Question

我打算将<strong> jboss 5 迁移到 wildfly 12 。有一个Web服务正在使用org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor来验证对该服务的访问。为此，它使用 jboss-cxf.xml 中的配置，如下所示。

<jaxws:inInterceptors>
     <bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor"/>
     <bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
           <property name="properties">
               <map>
                    <entry key="action"  value="UsernameToken"/>
                    <entry key="passwordType" value="PasswordText"/>
                    <entry key="passwordCallbackClass" value="com.xxx.xxx.ws.wsse.ServerPasswordCallback"/>
               </map>
             </property>
     </bean>
</jaxws:inInterceptors>

在 wildfly12 中，其未读取此xml。有一个名为“ jboss-webservices.xml”的新配置文件。但我找不到将其迁移到新版本的方法。
请对此提供帮助

Answer 1

我使用拦截器注释解决了这个问题。我添加了org.apache.cxf.interceptor.InInterceptors批注并提供了自定义类，以将值设置为WSS4JInInterceptor的必填字段，并将WSS4JInInterceptor添加到了拦截器链。

@InInterceptors(interceptors = {"com.xxx.xx.ws.wsse.WSSecurityInterceptor"})
@WebService
@Stateless
public class OrganizationImportServiceImpl{...enter code here

这是com.xxx.xx.ws.wsse.WSSecurityInterceptor类

package com.xxx.xx.ws.wsse;

import java.util.HashMap;
import java.util.Map;
import org.apache.cxf.interceptor.Fault;
import org.apache.cxf.interceptor.Interceptor;
import org.apache.cxf.message.Message;
import org.apache.cxf.phase.AbstractPhaseInterceptor;
import org.apache.cxf.phase.Phase;
import org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor;

public class WSSecurityInterceptor extends AbstractPhaseInterceptor<Message>{

public WSSecurityInterceptor() {
    super(Phase.PRE_PROTOCOL);
}   
public WSSecurityInterceptor(String phase) {
    super(Phase.PRE_PROTOCOL);
}

@Override
public void handleMessage(Message message) throws Fault {

    Map<String, Object> props = new HashMap<String, Object>();
    props.put("action", "UsernameToken");
    props.put("passwordCallbackClass", "com.xxx.xx.ws.wsse.ServerPasswordCallback");
    props.put("passwordType", "PasswordText");

    WSS4JInInterceptor wss4jInHandler = new WSS4JInInterceptor(props);

    message.getInterceptorChain().add((Interceptor<? extends Message>) wss4jInHandler);
 }
}

然后在回调处理程序类中设置有效密码。这是回调处理程序类。

package com.xxx.xx.ws.wsse;

import java.io.IOException;
import java.util.HashMap;
import java.util.Map;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
import org.apache.wss4j.common.ext.WSPasswordCallback;

public class ServerPasswordCallback implements CallbackHandler {

   private Map<String, String> passwords = new HashMap<String, String>();

   public ServerPasswordCallback() {
     super();
     passwords.put("testuser", "testpwd");
   }

   public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {

    WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];

    if (pc.getIdentifier() == null) {
        throw new IOException("authentication failure. required username password to proceed ..");
    }

    if (passwords.containsKey(pc.getIdentifier())) {
       // set the password on the callback. This will be compared to the
       // password which was sent from the client.
        pc.setPassword(passwords.get(pc.getIdentifier()));
    } else {
        throw new IOException("authentication failure. invalid user name or password ");
    }
  } 
}

然后在cxf-rt-ws-security模块中执行密码验证。

WSS4JInInterceptor迁移到wildfly12

1 个答案: