CXF服务抛出WSSecurityException:没有找到用于解密的证书(KeyId)

我正在按照http://web-gmazza.rhcloud.com/blog/entry/cxf-sts-tutorial中的示例使用CXF-STS应用程序。我能够生成SAML断言，但是当它到达服务提供者时失败。

我有PasswordCallback at Service as，

@Override
    public void handle(Callback[] callbacks) throws IOException,
            UnsupportedCallbackException {
        for (int index = 0; index < callbacks.length; index++) {
            WSPasswordCallback pc = (WSPasswordCallback)callbacks[index];
            int usage = pc.getUsage();
            if (usage == WSPasswordCallback.DECRYPT || usage == WSPasswordCallback.SIGNATURE) {
                String pass = (String) passwords.get(pc.getIdentifier());
                if (pass != null) {
                    pc.setPassword(pass);
                    return;
                }
            }
        }

发现WSPasswordCallback类型为SECRETKEY或not WSPasswordCallback.DECRYPT or WSPasswordCallback.SIGNATURE以外的其他类型

在上面的代码中调试时，标识符显示为_0bfaf221-9588-4033-b3fa-db9ecbd478fe或一些随机文本。在服务提供者上，我使用Keytype - SymmetricKey作为对称绑定

<sp:SymmetricBinding>
               <wsp:Policy>
                  <sp:ProtectionToken>
                     <wsp:Policy>
                        <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
                           <sp:RequestSecurityTokenTemplate>
                              <t:TokenType>http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1</t:TokenType>
                              <t:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</t:KeyType>
                              <t:KeySize>256</t:KeySize>
                           </sp:RequestSecurityTokenTemplate>
                           <wsp:Policy>
                              <sp:RequireInternalReference/>
                           </wsp:Policy>
                           <sp:Issuer>
                              <wsaw:Address>http://localhost:8080/StsService/services/STS</wsaw:Address>
                              <wsaw:Metadata>
                                 <wsx:Metadata>
                                    <wsx:MetadataSection>
                                       <wsx:MetadataReference>
                                          <wsaw:Address>http://localhost:8080/StsService/services/STS/mex</wsaw:Address>
                                       </wsx:MetadataReference>
                                    </wsx:MetadataSection>

在STS端，我提供服务提供商的公钥用于加密

<bean id="utSTSProperties"
         class="org.apache.cxf.sts.StaticSTSProperties">
        <property name="signaturePropertiesFile" value="springconfig/keystore.properties"/>
        <property name="signatureUsername" value="${stskeyalias}"/>
        <property name="callbackHandlerClass" value="com.security.sts.security.StsPasswordCallbackHandler"/>
        <property name="encryptionUsername" value="${serverkeyalias}" />
        <property name="encryptionPropertiesFile" value="springconfig/keystore.properties" />
        <property name="issuer" value="cieron"/>
    </bean>

以下建议:http://mail-archives.apache.org/mod_mbox/cxf-users/201112.mbox/%3CCAB8XdGABkphcJXTbtVpDfBZ3KcymtZYX-Rmv0H8QiuwYNHP5OQ@mail.gmail.com%3E和http://coheigea.blogspot.in/2011/05/ws-trust-sample-in-talend-service.html

我不确定如何对称密钥可用于服务提供者，因为它是加密的。

我检查了所有相关文件，一切似乎完好无损。我在https://github.com/sampleref/CXFSecurity上有我的例子供参考。我在运行客户端时遇到错误，服务提供程序日志显示

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
    at java.lang.Thread.run(Thread.java:722)
Caused by: org.apache.wss4j.common.ext.WSSecurityException: No certificates were found for decryption (KeyId)
    at org.apache.wss4j.dom.processor.EncryptedKeyProcessor.getCertificatesFromEncryptedKey(EncryptedKeyProcessor.java:372)
    at org.apache.wss4j.dom.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:137)
    at org.apache.wss4j.dom.saml.WSSSAMLKeyInfoProcessor.processSAMLKeyInfo(WSSSAMLKeyInfoProcessor.java:80)
    at org.apache.wss4j.common.saml.SAMLUtil.getCredentialFromKeyInfo(SAMLUtil.java:225)
    at org.apache.wss4j.common.saml.SAMLUtil.getCredentialFromSubject(SAMLUtil.java:152)
    at org.apache.wss4j.common.saml.SamlAssertionWrapper.parseSubject(SamlAssertionWrapper.java:672)
    at org.apache.wss4j.dom.processor.SAMLTokenProcessor.handleSAMLToken(SAMLTokenProcessor.java:193)
    at org.apache.wss4j.dom.processor.SAMLTokenProcessor.handleToken(SAMLTokenProcessor.java:79)
    at org.apache.wss4j.dom.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:427)
    at org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor.handleMessage(WSS4JInInterceptor.java:257)

没有找到证书。请提供一些建议

谢谢

您的STS + Service密钥存储库似乎包含不同的密钥…

STS:

serverkeyalias, 13- july -2014, trustedCertEntry，证书指纹(SHA1): 45:4E:EB:4C:35:89:17:E6:A4:0E:94:FB:61:9B:81:83:FB:A0:82:B1

服务器:

serverkeyalias, 12- july -2014, PrivateKeyEntry，证书指纹(SHA1): B8:E6:BA:A5:07:24:69:B3:5E:08:2F:A3:CE:97:D8:2E:E2:E1:31:F8

投资银行部。

相关内容

最新更新

热门标签：