[英]webservice SOAP UsernameToken CXF not send username/password on each requests
我正在使用usernameToken安全策略来保护Soap Web服务。 我不希望客户端在每个请求上发送用户名/密码。 是否有可能使Web服务处于全状态? 当前,为每个请求调用ServerPasswordCallback。
这是我的代码:
ComputeWS.java
@WebService(
serviceName = "ComputeWS",
targetNamespace = "http://org.test/compute",
name = "ComputeWS")
@EndpointProperties(
value = { @EndpointProperty(key = "ws-security.callback-handler", value = "org.test.ServerPasswordCallback") })
@Policy(placement = Policy.Placement.BINDING, uri = "WSPolicy.xml")
public class ComputeWS {
@WebMethod
public int add(int x, int y) {
return x * y;
}
}
WSPolicy.xml
<?xml version="1.0" encoding="UTF-8" ?>
<wsp:Policy wsu:Id="WSPolicy" xmlns:wsp="http://www.w3.org/ns/ws-policy"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsp:ExactlyOne>
<wsp:All>
<sp:SupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
<wsp:Policy>
<sp:UsernameToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
<wsp:Policy>
<sp:WssUsernameToken11/>
</wsp:Policy>
</sp:UsernameToken>
</wsp:Policy>
</sp:SupportingTokens>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
ServerPasswordCallback.java
public class ServerPasswordCallback implements CallbackHandler {
@Override
public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
if ("joe".equals(pc.getIdentifier())) {
pc.setPassword("joespassword");
}
}
}
没有“开箱即用”的方法。 您可以将UsernameToken的“ IncludeToken”策略从“ AlwaysToRecipient”更改为“ Once”。 然后在服务器端,您将必须通过某种方式(例如Spring Security或Apache Shiro等)来实现跟踪客户端的方式。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.