokenSOAPElement = soapHeaderElement.addChildElement("UsernameToken",
                                "wsse");

                        // Add username to usernameToken
                        QName userQname = soapHeaderElement.createQName("Username", "wsse");
                        SOAPElement userNameSOAPElement = usernameTokenSOAPElement.addChildElement(userQname);
                        userNameSOAPElement.addTextNode("username");
                        // Add password to usernameToken
                        QName passwordQname = usernameTokenSOAPElement.createQName("Password", "wsse");
                        SOAPElement passwordSOAPElement = usernameTokenSOAPElement.addChildElement("Password");
                        passwordSOAPElement.setAttribute("Type",
                                "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText");
                        passwordSOAPElement.addTextNode("password");
                        // Add Nonce to usernameToken.
                        QName nonceQname = soapHeaderElement.createQName("Nonce", "wsse");
                        SOAPElement nonceSOAPElement = usernameTokenSOAPElement.addChildElement("Nonce");
                        nonceSOAPElement.setAttribute("EncodingType",
                                "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary");

                        // Add Created to usernameToken.
                        QName createdQname = soapHeaderElement.createQName("Created", "wsu");
                        SOAPElement createdElement = usernameTokenSOAPElement.addChildElement(createdQname);
                        createdElement.addTextNode(instant.toString());
                    } catch (SOAPException | UnsupportedEncodingException e) {
                        e.printStackTrace();
                    }
                }
            });
    template.marshalSendAndReceive(URI, request);

该代码应在请求中添加Header标记，并用于通过“用户名”和“密码”对用户进行身份验证。
我期望的结果与SOAP UI为同一请求生成的结果相同。结果是这样：

<SOAP-ENV:Header>
<wsse:Security SOAP-ENV:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <wsse:UsernameToken wsu:Id="UsernameToken-C17C5A667A3F11A8DA153735499778322">
        <wsse:Username>username</wsse:Username>
        <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">password</wsse:Password>
        <wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">Tl6jznnHitsSE9F16FWTsw==</wsse:Nonce>
        <wsu:Created>2018-09-19T11:03:17.783Z</wsu:Created>
    </wsse:UsernameToken>
</wsse:Security>

但是我得到的结果如下：

<SOAP-ENV:Header>
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" SOAP-ENV:mustUnderstand="1">
        <wsse:UsernameToken>
            <wsse:Username>username</wsse:Username>
            <Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">password</Password>
            <Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"> </Nonce>
            <wsu:Created>2018-09-19T11:02:21.918Z</wsu:Created>
        </wsse:UsernameToken>
    </wsse:Security>
</SOAP-ENV:Header>

让我们看看我的结果中缺少一些东西，例如：

“ wsse”前缀。
“ Username”标签上的“ UsernameToken”属性。
“ Nonce”标签的值。

尝试修复这些问题时遇到了一些问题，但仍然存在一些问题：

当我尝试将“ wsse”前缀添加到“用户名”和“ Nonce”标签时：整个“ Header”标签消失了。（我使用了与“ Username”标记中相同的技术）
SOAP UI如何生成“ Nonce”值？
SOAP UI如何生成“ UsernameToken”值？

最后，还有另一种模拟SOAP UI请求的方法吗？

谢谢。

Answer 1

您正在尝试在请求中增加安全性，但是存在拦截器和默认方法。为您的WebServiceTemplate配置Wss4jSecurityInterceptor。

类似下面的事情应该可以解决。

@Bean
public Wss4jSecurityInterceptor securityInterceptor() {
  Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
  interceptor.setSecurementUsername("username");
  interceptor.setSecurementPassword("password");
  interceptor.setSecurementUsernameTokenNonce(true);
  interceptor.setSecurementActions("UsernameToken Timestamp");
  return interceptor;
}

然后将其注入您的WebServiceTemplate中。那应该添加所需的标题，而无需执行任何其他操作。理想情况下，您只需配置一次WebServiceTemplate并重复使用。

@Bean
public WebServiceTemplate webServiceTemplate(Marshaller marshaller) {
    WebServiceTemplate wsTemplate = new WebServiceTemplate(marshaller);
    wsTemplate.setInterceptors(new ClientInterceptor[]{ securityInterceptor() });
    return wsTemplate;
}

然后在代码中使用预先配置的WebServiceTemplate。

Spring-WS SOAP标头前缀问题

1 个答案: