Spring Web Service模板：添加用户名令牌

Question

我有一个Web应用程序，作为Jax-WS Web服务的客户端来使用，该服务使用Spring WS实现。Spring WS配置为需要SOAP头中的用户名令牌。在Web应用程序中，我计划使用Spring Web Service模板，但似乎找不到任何示例 showing如何将UsernameToken添加到出站请求中。

有人能给我指点一下吗？

谢谢。

- Justin Kredible

Answer 1

你需要使用拦截器。请查看第7章 Spring-WS保护Web服务。

配置应该像这样

<bean id="webServiceTemplate" class="org.springframework.ws.client.core.WebServiceTemplate">
    <property name="marshaller" ref="marshaller" />
    <property name="unmarshaller" ref="marshaller" />
    <property name="defaultUri"
        value="http://localhost:8080/ws-demo/myws" />
    <property name="interceptors">
        <list>
            <ref bean="wsSecurityInterceptor" />
        </list>
    </property>
</bean>

<bean id="wsSecurityInterceptor" class="org.springframework.ws.soap.security.wss4j.Wss4jSecurityInterceptor">
    <property name="securementActions" value="UsernameToken"/>
    <property name="securementUsername" value="Ernie"/>
    <property name="securementPassword" value="Bert"/>
</bean>

- jddsantaella

---

为了让这个解决方案起作用，在wsSecurityInterceptor bean下，我必须添加<property name="securementPasswordType" value="PasswordText" />。 - Taoufik Mohdit

Answer 2

除了jddsantaella的回答之外，客户端类还可以使用SAAJ在SOAP头中添加用户名令牌：

OrganisationPortfolioRequest request = WS_CLIENT_FACTORY.createOrganisationsPortfolioRequest();
OrganisationPortfolioResponse response;

response = (OrganisationPortfolioResponse) webServiceTemplate.marshalSendAndReceive(request, 
            new WebServiceMessageCallback() {
        public void doWithMessage(WebServiceMessage message) throws IOException, TransformerException {
            SaajSoapMessage soapMessage = (SaajSoapMessage) message;
            SoapEnvelope envelope = soapMessage.getEnvelope();
            envelope.addNamespaceDeclaration("soapenv", "http://schemas.xmlsoap.org/soap/envelope/");
            envelope.addNamespaceDeclaration("s", "http://company.com/ws/security.xsd");

            SoapHeaderElement username =  soapMessage.getSoapHeader().addHeaderElement(new QName("http://company.com/ws/security.xsd", "username", "s"));
            username.setText(getCurrentUser.getUsername());
        }
    });
response.getResults();

- hit3k

Answer 3

上述答案适用于xml。我在此提到基于注释的配置，用于Web服务的usernameToken安全策略。请将此配置添加到Spring Boot客户端中。

@Bean
public WebServiceTemplate webServiceTemplate() {
    WebServiceTemplate webServiceTemplate = new WebServiceTemplate();
    webServiceTemplate.setMarshaller(marshaller());
    webServiceTemplate.setUnmarshaller(marshaller());
    webServiceTemplate.setDefaultUri("http://localhost:8080/ws");
    webServiceTemplate.setInterceptors(new ClientInterceptor[] {wsSecurityInterceptor()}); 
    return webServiceTemplate;
}

@Bean
public Wss4jSecurityInterceptor wsSecurityInterceptor() {
    Wss4jSecurityInterceptor wss4jSecurityInterceptor = new Wss4jSecurityInterceptor();
    wss4jSecurityInterceptor.setSecurementActions(WSHandlerConstants.TIMESTAMP + " " + WSHandlerConstants.USERNAME_TOKEN);
    wss4jSecurityInterceptor.setSecurementPasswordType(WSConstants.PW_TEXT);
    wss4jSecurityInterceptor.setSecurementUsername("user");
    wss4jSecurityInterceptor.setSecurementPassword("password");
    return wss4jSecurityInterceptor;
}   

- Vishal