WSSE - 在 soapenv:Header 中签署一个元素
WSSE - Sign an element inside soapenv:Header
我想将 wsse:security 添加到我的 soap 消息中。这是我的代码:
public Document signSoapMessage(SOAPMessage message) {
try {
Document doc = message.getSOAPBody().getOwnerDocument();
Crypto crypto = CryptoFactory.getInstance(properties); //File
WSSecHeader secHeader = new WSSecHeader(doc);
secHeader.insertSecurityHeader();
InputStream inStream = new FileInputStream(properties.getProperty("org.apache.ws.security.crypto.merlin.keystore.file"));
KeyStore ks = KeyStore.getInstance("PKCS12");
ks.load(inStream, properties.getProperty("privatekeypassword").toCharArray());
String alias = ks.aliases().nextElement();
X509Certificate cert = (X509Certificate) ks.getCertificate(alias);
WSSecSignature sign = new WSSecSignature(secHeader);
sign.setX509Certificate(cert);
sign.setUserInfo(properties.getProperty("org.apache.ws.security.crypto.merlin.keystore.alias"), properties.getProperty("privatekeypassword"));
sign.setKeyIdentifierType(WSConstants.BST_DIRECT_REFERENCE); // Binary Security Token - SecurityTokenReference
sign.setUseSingleCertificate(true);
sign.setDigestAlgo(DigestMethod.SHA1);
//sign.build(crypto);
Document signedDoc = sign.build(crypto);
return signedDoc;
} catch (SOAPException e) {
e.printStackTrace();
return null;
} catch (WSSecurityException e) {
e.printStackTrace();
throw new RuntimeException("Error: " + e.getMessage());
} catch (IOException e) {
e.printStackTrace();
return null;
} catch (CertificateException e) {
e.printStackTrace();
return null;
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
return null;
} catch (KeyStoreException e) {
e.printStackTrace();
return null;
}
}
它适用于 soapenv:Body(它确实添加了 wsu:Id 和 xmlns:wsu 参数)
但是 soapenv:Header 中有一个额外的元素,它没有对该元素进行签名。没有 wsu:Id 和 xmlns:wsu 参数并且缺少一个 ds:Reference。
未签名肥皂消息示例:
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<!-- this element should be signed but is not - NOT WORKING -->
<something>
</something>
</soapenv:Header>
<!-- this element should be signed and It does. -->
<soapenv:Body>
</soapenv:Body>
</soapenv:Envelope>
我将程序中的 soap msg 与 SoapUI 项目中的工作 soap msg 进行了比较。
当我 post 向 Web 服务发送消息时,我收到错误消息:wsse:InvalidSecurity - Soap Header must be signed
。在 SoupUI 中它确实有效。
所以我的问题是如何强制 WSS4j 在 soapenv:Header 中签署额外的元素?
好的,我已经解决了问题
通常这段代码应该适用于我的情况。
//strange static method from apache o.O
org.apache.xml.security.Init.init();
List<WSEncryptionPart> wsEncryptionParts = new ArrayList<>();
WSEncryptionPart somethingPart = new WSEncryptionPart("something","somethingNamespace","");
wsEncryptionParts.add(somethingPart);
sign.addReferencesToSign(wsEncryptionParts);
然而,它不起作用。它总是抛出异常:
org.apache.wss4j.common.ext.WSSecurityException: No message with ID
"noXMLSig" found in resource bundle
"org/apache/xml/security/resource/xmlsecurity". Original Exception was
a org.apache.wss4j.common.ext.WSSecurityException and message No
message with ID "noEncElement" found in resource bundle
"org/apache/xml/security/resource/xmlsecurity"
我找不到我的 soap 消息或代码有什么问题的答案。
但是经过org.apache.wss4j.dom.message.WSSecSignature的调试。我觉得 class 有问题。我决定修改一个方法 build(Crypto cr).
public Document build(Crypto cr) throws WSSecurityException {
LOG.debug("Beginning signing...");
this.prepare(cr);
if (this.getParts().isEmpty()) {
this.getParts().add(WSSecurityUtil.getDefaultEncryptionPart(this.getDocument()));
// --- Here is my edit - And it works!
WSEncryptionPart aaa = new WSEncryptionPart("something","somethingNamespace","");
this.getParts().add(aaa);
// ----------------------------------
} else {
Iterator var2 = this.getParts().iterator();
label33:
while(true) {
while(true) {
if (!var2.hasNext()) {
break label33;
}
WSEncryptionPart part = (WSEncryptionPart)var2.next();
if (part.getId() == null && "STRTransform".equals(part.getName())) {
part.setId(this.strUri);
} else if ("KeyInfo".equals(part.getName()) && "http://www.w3.org/2000/09/xmldsig#".equals(part.getNamespace()) && part.getElement() == null) {
Element keyInfoElement = this.getKeyInfoElement();
part.setElement(keyInfoElement);
}
}
}
}
List<javax.xml.crypto.dsig.Reference> referenceList = this.addReferencesToSign(this.getParts());
this.computeSignature(referenceList);
if (this.bstToken != null) {
this.prependBSTElementToHeader();
}
return this.getDocument();
}
当然,解决方案很弱。然而,至少它现在有效。
最新版本存在问题:
wss4j-ws-security-dom 2.2.2
wss4j-ws-security-common 2.2.2
我猜它应该是这样工作的:
WSSecSignature sign = new WSSecSignature(secHeader);
sign.getParts().addAll(getEncryptionParts());
getEncryptionParts() 是您要添加的 WSEncryptionPart 列表。
如果以这种方式添加,构建方法能够找到它们,而无需修补框架。
我想将 wsse:security 添加到我的 soap 消息中。这是我的代码:
public Document signSoapMessage(SOAPMessage message) {
try {
Document doc = message.getSOAPBody().getOwnerDocument();
Crypto crypto = CryptoFactory.getInstance(properties); //File
WSSecHeader secHeader = new WSSecHeader(doc);
secHeader.insertSecurityHeader();
InputStream inStream = new FileInputStream(properties.getProperty("org.apache.ws.security.crypto.merlin.keystore.file"));
KeyStore ks = KeyStore.getInstance("PKCS12");
ks.load(inStream, properties.getProperty("privatekeypassword").toCharArray());
String alias = ks.aliases().nextElement();
X509Certificate cert = (X509Certificate) ks.getCertificate(alias);
WSSecSignature sign = new WSSecSignature(secHeader);
sign.setX509Certificate(cert);
sign.setUserInfo(properties.getProperty("org.apache.ws.security.crypto.merlin.keystore.alias"), properties.getProperty("privatekeypassword"));
sign.setKeyIdentifierType(WSConstants.BST_DIRECT_REFERENCE); // Binary Security Token - SecurityTokenReference
sign.setUseSingleCertificate(true);
sign.setDigestAlgo(DigestMethod.SHA1);
//sign.build(crypto);
Document signedDoc = sign.build(crypto);
return signedDoc;
} catch (SOAPException e) {
e.printStackTrace();
return null;
} catch (WSSecurityException e) {
e.printStackTrace();
throw new RuntimeException("Error: " + e.getMessage());
} catch (IOException e) {
e.printStackTrace();
return null;
} catch (CertificateException e) {
e.printStackTrace();
return null;
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
return null;
} catch (KeyStoreException e) {
e.printStackTrace();
return null;
}
}
它适用于 soapenv:Body(它确实添加了 wsu:Id 和 xmlns:wsu 参数)
但是 soapenv:Header 中有一个额外的元素,它没有对该元素进行签名。没有 wsu:Id 和 xmlns:wsu 参数并且缺少一个 ds:Reference。
未签名肥皂消息示例:
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<!-- this element should be signed but is not - NOT WORKING -->
<something>
</something>
</soapenv:Header>
<!-- this element should be signed and It does. -->
<soapenv:Body>
</soapenv:Body>
</soapenv:Envelope>
我将程序中的 soap msg 与 SoapUI 项目中的工作 soap msg 进行了比较。
当我 post 向 Web 服务发送消息时,我收到错误消息:wsse:InvalidSecurity - Soap Header must be signed
。在 SoupUI 中它确实有效。
所以我的问题是如何强制 WSS4j 在 soapenv:Header 中签署额外的元素?
好的,我已经解决了问题
通常这段代码应该适用于我的情况。
//strange static method from apache o.O
org.apache.xml.security.Init.init();
List<WSEncryptionPart> wsEncryptionParts = new ArrayList<>();
WSEncryptionPart somethingPart = new WSEncryptionPart("something","somethingNamespace","");
wsEncryptionParts.add(somethingPart);
sign.addReferencesToSign(wsEncryptionParts);
然而,它不起作用。它总是抛出异常:
org.apache.wss4j.common.ext.WSSecurityException: No message with ID "noXMLSig" found in resource bundle "org/apache/xml/security/resource/xmlsecurity". Original Exception was a org.apache.wss4j.common.ext.WSSecurityException and message No message with ID "noEncElement" found in resource bundle "org/apache/xml/security/resource/xmlsecurity"
我找不到我的 soap 消息或代码有什么问题的答案。
但是经过org.apache.wss4j.dom.message.WSSecSignature的调试。我觉得 class 有问题。我决定修改一个方法 build(Crypto cr).
public Document build(Crypto cr) throws WSSecurityException {
LOG.debug("Beginning signing...");
this.prepare(cr);
if (this.getParts().isEmpty()) {
this.getParts().add(WSSecurityUtil.getDefaultEncryptionPart(this.getDocument()));
// --- Here is my edit - And it works!
WSEncryptionPart aaa = new WSEncryptionPart("something","somethingNamespace","");
this.getParts().add(aaa);
// ----------------------------------
} else {
Iterator var2 = this.getParts().iterator();
label33:
while(true) {
while(true) {
if (!var2.hasNext()) {
break label33;
}
WSEncryptionPart part = (WSEncryptionPart)var2.next();
if (part.getId() == null && "STRTransform".equals(part.getName())) {
part.setId(this.strUri);
} else if ("KeyInfo".equals(part.getName()) && "http://www.w3.org/2000/09/xmldsig#".equals(part.getNamespace()) && part.getElement() == null) {
Element keyInfoElement = this.getKeyInfoElement();
part.setElement(keyInfoElement);
}
}
}
}
List<javax.xml.crypto.dsig.Reference> referenceList = this.addReferencesToSign(this.getParts());
this.computeSignature(referenceList);
if (this.bstToken != null) {
this.prependBSTElementToHeader();
}
return this.getDocument();
}
当然,解决方案很弱。然而,至少它现在有效。
最新版本存在问题:
wss4j-ws-security-dom 2.2.2
wss4j-ws-security-common 2.2.2
我猜它应该是这样工作的:
WSSecSignature sign = new WSSecSignature(secHeader);
sign.getParts().addAll(getEncryptionParts());
getEncryptionParts() 是您要添加的 WSEncryptionPart 列表。 如果以这种方式添加,构建方法能够找到它们,而无需修补框架。