Question

我正在尝试访问第三方Web服务，该服务要求我创建一个传递时间信息，用户名和密码的安全标头。我已经在网上搜索工作示例，并尝试了很多方法。我正试图用Java 6中内置的东西来做这件事。我不确定我做错了什么。从WSDL生成我的Web服务客户端类之后，我在下面创建了Handler。

import java.util.Set;
import java.util.TimeZone;
import javax.xml.namespace.QName;
import javax.xml.soap.Node;
import javax.xml.soap.SOAPElement;
import javax.xml.soap.SOAPEnvelope;
import javax.xml.soap.SOAPFactory;
import javax.xml.soap.SOAPHeader;
import javax.xml.soap.SOAPMessage;
import javax.xml.soap.Text;
import javax.xml.ws.handler.MessageContext;
import javax.xml.ws.handler.soap.SOAPHandler;
import javax.xml.ws.handler.soap.SOAPMessageContext;

public class MyHeaderHandler implements SOAPHandler<SOAPMessageContext>
{
  public boolean handleMessage(SOAPMessageContext context) 
  {
    String prefixUri = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-";
    String uri = prefixUri + "wssecurity-secext-1.0.xsd";
    String uta = prefixUri + "wssecurity-utility-1.0.xsd";
    String ta = prefixUri + "username-token-profile-1.0#PasswordText";
    Boolean isRequest = (Boolean)context.get(MessageContext.MESSAGE_OUTBOUND_PROPERTY);
    if(isRequest)
    {
      try
      {
        SimpleDateFormat formatter = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:dd.SSS'Z'");
        formatter.setTimeZone(TimeZone.getTimeZone("GMT"));
        java.util.Date created = new java.util.Date();
        java.util.Date expires = new java.util.Date(created.getTime() + (5l * 60l * 1000l));
        SOAPMessage soapMsg = context.getMessage();
        SOAPEnvelope soapEnv = soapMsg.getSOAPPart().getEnvelope();
        SOAPHeader soapHeader = soapEnv.getHeader();
        if (soapHeader == null)
          soapHeader = soapEnv.addHeader();
        SOAPFactory factory = SOAPFactory.newInstance();
        SOAPElement securityElem = factory.createElement("Security", "o", uri);
        securityElem.addAttribute(QName.valueOf("s:mustUnderstand"), "0");
        SOAPElement timestampElem = factory.createElement("Timestamp", "u", uta);
        timestampElem.addAttribute(QName.valueOf("xmlns:u"), uta);
        timestampElem.addAttribute(QName.valueOf("Id"), "_0");
        SOAPElement elem = factory.createElement("Created", "u", uta);
        elem.addTextNode(formatter.format(created));
        timestampElem.addChildElement(elem);
        elem = factory.createElement("Expires", "u", uta);
        elem.addTextNode(formatter.format(expires));
        timestampElem.addChildElement(elem);
        securityElem.addChildElement(timestampElem);
        SOAPElement usernameElem = factory.createElement("UsernameToken", "o", uri);
        elem = factory.createElement("Username", "o", uri);
        elem.addTextNode("xxxxx");
        usernameElem.addChildElement(elem);
        elem = factory.createElement("Password", "o", uri);
        elem.addTextNode("xxxxx");
        elem.addAttribute(QName.valueOf("Type"), ta);
        usernameElem.addChildElement(elem);
        securityElem.addChildElement(usernameElem);
        soapHeader.addChildElement(securityElem);
      }
      catch(Exception e)
      {
        System.out.println("Handler error!!!! - " + e);
      }
    }
    return true;
  }

public boolean handleFault(SOAPMessageContext context) 
  {
    return true;
  }

public void close(MessageContext context)
  {
  }

public Set<QName> getHeaders() 
  {
    return null;
  }
}

接下来，我将测试程序编码为附加处理程序并尝试调用Web服务。

import java.util.ArrayList;
import java.util.List;
import javax.xml.namespace.QName;
import javax.xml.ws.handler.Handler;
import javax.xml.ws.handler.HandlerResolver;
import javax.xml.ws.handler.PortInfo;
import org.tempuri.ServiceName;
import org.tempuri.IServiceName;


public class test
{
 public static void main(String[] args)
 throws Exception
 {
   ServiceName service = new ServiceName(new URL("https://url.to.service/services/ServiceName.svc?wsdl"), new QName("http://org.tempuri/", "ServiceName"));
   service.setHandlerResolver(new HandlerResolver() 
   {
     public List<Handler> getHandlerChain(PortInfo portInfo) 
     {
       List<Handler> handlerList = new ArrayList<Handler>();
       handlerList.add(new MyHeaderHandler());
       return handlerList;
     }
   });
   IServiceName binding = service.getBasicHttpBindingIServiceName();
   ArrayLiist results = binding.getMyData("my parm");
   System.out.println("Size: " + results.size());
 }
}

当我运行它时，我在绑定的行中得到以下错误.getMyData（）：

Exception in thread "main" java.lang.ClassCastException: com.sun.xml.ws.message.saaj.SAAJHeader cannot be cast to com.sun.xml.ws.security.opt.impl.outgoing.SecurityHeader
 at com.sun.xml.ws.security.opt.impl.JAXBFilterProcessingContext.setJAXWSMessage(JAXBFilterProcessingContext.java:140)
 at com.sun.xml.wss.jaxws.impl.SecurityPipeBase.secureOutboundMessage(SecurityPipeBase.java:389)
 at com.sun.xml.wss.jaxws.impl.SecurityClientPipe.process(SecurityClientPipe.java:196)
 at com.sun.xml.ws.api.pipe.helper.PipeAdapter.processRequest(PipeAdapter.java:115)
 at com.sun.xml.ws.api.pipe.Fiber.__doRun(Fiber.java:595)
 at com.sun.xml.ws.api.pipe.Fiber._doRun(Fiber.java:554)
 at com.sun.xml.ws.api.pipe.Fiber.doRun(Fiber.java:539)
 at com.sun.xml.ws.api.pipe.Fiber.runSync(Fiber.java:436)
 at com.sun.xml.ws.client.Stub.process(Stub.java:248)
 at com.sun.xml.ws.client.sei.SEIStub.doProcess(SEIStub.java:135)
 at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:109)
 at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:89)
 at com.sun.xml.ws.client.sei.SEIStub.invoke(SEIStub.java:118)
 at $Proxy40.getM(Unknown Source)
 at test.main(test.java:30)

我尝试的每一种方法都会在同一点上结束。我该如何解决这个问题？我无法弄清楚如何创建SecurityHeader放入标题。任何帮助将不胜感激。一个工作的例子会很棒。

谢谢！

Answer 1

当我解决类似问题时，this thread really帮助了我。

问题是当你在类路径上有Metro（Oracle的WS堆栈）库时，它们会被自动检测并包含在WS处理中。当WSDL中存在端点策略时，一个功能是透明身份验证/安全性处理。不幸的是，这种安全处理不是

我无法更改WSDL。 我的解决方案是从类路径中删除不需要的JAR（wsit-rt）。

Answer 2

老问题，但我目前遇到了同样的问题。解决方案是删除我手动包含的其他安全标头。因此，如果遇到此问题，请检查是否有任何处理程序（SOAPHandler）将任何标头写入soap消息<Security>标题部分。

com.sun.xml.ws.message.saaj.SAAJHeader无法强制转换为com.sun.xml.ws.security.opt.impl.outgoing.SecurityHeader

2 个答案: