webservice SOAP UsernameToken CXF 不会在每个请求上发送用户名/密码

Question

我正在使用用户名令牌安全策略来保护肥皂网络服务。我不希望客户端在每个请求上发送用户名/密码。是否可以使网络服务具有状态？目前，为每个请求调用 ServerPasswordCallback。

这是我的代码：

ComputeWS

.java

@WebService(
    serviceName = "ComputeWS",
    targetNamespace = "http://org.test/compute",
    name = "ComputeWS")
@EndpointProperties(
    value = { @EndpointProperty(key = "ws-security.callback-handler", value = "org.test.ServerPasswordCallback") })
@Policy(placement = Policy.Placement.BINDING, uri = "WSPolicy.xml")
public class ComputeWS {
@WebMethod
public int add(int x, int y) {
    return x * y;
}
}

WSPolicy.xml

<?xml version="1.0" encoding="UTF-8" ?>
<wsp:Policy wsu:Id="WSPolicy" xmlns:wsp="http://www.w3.org/ns/ws-policy"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsp:ExactlyOne>
    <wsp:All>
        <sp:SupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
            <wsp:Policy>
                <sp:UsernameToken sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient">
                    <wsp:Policy>
                        <sp:WssUsernameToken11/>
                    </wsp:Policy>
                </sp:UsernameToken>
            </wsp:Policy>
        </sp:SupportingTokens>
    </wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>

服务器密码回调.java

public class ServerPasswordCallback implements CallbackHandler {
@Override
public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
    WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];
    if ("joe".equals(pc.getIdentifier())) {
        pc.setPassword("joespassword"); 
    }
}
}

Answer 1

没有"开箱即用"的方法。您可以将用户名令牌的"包含令牌"策略从"AlwaysToRecipient"更改为"一次"。然后在服务器端，您必须通过Spring Security或Apache Shiro等实现某种跟踪客户端的方法。