web-services 相关问题

我正在尝试将 UsernameToken wss 标头添加到我的 ws 客户端。客户端实现 javax.xml.ws.Service 并已通过 WSDL2Java CFX 3.1.4 生成由于 wsdl 包含我正在尝试将 UsernameToken wss 标头添加到我的 ws 客户端。客户端实现了 javax.xml.ws.Service 并已通过 WSDL2Java CFX 3.1.4 生成由于 wsdl 包含 <wsp:Policy xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy" wsu:Id="UsernameTokenPolicy"> <sp:UsernameToken> <wsp:Policy> <sp:WssUsernameToken10/> <sp:HashPassword/> </wsp:Policy> </sp:UsernameToken> </wsp:Policy> 必须添加 Usernametoken 标头。搜索了一下，我发现这很简单 ((BindingProvider)soapClient).getRequestContext().put("ws-security.username", usr); ((BindingProvider)soapClient).getRequestContext().put("ws-security.password", psw); 顺便说一下，当我尝试执行呼叫时，出现以下错误： These policy alternatives can not be satisfied: {http://schemas.xmlsoap.org/ws/2005/07/securitypolicy}UsernameToken: Password hashing policy not enforced 有什么建议吗？谢谢你。附注我已经在堆栈溢出中检查过类似的帖子，但是如果我尝试像here建议的那样采用不同的方法，我会得到一个不同的错误： Interceptor for XXXX has thrown exception, unwinding now org.apache.cxf.ws.policy.PolicyException: No username available 如cxf-文档所述从 Apache CXF 3.1.0 开始，WS-SecurityPolicy 和 XML 安全性 CXF 中的 (JAX-RS) 组件共享一组通用的配置标签。所以你不应该使用ws-security.username和ws-security.password，而应该使用security.username和security.password 还要确保 cxf-rt-ws-policy 和 cxf-rt-ws-security 模块在类路径上可用，以便 ws-policy 将自动启用，从而负责对密码进行哈希处理，即计算正确的密码摘要。

java web-services cxf ws-security windows-sharepoint-services

回答 1 投票 0

“wsse:InvalidSecurity”是什么意思？

处理标头时发现错误顺便说一句，这是一个 WS-Security 问题... 我看不出我的 WS 端点有任何问题（除了它在

web-services security ws-security pki

回答 2 投票 0

如何为 Weblogic 实现具有签名正文和时间戳的 Web 服务客户端

我正在尝试为启用了 WSS（签名正文和时间戳）的 Web 服务实现一个简单的 Web 服务客户端。这是 WSS 政策：我正在尝试为启用了 WSS（签名正文和时间戳）的 Web 服务实现一个简单的 Web 服务客户端。这是 WSS 政策： <wsp:Policy wsu:Id="SignatureRequired" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"> <wsp:ExactlyOne> <wsp:All> <sp:AsymmetricBinding> <wsp:Policy> <sp:InitiatorToken> <wsp:Policy> <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient"> <wsp:Policy> <sp:WssX509V3Token10 /> </wsp:Policy> </sp:X509Token> </wsp:Policy> </sp:InitiatorToken> <sp:RecipientToken> <wsp:Policy> <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToInitiator"> <wsp:Policy> <sp:WssX509V3Token10 /> </wsp:Policy> </sp:X509Token> </wsp:Policy> </sp:RecipientToken> <sp:AlgorithmSuite> <wsp:Policy> <sp:TripleDesRsa15/> </wsp:Policy> </sp:AlgorithmSuite> <sp:Layout> <wsp:Policy> <sp:Strict /> </wsp:Policy> </sp:Layout> <sp:IncludeTimestamp /> </wsp:Policy> </sp:AsymmetricBinding> <sp:SignedParts> <sp:Body /> </sp:SignedParts> </wsp:All> </wsp:ExactlyOne> </wsp:Policy> 客户端实现基于 Oracle 文档中的示例：http://docs.oracle.com/cd/E24329_01/web.1211/e24488/message.htm#WSSOV273 Web 服务在 Weblogic 12c (12.1.2) 和 Oracle Java 1.7.0_25 上运行 package com.example.testclient.mtom; import weblogic.jws.jaxws.ClientPolicyFeature; import weblogic.jws.jaxws.policy.InputStreamPolicySource; import weblogic.security.SSL.TrustManager; import weblogic.xml.crypto.wss.api.Timestamp; import weblogic.xml.crypto.wss.api.WSSecurityFactory; import weblogic.xml.crypto.wss.provider.CredentialProvider; import weblogic.xml.crypto.wss.WSSecurityContext; import weblogic.wsee.security.bst.ClientBSTCredentialProvider; import javax.activation.DataHandler; import javax.activation.FileDataSource; import javax.xml.namespace.QName; import javax.xml.ws.BindingProvider; import javax.xml.ws.soap.MTOMFeature; import org.apache.commons.lang.RandomStringUtils; import java.util.Calendar; import java.util.Date; import java.util.List; import java.util.ArrayList; import java.util.Map; import java.io.FileInputStream; import java.io.InputStream; import java.security.cert.X509Certificate; import com.example.attachment.TestWebServiceAttachment_Service; import com.example.attachment.TestWebServiceAttachment; public class TestWebServiceAttachmentClient { public TestWebServiceAttachmentClient() { // TODO Auto-generated constructor stub } public static void main(String[] args) throws Throwable { String username = "User"; String password = "Pass"; String clientCertFile = "src/main/resources/User.jks"; QName operationName = new QName("http://www.example.com/ws/attachment", "fileUpload"); MTOMFeature mtomFeature = new MTOMFeature(); InputStream is = new FileInputStream("src/main/resources/my-wssp1.1-signature-required.xml"); ClientPolicyFeature clientPolicyFeature = new ClientPolicyFeature(); clientPolicyFeature.setEffectivePolicyForOperation(operationName, new InputStreamPolicySource(is)); TestWebServiceAttachment_Service service = new TestWebServiceAttachment_Service(); TestWebServiceAttachment port = service.getTestWebServiceAttachmentPort(clientPolicyFeature, mtomFeature); //create credential provider and set it to the Stub List credProviders = new ArrayList(); //client side BinarySecurityToken credential provider -- x509 CredentialProvider cp = new ClientBSTCredentialProvider(clientCertFile, password, username, password); credProviders.add(cp); Date date = new Date(); Calendar created = Calendar.getInstance(); created.setTime(date); Calendar expired = Calendar.getInstance(); expired.setTime(date); expired.set(Calendar.HOUR_OF_DAY, created.get(Calendar.HOUR_OF_DAY) + 1); Timestamp timestamp = WSSecurityFactory.newTimestamp("TS-" + RandomStringUtils.randomNumeric(34), created, expired); Map<String, Object> requestContext = ((BindingProvider) port).getRequestContext(); requestContext.put(WSSConstants.TIMESTAMP_ELEMENT, timestamp); requestContext.put(WSSecurityContext.CREDENTIAL_PROVIDER_LIST, credProviders); requestContext.put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY, "http://myserver:7001/ws/TestWebServiceAttachment/1.0"); requestContext.put(WSSecurityContext.TRUST_MANAGER, new TrustManager() { public boolean certificateCallback(X509Certificate[] chain, int validateErr) { // need to validate if the server cert can be trusted return true; } }); DataHandler dh = new DataHandler(new FileDataSource("src/main/resources/file1.pdf")); long response = port.fileUpload("file1.pdf", dh); System.out.println("response = " + response); } } 问题在于时间戳。我不知道如何正确地将时间戳签名添加到 WSS 上下文中。有谁知道如何实现这样的客户端？我收到以下异常： Exception in thread "main" com.sun.xml.ws.fault.ServerSOAPFaultException: Client received SOAP Fault from server: Timestamp validation failed. Please see the server log to find more detail regarding exact cause of the failure. at com.sun.xml.ws.fault.SOAP11Fault.getProtocolException(SOAP11Fault.java:193) at com.sun.xml.ws.fault.SOAPFaultBuilder.createException(SOAPFaultBuilder.java:125) at com.sun.xml.ws.client.sei.StubHandler.readResponse(StubHandler.java:253) at com.sun.xml.ws.db.DatabindingImpl.deserializeResponse(DatabindingImpl.java:181) at com.sun.xml.ws.db.DatabindingImpl.deserializeResponse(DatabindingImpl.java:258) at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:117) at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:91) at com.sun.xml.ws.client.sei.SEIStub.invoke(SEIStub.java:154) at com.sun.proxy.$Proxy37.fileUpload(Unknown Source) 我知道我的答案可能对你不再有用，但可能对其他人有帮助。 Weblogic 时间戳验证假定相应字段位于 UTC 时区。检查您的日期时间字段是否采用 UTC。当没有时间戳字段或时间戳字段不正确时，服务器会显示 Timestamp validation failed 消息。您可以通过将以下行添加到代码中来查看您的原始 SOAP 请求： System.setProperty("com.sun.xml.ws.transport.http.client.HttpTransportPipe.dump", "true"); System.setProperty("com.sun.xml.internal.ws.transport.http.client.HttpTransportPipe.dump", "true"); System.setProperty("com.sun.xml.ws.transport.http.HttpAdapter.dump", "true"); System.setProperty("com.sun.xml.internal.ws.transport.http.HttpAdapter.dump". "true");

web-services timestamp weblogic signature ws-security

回答 1 投票 0

当明文密码未存储在 Web 服务生产者上时，PasswordDigest 的替代方案是什么？

场景： Web 服务生产者仅将密码的 SHA-1 哈希值存储在数据库中。我们需要使用用户名/密码组合来验证 Web 服务用户。 Web 服务安全用户名...

web-services security passwords wss4j

回答 1 投票 0

使用 Web 服务 - WS Security

我即将开发一个 Windows 应用程序，需要使用 Web 服务安全性与 Axis2 Web 服务进行通信 - 所有文档都说，SOAP 安全通信是

c# web-services x509certificate apache-axis ws-security

回答 1 投票 0

使用soapUI测试WS安全性 - 在消息负载中使用安全标头

我是 Web 服务和 WS Security 的新手。我有一个使用 CFX 拦截器的示例 Web 服务。以下是我的配置文件。 Cfx-servelet.xml： ...