調用SSL服務的Apache CXF客戶端問題

我正在嘗試使用Apache CXF框架編寫WS客戶端。遠程WS具有SSL安全性。我有yydats-keys.jks Java KeyStore和這個遠程WS的所有必要證書。使用瀏覽器（FF，Chrome）（當我導入必要的鍵時）我可以訪問WSDL定義。使用SoapUI（使用設置SSL密鑰庫ti yydats-keys.jks）我可以訪問這些WS並執行它們。基於使用wsdl2java的WSDL定義我已經生成了實現我的客戶調用的起點。注意。這是我使用的命令：./wsdl2java.sh -p org.yydats -d/home/john -exsh false -dns true -dex true -verbose /home/john/yydats.wsdl調用SSL服務的Apache CXF客戶端問題

這裏是WSDL（很少修改爲隱藏真實的URL位）：

<wsdl:definitions xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" 
      xmlns:wsx="http://schemas.xmlsoap.org/ws/2004/09/mex" 
      xmlns:wsa10="http://www.w3.org/2005/08/addressing" 
      xmlns:tns="http://tempuri.org/" 
      xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/" 
      xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" 
      xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" 
      xmlns:wsap="http://schemas.xmlsoap.org/ws/2004/08/addressing/policy" 
      xmlns:msc="http://schemas.microsoft.com/ws/2005/12/wsdl/contract" 
      xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" 
      xmlns:wsam="http://www.w3.org/2007/05/addressing/metadata" 
      xmlns:wsaw="http://www.w3.org/2006/05/addressing/wsdl" 
      xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" 
      xmlns:i0="http://ws.yydats.org/services/StatusService" 
      xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
      xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" 
      name="StatusService" targetNamespace="http://tempuri.org/"> 
    <wsp:Policy wsu:Id="basicBinding_policy"> 
     <wsp:ExactlyOne> 
    <wsp:All> 
     <sp:TransportBinding xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"> 
     <wsp:Policy> 
      <sp:TransportToken> 
     <wsp:Policy> 
      <sp:HttpsToken RequireClientCertificate="true"/> 
     </wsp:Policy> 
      </sp:TransportToken> 
      <sp:AlgorithmSuite> 
     <wsp:Policy> 
      <sp:Basic256/> 
     </wsp:Policy> 
      </sp:AlgorithmSuite> 
      <sp:Layout> 
     <wsp:Policy> 
      <sp:Strict/> 
     </wsp:Policy> 
      </sp:Layout> 
     </wsp:Policy> 
     </sp:TransportBinding> 
    </wsp:All> 
     </wsp:ExactlyOne> 
    </wsp:Policy> 
    <wsdl:import namespace="http://ws.yydats.org/services/IndigentStatusService" location="https://ws.yydats.org/services/StatusService.svc?wsdl=wsdl0"/> 
    <wsdl:types/> 
    <wsdl:binding name="basicBinding" type="i0:IIndigentStatusService"> 
     <wsp:PolicyReference URI="#basicBinding_policy"/> 
     <soap:binding transport="http://schemas.xmlsoap.org/soap/http"/> 
     <wsdl:operation name="Check"> 
    <soap:operation soapAction="http://ws.yydats.org/services/Check" style="document"/> 
    <wsdl:input> 
     <soap:body use="literal"/> 
    </wsdl:input> 
    <wsdl:output> 
     <soap:body use="literal"/> 
    </wsdl:output> 
    <wsdl:fault name="AddressAccessDeniedExceptionFault"> 
     <soap:fault name="AddressAccessDeniedExceptionFault" use="literal"/> 
    </wsdl:fault> 
     </wsdl:operation> 
     <wsdl:operation name="SurveyCheck"> 
    <soap:operation soapAction="http://ws.yydats.org/services/SurveyCheck" style="document"/> 
    <wsdl:input> 
     <soap:body use="literal"/> 
    </wsdl:input> 
    <wsdl:output> 
     <soap:body use="literal"/> 
    </wsdl:output> 
    <wsdl:fault name="AddressAccessDeniedExceptionFault"> 
     <soap:fault name="AddressAccessDeniedExceptionFault" use="literal"/> 
    </wsdl:fault> 
     </wsdl:operation> 
     <wsdl:operation name="ServicesCheck"> 
    <soap:operation soapAction="http://ws.yydats.org/services/ServicesCheck" style="document"/> 
    <wsdl:input> 
     <soap:body use="literal"/> 
    </wsdl:input> 
    <wsdl:output> 
     <soap:body use="literal"/> 
    </wsdl:output> 
    <wsdl:fault name="AddressAccessDeniedExceptionFault"> 
     <soap:fault name="AddressAccessDeniedExceptionFault" use="literal"/> 
    </wsdl:fault> 
     </wsdl:operation> 
    </wsdl:binding> 
    <wsdl:service name="IndigentStatusService"> 
     <wsdl:port name="basicBinding" binding="tns:basicBinding"> 
    <soap:address location="https://ws.yydats.org/services/StatusService.svc"/> 
     </wsdl:port> 
    </wsdl:service> 
    </wsdl:definitions>

我有問題設置客戶端，以便它會使用yydats-keys.jks。我曾嘗試兩種方法： 1）設置JVM系統密鑰庫和信任屬性：

public static void main(String args[]) throws java.lang.Exception { 
    System.setProperty("javax.net.ssl.trustStore","/home/john/yydats-keys.jks"); 
    System.setProperty("javax.net.ssl.trustStorePassword","changeit"); 
    System.setProperty("com.sun.xml.ws.transport.http.client.HttpTransportPipe.dump","true"); 
    System.setProperty("javax.net.ssl.keyStore","/home/john/yydats-keys.jks"); 
    System.setProperty("javax.net.ssl.keyStorePassword","changeit"); 

    QName SERVICE_NAME = new QName("http://tempuri.org/", "StatusService"); 
    StatusService ss = new StatusService(new URL("file:///home/john/yydats.wsdl"), SERVICE_NAME); 
    IStatusService port = ss.getBasicBinding(); 
    port.surveyCheck(); 
    }

2）設置一個HTTPConduit（基於：http://aruld.info/programming-ssl-for-jetty-based-cxf-services/）：

private static void configureSSLOnTheClient(Object c) { 
    Client client = ClientProxy.getClient(c); 
    HTTPConduit httpConduit = (HTTPConduit) client.getConduit(); 

    try { 
     TLSClientParameters tlsParams = new TLSClientParameters(); 
     tlsParams.setDisableCNCheck(true); 

     KeyStore keyStore = KeyStore.getInstance("JKS"); 
     String trustpass = "changeit"; 

     File truststore = new File("/home/john/yydats-keys.jks"); 
     keyStore.load(new FileInputStream(truststore), trustpass.toCharArray()); 
     TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); 
     trustFactory.init(keyStore); 
     TrustManager[] tm = trustFactory.getTrustManagers(); 
     tlsParams.setTrustManagers(tm); 

     truststore = new File("/home/john/yydats-keys.jks"); 
     keyStore.load(new FileInputStream(truststore), trustpass.toCharArray()); 
     KeyManagerFactory keyFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()); 
     keyFactory.init(keyStore, trustpass.toCharArray()); 
     KeyManager[] km = keyFactory.getKeyManagers(); 
     tlsParams.setKeyManagers(km); 

     FiltersType filter = new FiltersType(); 
     filter.getInclude().add(".*_EXPORT_.*"); 
     filter.getInclude().add(".*_EXPORT1024_.*"); 
     filter.getInclude().add(".*_WITH_DES_.*"); 
     filter.getInclude().add(".*_WITH_NULL_.*"); 
     filter.getExclude().add(".*_DH_anon_.*"); 
     tlsParams.setCipherSuitesFilter(filter); 

     httpConduit.setTlsClientParameters(tlsParams); 
    } catch (KeyStoreException kse) { 
     System.out.println("Security configuration failed with the following: " + kse.getCause()); 
    } catch (NoSuchAlgorithmException nsa) { 
     System.out.println("Security configuration failed with the following: " + nsa.getCause()); 
    } catch (FileNotFoundException fnfe) { 
     System.out.println("Security configuration failed with the following: " + fnfe.getCause()); 
    } catch (UnrecoverableKeyException uke) { 
     System.out.println("Security configuration failed with the following: " + uke.getCause()); 
    } catch (CertificateException ce) { 
     System.out.println("Security configuration failed with the following: " + ce.getCause()); 
    } catch (GeneralSecurityException gse) { 
     System.out.println("Security configuration failed with the following: " + gse.getCause()); 
    } catch (IOException ioe) { 
     System.out.println("Security configuration failed with the following: " + ioe.getCause()); 
    } 
    } 

    public static void main(String args[]) throws java.lang.Exception { 
    QName SERVICE_NAME = new QName("http://tempuri.org/", "StatusService"); 
    StatusService ss = new StatusService(new URL("file:///home/john/yydats.wsdl"), SERVICE_NAME); 
    IStatusService port = ss.getBasicBinding(); 

    configureSSLOnTheClient(port); 

    port.surveyCheck(); 
    }

這是堆棧跟蹤我得到：

--------------------------- 
    ID: 1 
    Address: https://ws.yydats.org/services/StatusService.svc 
    Encoding: UTF-8 
    Content-Type: text/xml 
    Headers: {Accept=[*/*], SOAPAction=["http://ws.yydats.org/services/StatusService.svc/ServicesCheck"]} 
    Payload: <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Header/><soap:Body><ServicesCheck xmlns="http://ws.yydats.org/services/StatusService" xmlns:ns2="http://schemas.microsoft.com/2003/10/Serialization/" xmlns:ns3="yydats://yydats.Status" xmlns:ns4="http://schemas.datacontract.org/2004/07/System" xmlns:ns5="http://schemas.datacontract.org/2004/07/System.ServiceModel"><personCode></personCode><userName></userName><userSecondName></userSecondName><userPersonCode></userPersonCode><outErrText></outErrText><outPersCode></outPersCode></ServicesCheck></soap:Body></soap:Envelope> 
    -------------------------------------- 
    Dec 06, 2011 5:57:29 PM org.apache.cxf.phase.PhaseInterceptorChain doDefaultLogging 
    WARNING: Interceptor for {http://tempuri.org/}StatusService#{http://ws.yydats.org/services/StatusService}ServicesCheck has thrown exception, unwinding now 
    org.apache.cxf.interceptor.Fault: Could not send Message. 
     at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:64) 
     at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:263) 
     at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:533) 
     at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:463) 
     at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:366) 
     at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:319) 
     at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:88) 
     at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:134) 
     at $Proxy37.servicesCheck(Unknown Source) 
     at lv.lattelecom.npais.sopa.IIndigentStatusService_BasicBinding_Client.main(IIndigentStatusService_BasicBinding_Client.java:170) 
    Caused by: org.apache.cxf.transport.http.UntrustedURLConnectionIOException: UntrustedURLConnectionIOException invoking https://ws.yydats.org/services/StatusService.svc: RequireClientCertificate is set, but no local certificates were negotiated. Is the server set to ask for client authorization? 
     at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) 
     at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57) 
     at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) 
     at java.lang.reflect.Constructor.newInstance(Constructor.java:525) 
     at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.mapException(HTTPConduit.java:1428) 
     at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1413) 
     at org.apache.cxf.io.CacheAndWriteOutputStream.postClose(CacheAndWriteOutputStream.java:47) 
     at org.apache.cxf.io.CachedOutputStream.close(CachedOutputStream.java:188) 
     at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56) 
     at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:646) 
     at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62) 
     ... 9 more 
    Caused by: org.apache.cxf.transport.http.UntrustedURLConnectionIOException: RequireClientCertificate is set, but no local certificates were negotiated. Is the server set to ask for client authorization? 
     at org.apache.cxf.ws.security.policy.interceptors.HttpsTokenInterceptorProvider$HttpsTokenOutInterceptor$1.establishTrust(HttpsTokenInterceptorProvider.java:121) 
     at org.apache.cxf.transport.http.TrustDecisionUtil.makeTrustDecision(TrustDecisionUtil.java:80) 
     at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleHeadersTrustCaching(HTTPConduit.java:1342) 
     at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.onFirstWrite(HTTPConduit.java:1307) 
     at org.apache.cxf.io.AbstractWrappedOutputStream.write(AbstractWrappedOutputStream.java:42) 
     at org.apache.cxf.io.AbstractThresholdOutputStream.write(AbstractThresholdOutputStream.java:69) 
     at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1385) 
     ... 14 more 

    Exception in thread "main" javax.xml.ws.WebServiceException: Could not send Message. 
     at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:145) 
     at $Proxy37.servicesCheck(Unknown Source) 
     at lv.lattelecom.npais.sopa.IIndigentStatusService_BasicBinding_Client.main(IIndigentStatusService_BasicBinding_Client.java:170) 
    Caused by: org.apache.cxf.transport.http.UntrustedURLConnectionIOException: UntrustedURLConnectionIOException invoking https://ws.yydats.org/services/StatusService.svc: RequireClientCertificate is set, but no local certificates were negotiated. Is the server set to ask for client authorization? 
     at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) 
     at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57) 
     at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) 
     at java.lang.reflect.Constructor.newInstance(Constructor.java:525) 
     at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.mapException(HTTPConduit.java:1428) 
     at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1413) 
     at org.apache.cxf.io.CacheAndWriteOutputStream.postClose(CacheAndWriteOutputStream.java:47) 
     at org.apache.cxf.io.CachedOutputStream.close(CachedOutputStream.java:188) 
     at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56) 
     at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:646) 
     at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62) 
     at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:263) 
     at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:533) 
     at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:463) 
     at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:366) 
     at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:319) 
     at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:88) 
     at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:134) 
     ... 2 more 
    Caused by: org.apache.cxf.transport.http.UntrustedURLConnectionIOException: RequireClientCertificate is set, but no local certificates were negotiated. Is the server set to ask for client authorization? 
     at org.apache.cxf.ws.security.policy.interceptors.HttpsTokenInterceptorProvider$HttpsTokenOutInterceptor$1.establishTrust(HttpsTokenInterceptorProvider.java:121) 
     at org.apache.cxf.transport.http.TrustDecisionUtil.makeTrustDecision(TrustDecisionUtil.java:80) 
     at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleHeadersTrustCaching(HTTPConduit.java:1342) 
     at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.onFirstWrite(HTTPConduit.java:1307) 
     at org.apache.cxf.io.AbstractWrappedOutputStream.write(AbstractWrappedOutputStream.java:42) 
     at org.apache.cxf.io.AbstractThresholdOutputStream.write(AbstractThresholdOutputStream.java:69) 
     at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1385)`enter code here`

有沒有人遇到過類似的問題？或者也許有什麼想法我可能做錯了？

來源

2011-12-06 oskarae

由於堆棧跟蹤指示，SSL連接被服務器拒絕。您的兩個測試客戶端都試圖建立一個簡單的HTTPS連接（即客戶端有一個可信任的證書）。但是，您的WSDL的WS-Policy的是在這個問題上明確表示：

<wsp:Policy> 
    <sp:HttpsToken RequireClientCertificate="true"/> 
</wsp:Policy>

的客戶將需要一個相互HTTPS連接授權訪問網絡服務（即同簡單的HTTPS +客戶端都有自己的密鑰對向服務器標識自己）。這可能適用於其他客戶端（SOAPUI），因爲它們更寬鬆和/或完全忽略WS-Policy限制。

所以，你有兩個選擇：

您更新設置你的測試腳本的一個相互HTTPS連接（我沒有代碼，方便了這一點）。
你開發了一個簡單的測試CXF客戶端沒有相互HTTPS連接，也可從CXF樣本一個非常好的示例項目，不正是你所需要的： http://svn.apache.org/repos/asf/cxf/tags/cxf-2.4.4/distribution/src/main/release/samples/wsdl_first_https/

來源

2011-12-14 16:49:45 ajeans

謝謝@ajeans我將這個至三一。 – oskarae

調用SSL服務的Apache CXF客戶端問題

回答

相關問題