使用 Spring 和自定义上下文文件未在 Apache CXF 中生成 WS-Security Policy 节点

Question

我有一个使用 Apache CXF 生成并使用 Spring 的 SOAP Web 服务。该接口是从没有 WS-Security Policy 的 WSDL 生成的。现在我需要在生成的 WSDL 中包含这个 WS-Security 节点：

<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" wsu:Id="wss_saml_or_username_token_service_policy">
    <wsp:ExactlyOne>
        <wsp:All>
            <sp:SupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                <wsp:Policy>
                    <sp:SamlToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
                        <wsp:Policy>
                            <sp:WssSamlV11Token10/>
                        </wsp:Policy>
                    </sp:SamlToken>
                </wsp:Policy>
            </sp:SupportingTokens>
        </wsp:All>
        <wsp:All>
            <sp:SupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                <wsp:Policy>
                    <sp:UsernameToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
                        <wsp:Policy>
                            <sp:WssUsernameToken10/>
                        </wsp:Policy>
                    </sp:UsernameToken>
                </wsp:Policy>
            </sp:SupportingTokens>
        </wsp:All>
    </wsp:ExactlyOne>
</wsp:Policy>

我在 maven 中包含了这个依赖项

    <dependency>
        <groupId>org.apache.cxf</groupId>
        <artifactId>cxf-rt-ws-policy</artifactId>
        <version>2.7.2</version>
    </dependency>
    <dependency>
        <groupId>org.apache.cxf</groupId>
        <artifactId>cxf-rt-ws-security</artifactId>
        <version>2.7.2</version>
    </dependency>
    <dependency>
        <groupId>org.apache.cxf</groupId>
        <artifactId>cxf-rt-ws-rm</artifactId>
        <version>2.7.2</version>
    </dependency>

我在我的服务实现中包含了这个注解

@Policies({
        @Policy(uri = "SecurityPolicy.xml")
}
)
@WebService(targetNamespace = "http://sample.com/SampleService", name = "SampleService", portName = "SampleService_pt")
public class SampleServiceImpl implements SampleService {
    .
    .
    .
    .
}

我修改了 Spring 上下文文件以包含这样的 cxf 上下文文件：

<import resource="classpath:META-INF/cxf/cxf.xml"/>
<import resource="classpath:META-INF/cxf/cxf-extension-soap.xml"/>
<import resource="classpath:META-INF/cxf/cxf-servlet.xml"/>
<import resource="classpath:META-INF/cxf/cxf-extension-policy.xml"/>
<import resource="classpath:META-INF/cxf/cxf-extension-ws-security.xml"/>

我在我的 WEB-INF 目录下创建了一个名为 SecurityPolicy.xml 的文件，其安全策略内容如下：

<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" wsu:Id="wss_saml_or_username_token_service_policy">
    <wsp:ExactlyOne>
        <wsp:All>
            <sp:SupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                <wsp:Policy>
                    <sp:SamlToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
                        <wsp:Policy>
                            <sp:WssSamlV11Token10/>
                        </wsp:Policy>
                    </sp:SamlToken>
                </wsp:Policy>
            </sp:SupportingTokens>
        </wsp:All>
        <wsp:All>
            <sp:SupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
                <wsp:Policy>
                    <sp:UsernameToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
                        <wsp:Policy>
                            <sp:WssUsernameToken10/>
                        </wsp:Policy>
                    </sp:UsernameToken>
                </wsp:Policy>
            </sp:SupportingTokens>
        </wsp:All>
    </wsp:ExactlyOne>
</wsp:Policy>

但是，我仍然没有在生成的 WSDL 中获取 WS-Security Policy 节点。

我做错了什么？

Answer 1

我明白了。我不得不做一些修改。

首先，将SecurityPolicy.xml移动到resources目录下，然后修改@Policy注解，从中获取策略文件类路径：

@Policies({
        @Policy(uri = "classpath:SecurityPolicy.xml",
                placement = Policy.Placement.BINDING)
}
)

使用 Spring 和自定义上下文文件未在 Apache CXF 中生成 WS-Security Policy 节点

WS-Security Policy node not being generated in Apache CXF with Spring and custom context file

ws-security

spring

soap

wsdl

cxf