使用SymmetricBinding策略保護weservice

有沒有人可以幫助我配置STS服務器以使用SymmetricBinding策略？使用SymmetricBinding策略保護weservice

我有以下服務：

<?xml version="1.0" encoding="UTF-8"?> 

<wsdl:definitions xmlns="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:tns="http://apache.org/hello_world_soap_http" xmlns:x1="http://apache.org/hello_world_soap_http/types" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsp="http://www.w3.org/ns/ws-policy" xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata" xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702" xmlns:t="http://docs.oasis-open.org/ws-sx/ws-trust/200512" xmlns:wsaw="http://www.w3.org/2005/08/addressing" xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="HelloWorld" targetNamespace="http://apache.org/hello_world_soap_http"> 
    <wsdl:types> 
     <schema xmlns="http://www.w3.org/2001/XMLSchema" xmlns:tns="http://apache.org/hello_world_soap_http/types" targetNamespace="http://apache.org/hello_world_soap_http/types" elementFormDefault="qualified"> 
      <simpleType name="MyStringType"> 
       <restriction base="string"> 
        <maxLength value="30"/> 
       </restriction> 
      </simpleType> 
      <element name="greetMe"> 
       <complexType> 
        <sequence> 
         <element name="requestType" type="tns:MyStringType"/> 
        </sequence> 
       </complexType> 
      </element> 
      <element name="greetMeResponse"> 
       <complexType> 
        <sequence> 
         <element name="responseType" type="string"/> 
        </sequence> 
       </complexType> 
      </element> 
     </schema> 
    </wsdl:types> 
    <wsdl:message name="greetMeRequest"> 
     <wsdl:part element="x1:greetMe" name="in"/> 
    </wsdl:message> 
    <wsdl:message name="greetMeResponse"> 
     <wsdl:part element="x1:greetMeResponse" name="out"/> 
    </wsdl:message> 
    <wsdl:portType name="Greeter"> 
     <wsdl:operation name="greetMe"> 
      <wsdl:input message="tns:greetMeRequest" name="greetMeRequest"/> 
      <wsdl:output message="tns:greetMeResponse" name="greetMeResponse"/> 
     </wsdl:operation> 
    </wsdl:portType> 
    <wsdl:binding name="Greeter_SOAPBinding" type="tns:Greeter"> 
     <wsp:PolicyReference URI="#AsymmetricSAML2Policy"/> 
     <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/> 
     <wsdl:operation name="greetMe"> 
      <soap:operation soapAction="" style="document"/> 
      <wsdl:input name="greetMeRequest"> 
       <soap:body use="literal"/> 
       <wsp:PolicyReference URI="#Input_Policy"/> 
      </wsdl:input> 
      <wsdl:output name="greetMeResponse"> 
       <soap:body use="literal"/> 
       <wsp:PolicyReference URI="#Output_Policy"/> 
      </wsdl:output> 
     </wsdl:operation> 
    </wsdl:binding> 
    <wsdl:service name="SOAPService"> 
     <wsdl:port binding="tns:Greeter_SOAPBinding" name="SoapPort"> 
      <soap:address location="http://localhost:9001/SoapContext/SoapPort"/> 
     </wsdl:port> 
    </wsdl:service> 
    <wsp:Policy wsu:Id="AsymmetricSAML2Policy"> 
     <wsp:ExactlyOne> 
      <wsp:All> 
       <wsam:Addressing wsp:Optional="false"> 
        <wsp:Policy/> 
       </wsam:Addressing> 
       <sp:AsymmetricBinding> 
        <wsp:Policy> 
         <sp:InitiatorToken> 
          <wsp:Policy> 
           <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient"> 
            <sp:RequestSecurityTokenTemplate> 
             <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType> 
             <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/PublicKey</t:KeyType> 
            </sp:RequestSecurityTokenTemplate> 
            <wsp:Policy> 
             <sp:RequireInternalReference/> 
            </wsp:Policy> 
            <sp:Issuer> 
             <wsaw:Address>http://127.0.0.1:8080/SecurityTokenService 
                       </wsaw:Address> 
            </sp:Issuer> 
           </sp:IssuedToken> 
          </wsp:Policy> 
         </sp:InitiatorToken> 
         <sp:RecipientToken> 
          <wsp:Policy> 
           <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/Never"> 
            <wsp:Policy> 
             <sp:WssX509V3Token10/> 
             <sp:RequireIssuerSerialReference/> 
            </wsp:Policy> 
           </sp:X509Token> 
          </wsp:Policy> 
         </sp:RecipientToken> 
         <sp:Layout> 
          <wsp:Policy> 
           <sp:Lax/> 
          </wsp:Policy> 
         </sp:Layout> 
         <sp:IncludeTimestamp/> 
         <sp:OnlySignEntireHeadersAndBody/> 
         <sp:AlgorithmSuite> 
          <wsp:Policy> 
           <sp:Basic256/> 
          </wsp:Policy> 
         </sp:AlgorithmSuite> 
        </wsp:Policy> 
       </sp:AsymmetricBinding> 
       <sp:Wss11> 
        <wsp:Policy> 
         <sp:MustSupportRefIssuerSerial/> 
         <sp:MustSupportRefThumbprint/> 
         <sp:MustSupportRefEncryptedKey/> 
        </wsp:Policy> 
       </sp:Wss11> 
       <sp:Trust13> 
        <wsp:Policy> 
         <sp:MustSupportIssuedTokens/> 
         <sp:RequireClientEntropy/> 
         <sp:RequireServerEntropy/> 
        </wsp:Policy> 
       </sp:Trust13> 
      </wsp:All> 
     </wsp:ExactlyOne> 
    </wsp:Policy> 
    <wsp:Policy wsu:Id="Input_Policy"> 
     <wsp:ExactlyOne> 
      <wsp:All> 
       <sp:EncryptedParts> 
        <sp:Body/> 
       </sp:EncryptedParts> 
       <sp:SignedParts> 
        <sp:Body/> 
        <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/> 
        <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/> 
        <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/> 
        <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/> 
        <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/> 
        <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/> 
        <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/> 
        <sp:Header Name="AckRequested" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/> 
        <sp:Header Name="SequenceAcknowledgement" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/> 
        <sp:Header Name="Sequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/> 
        <sp:Header Name="CreateSequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/> 
       </sp:SignedParts> 
      </wsp:All> 
     </wsp:ExactlyOne> 
    </wsp:Policy> 
    <wsp:Policy wsu:Id="Output_Policy"> 
     <wsp:ExactlyOne> 
      <wsp:All> 
       <sp:EncryptedParts> 
        <sp:Body/> 
       </sp:EncryptedParts> 
       <sp:SignedParts> 
        <sp:Body/> 
        <sp:Header Name="To" Namespace="http://www.w3.org/2005/08/addressing"/> 
        <sp:Header Name="From" Namespace="http://www.w3.org/2005/08/addressing"/> 
        <sp:Header Name="FaultTo" Namespace="http://www.w3.org/2005/08/addressing"/> 
        <sp:Header Name="ReplyTo" Namespace="http://www.w3.org/2005/08/addressing"/> 
        <sp:Header Name="MessageID" Namespace="http://www.w3.org/2005/08/addressing"/> 
        <sp:Header Name="RelatesTo" Namespace="http://www.w3.org/2005/08/addressing"/> 
        <sp:Header Name="Action" Namespace="http://www.w3.org/2005/08/addressing"/> 
        <sp:Header Name="AckRequested" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/> 
        <sp:Header Name="SequenceAcknowledgement" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/> 
        <sp:Header Name="Sequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/> 
        <sp:Header Name="CreateSequence" Namespace="http://docs.oasis-open.org/ws-rx/wsrm/200702"/> 
       </sp:SignedParts> 
      </wsp:All> 
     </wsp:ExactlyOne> 
    </wsp:Policy> 
</wsdl:definitions>

我用CXF來創建STS服務器：

<?xml version="1.0"?> 
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:cxf="http://cxf.apache.org/core" 
     xmlns:jaxws="http://cxf.apache.org/jaxws" 
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
     xmlns:util="http://www.springframework.org/schema/util" 
     xmlns:context="http://www.springframework.org/schema/context" 
     xsi:schemaLocation=" 
     http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd   
     http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd   
     http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd   
     http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.2.xsd 
     http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd 
     "> 

    <cxf:bus> 
     <cxf:features> 
      <cxf:logging/> 
     </cxf:features> 
    </cxf:bus> 
    <bean id="utSTSProviderBean" class="org.apache.cxf.ws.security.sts.provider.SecurityTokenServiceProvider"> 
     <property name="issueOperation" ref="utIssueDelegate"/> 
     <property name="validateOperation" ref="utValidateDelegate"/> 
    </bean> 
    <bean id="utIssueDelegate" class="org.apache.cxf.sts.operation.TokenIssueOperation"> 
     <property name="tokenProviders" ref="utSamlTokenProvider"/> 
     <property name="services" ref="utService"/> 
     <property name="stsProperties" ref="utSTSProperties"/> 
    </bean> 
    <bean id="utValidateDelegate" class="org.apache.cxf.sts.operation.TokenValidateOperation"> 
     <property name="tokenValidators" ref="utSamlTokenValidator"/> 
     <property name="stsProperties" ref="utSTSProperties"/> 
    </bean> 
    <bean id="utSamlTokenProvider" class="org.apache.cxf.sts.token.provider.SAMLTokenProvider"> 
    </bean> 
    <bean id="utSamlTokenValidator" class="org.apache.cxf.sts.token.validator.SAMLTokenValidator"> 
    </bean> 
    <bean id="utService" class="org.apache.cxf.sts.service.StaticService"> 
     <property name="endpoints" ref="utEndpoints"/> 
    </bean> 
    <util:list id="utEndpoints"> 
     <value>http://${sts.host}:(\d)*/SoapContext/SoapPort</value> 
    </util:list> 
    <bean id="utSTSProperties" class="org.apache.cxf.sts.StaticSTSProperties"> 
     <property name="signaturePropertiesFile" value="stsKeystore.properties"/> 
     <property name="signatureUsername" value="mystskey"/> 
     <property name="callbackHandlerClass" value="pl.invicta.STSCallbackHandler"/> 
     <property name="issuer" value="MySTSIssuer"/> 
    </bean> 
    <jaxws:endpoint xmlns:ns1="http://docs.oasis-open.org/ws-sx/ws-trust/200512/" id="UTSTS" 
        implementor="#utSTSProviderBean" address="http://${sts.host}:${sts.port}/SecurityTokenService/UT" 
        wsdlLocation="wsdl/ws-trust-1.4-service.wsdl" serviceName="ns1:SecurityTokenService" 
        endpointName="ns1:UT_Port"> 
     <jaxws:properties> 
      <entry key="ws-security.callback-handler" value="pl.invicta.STSCallbackHandler"/> 
      <entry key="ws-security.signature.properties" value="stsKeystore.properties"/> 
      <entry key="ws-security.signature.username" value="mystskey"/> 
     </jaxws:properties> 
    </jaxws:endpoint> 
</beans>

對於這樣的配置中，所有的處理效果很好，但是當我改變結合對稱的：

<sp:SymmetricBinding> 
        <wsp:Policy> 
         <sp:ProtectionToken> 
          <wsp:Policy> 
           <sp:IssuedToken 
             sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient"> 
            <sp:RequestSecurityTokenTemplate> 
             <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</t:TokenType> 
             <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</t:KeyType> 
             <t:KeySize>256</t:KeySize> 
            </sp:RequestSecurityTokenTemplate> 
            <wsp:Policy> 
             <sp:RequireInternalReference/> 
            </wsp:Policy> 
            <sp:Issuer> 
             <wsaw:Address>http://127.0.0.1:8080/SecurityTokenService</wsaw:Address> 
             <wsaw:Metadata> 
              <wsx:Metadata> 
               <wsx:MetadataSection> 
                <wsx:MetadataReference> 
                 <wsaw:Address>http://127.0.0.1:8080/SecurityTokenService 
                 </wsaw:Address> 
                </wsx:MetadataReference> 
               </wsx:MetadataSection> 
              </wsx:Metadata> 
             </wsaw:Metadata> 
            </sp:Issuer> 
           </sp:IssuedToken> 
          </wsp:Policy> 
         </sp:ProtectionToken> 
         <sp:Layout> 
          <wsp:Policy> 
           <sp:Lax/> 
          </wsp:Policy> 
         </sp:Layout> 
         <sp:IncludeTimestamp/> 
         <sp:OnlySignEntireHeadersAndBody/> 
         <sp:AlgorithmSuite> 
          <wsp:Policy> 
           <sp:Basic256/> 
          </wsp:Policy> 
         </sp:AlgorithmSuite> 
        </wsp:Policy> 
       </sp:SymmetricBinding>

我收到的錯誤：

2017-04-24 14:02:47.414 {- WARN} [qtp766232641-16] o.a.c.s.t.provider.SAMLTokenProvider  : 
org.apache.cxf.ws.security.sts.provider.STSException: The specified request failed

來源

2017-04-24 Marcin Wiśniewski

如果你在STS上啓用調試日誌，它會告訴你問題是什麼。對於CXF源中的STS存在負載的對稱測試：例如， https://github.com/apache/cxf/blob/master/services/sts/systests/basic/src/test/java/org/apache/cxf/systest/sts/symmetric/SymmetricBindingTest.java

來源

2017-04-26 08:58:07

使用SymmetricBinding策略保護weservice

回答

相關問題