我想知道如何在 WebSphere Liberty 中启用 WS-Security
我在 Liberty 配置文件的server.xml中创建了一个用户 ( soa_user ) 和用户组 ( soa_group ) 。下面提到的所有功能都已成功安装。
服务器.xml
<server description="new server">
<!-- Enable features -->
<featureManager>
<feature>javaee-7.0</feature>
<feature>jdbc-4.1</feature>
<feature>localConnector-1.0</feature>
<feature>ssl-1.0</feature>
<feature>servlet-3.1</feature>
<feature>wsSecurity-1.1</feature>
<feature>appSecurity-2.0</feature>
<feature>jaxws-2.2</feature>
</featureManager>
<keyStore id="defaultKeyStore" password="yourPassword" />
<basicRegistry id="basic" realm="Authentication">
<user name="soa_user" password="testUserPassword" />
<group name="soa_group">
<member name="soa_user" />
</group>
</basicRegistry>
<httpEndpoint host="*" httpPort="8080" httpsPort="9443" id="defaultHttpEndpoint" />
.....
</server>
我有两个模块，一个用于生成 EAR(ABCServiceEAR) 文件，另一个是 SOAPService(ABCSOAPService)
在src\main\webapp\WEB-INF\web.xml下的 ABCSOAPService 中，我创建了一个用户角色，如下所示
<security-role id="security_role_1">
<role-name>authenticated-user</role-name>
</security-role>
在resources\META-INF\ibm-application-bnd.xml下的 ABCServiceEAR 中，我已将上述用户角色分配给我在 liberty server.xml 中创建的组
<security-role name="authenticated-user">
<group name="soa_group" />
</security-role>
我的目标是检查此用户是否已通过服务端点实现类进行身份验证，如下所示
@javax.jws.WebService (endpointInterface="...",
targetNamespace="...",
serviceName="ABCService_1_0", portName="ABCServicePort_1_0",
wsdlLocation="WEB-INF/wsdl/ABCSOAPService.wsdl")
@HandlerChain(file = "/handlers.xml")
@DeclareRoles({ "authenticated-user" })
public class ABCSOAPServiceImpl implements ABCSOAPService {
@Resource
private WebServiceContext wsContext;
public void myMethod() {
if (!wsContext.isUserInRole("authenticated-user")) {
//do something
}
}
我的 SOAP 标头如下
<soapenv:Header>
<wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:UsernameToken wsu:Id="UsernameToken-1314D8CB1A76EFB5F614902572284093">
<wsse:Username>soa_user</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">testUserPassword</wsse:Password>
<wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">cCdfT/hAg3p4vNwRHP/BMA==</wsse:Nonce>
<wsu:Created>2017-03-23T08:20:28.409Z</wsu:Created>
</wsse:UsernameToken>
</wsse:Security>
</soapenv:Header>
我得到的回应如下
<faultcode>soap:MustUnderstand</faultcode>
<faultstring>MustUnderstand headers: [{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Security] are not understood.</faultstring>
即使我将soapenv:mustUnderstand 设置为“0”，应用程序也无法识别服务端点类中的用户（wsContext.getUserPrincipal() 为空）。
我是 WS Security 的新手，
有人可以告诉我如何实现这一目标吗？
我应该向我的 WSDL 添加什么？
或者是否可以在不更改 WSDL 的情况下全局配置安全性（可能在 Liberty 配置文件中）
更新
我在 {ProjectLocation}\src\main\webapp\WEB-INF\policy-attachments-server.xml 中提供了 ws-security 策略（策略附件），如下所示。
<attachments
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
xmlns:wsp="http://www.w3.org/ns/ws-policy"
xmlns:wsa="http://www.w3.org/2005/08/addressing"
xmlns:sp13="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200802"
xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
<wsp:PolicyAttachment wsdlNamespace="com.my-service.sales.servs.MyService">
<wsp:AppliesTo>
<wsa:EndpointReference>
<wsa:Address>http://localhost:9080/sales/servs/MyService_1_0</wsa:Address>
</wsa:EndpointReference>
</wsp:AppliesTo>
<wsp:Policy wsu:Id="UsernameTokenwithPasswordHashoverSSL">
<wsp:ExactlyOne>
<wsp:All>
<sp:SupportingTokens>
<wsp:Policy>
<sp:UsernameToken
sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
<wsp:Policy>
<sp:WssUsernameToken10 />
</wsp:Policy>
</sp:UsernameToken>
</wsp:Policy>
</sp:SupportingTokens>
</wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>
</wsp:PolicyAttachment>
</attachments>
我仍然有同样的问题。