使用 Apache CXF 3.0 的 WS 策略

Question

尝试在 WSDL 内实施 WS-Policy。

有我的配置：

WS-Policy WSDL:



    <wsp:Policy wsu:Id="Signature">
        <wsp:ExactlyOne>
            <wsp:All>
                <sp:AsymmetricBinding>
                    <wsp:Policy>
                        <sp:InitiatorToken>
                            <wsp:Policy>
                                <sp:X509Token sp:IncludeToken=
                                                      "http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
                                    <wsp:Policy>
                                        <sp:WssX509V3Token10 />
                                    </wsp:Policy>
                                </sp:X509Token>
                            </wsp:Policy>
                        </sp:InitiatorToken>
                        <sp:RecipientToken>
                            <wsp:Policy>
                                <sp:X509Token sp:IncludeToken=
                                                      "http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never">
                                    <wsp:Policy>
                                        <sp:WssX509V3Token10 />
                                    </wsp:Policy>
                                </sp:X509Token>
                            </wsp:Policy>
                        </sp:RecipientToken>
                        <sp:AlgorithmSuite>
                            <wsp:Policy>
                                <sp:TripleDesRsa15/>
                            </wsp:Policy>
                        </sp:AlgorithmSuite>
                        <sp:Layout>
                            <wsp:Policy>
                                <sp:LaxTsFirst />
                            </wsp:Policy>
                        </sp:Layout>
                        <sp:IncludeTimestamp />
                        <sp:OnlySignEntireHeadersAndBody />
                    </wsp:Policy>
                </sp:AsymmetricBinding>
                <sp:SignedParts>
                    <sp:Body />
                </sp:SignedParts>
            </wsp:All>
        </wsp:ExactlyOne>
    </wsp:Policy>

CXF配置：



    EndpointImpl endpoint = new EndpointImpl(bus, service);
    endpoint.setWsdlLocation("classpath:/wsdl/ws.wsdl");
    endpoint.setProperties(new HashMap<String, Object>() {
        {
            put("ws-security.signature.validator", customSignatureValidator);
            put("ws-security.signature.properties", new Properties() {{
                put("org.apache.ws.security.crypto.provider", "org.apache.ws.security.components.crypto.Merlin");
                put("org.apache.ws.security.crypto.merlin.keystore.type", "jks");
                put("org.apache.ws.security.crypto.merlin.keystore.password", keystorePassword);
                put("org.apache.ws.security.crypto.merlin.file", keystorePath);
            }});
            put("ws-security.signature.username", privateKeyName);
            put("ws-security.callback-handler", (CallbackHandler) callbacks -> {
                WSPasswordCallback passwordCallback = (WSPasswordCallback) callbacks[0];

                passwordCallback.setPassword(privateKeyPassword);
            });
        }
    });
    endpoint.publish("/ws");

问题：

发送带有时间戳、签名密钥信息等的 SOAP 请求后。我收到 SOAP 故障消息：

    不能满足这些政策选择：
    {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}AsymmetricBinding: 收到的时间戳不符合要求
    {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}InitiatorToken
    {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}RecipientToken
    {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}IncludeTimestamp
    {http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}OnlySignEntireHeadersAndBody

即使我没有发送时间戳也会出现错误。根据日志 (CXF) 我看到签名是正确的。

Answer 1

经过一些调试和实验找出问题所在：假设 SOAP 请求根据 WS-Policy 不正确：Timestamp 和 Body 必须由相同的签名签名。如果仅签名 Body - 将面临列出的错误（有点不准确）。

使用 Apache CXF 3.0 的 WS 策略

WS Policy with Apache CXF 3.0

soap

wsdl

cxf