带有支持令牌的 WS-Policy X509Token

Question

我有一个包含 WSPolicy 的 WSDL，定义的策略使用支持令牌，而在支持令牌中它使用 X509 令牌。下面是具有策略的 WSDL 的 sn-p

<wsp:Policy xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
           xmlns:xs="http://www.w3.org/2001/XMLSchema"
           xmlns:fn="http://www.w3.org/2005/xpath-functions"
           xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
           xmlns:wssutil="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
           wssutil:Id="MyPolicy">
  <wsp:ExactlyOne>
     <wsp:All>
        <sp:SupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
           <sp:X509Token sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
              <wsp:Policy>
                 <sp:WssX509V3Token11/>
              </wsp:Policy>
           </sp:X509Token>
        </sp:SupportingTokens>
     </wsp:All>
  </wsp:ExactlyOne>
</wsp:Policy>

现在，当我生成客户端（使用 Apache CXF）并使用任何 Web 服务操作时，我没有看到 wssec 安全标头被添加到 SOAP 标头中。因此，SOAP 服务会在 Policy Validation Interceptor 失败时引发错误。

我进行了大量搜索，但没有找到任何使用这种策略的示例/示例，支持令牌已与 Assymetric / Symmetric 绑定一起使用。

想知道定义的策略是否正确，如果是，那么访问该服务的客户端代码是什么。

只是补充一下，当我将下面的拦截器放入客户端代码时，会添加安全标头（使用二进制安全令牌和签名），但是，服务仍然失败（使用策略验证拦截器）

    Client client = ClientProxy.getClient(port);
    client.getInInterceptors().add(new LoggingInInterceptor());
    client.getOutInterceptors().add(new LoggingOutInterceptor()); 

    Map<String,Object> outProps = new HashMap<String,Object>();
    outProps.put(WSHandlerConstants.ACTION, "Signature");
    outProps.put(WSHandlerConstants.USER, "myclientkey");
    outProps.put(WSHandlerConstants.PW_CALLBACK_CLASS, 
        ClientKeystorePasswordCallback.class.getName());
    outProps.put(WSHandlerConstants.SIG_PROP_FILE, "clientKeystore.properties");
    outProps.put(ConfigurationConstants.SIG_KEY_ID, "DirectReference");

    WSS4JOutInterceptor wssOut = new WSS4JOutInterceptor(outProps);
    client.getOutInterceptors().add(wssOut);

下面是错误堆栈跟踪

Caused by: org.apache.cxf.binding.soap.SoapFault: These policy alternatives can not be satisfied: 
{http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702}SupportingTokens
at     org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.unmarshalFault(Soap11FaultInInterceptor.java:86)
at org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.handleMessage(Soap11FaultInInterceptor.java:52)
at org.apache.cxf.binding.soap.interceptor.Soap11FaultInInterceptor.handleMessage(Soap11FaultInInterceptor.java:41)
at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)
at org.apache.cxf.interceptor.AbstractFaultChainInitiatorObserver.onMessage(AbstractFaultChainInitiatorObserver.java:113)
at org.apache.cxf.binding.soap.interceptor.CheckFaultInterceptor.handleMessage(CheckFaultInterceptor.java:69)
at org.apache.cxf.binding.soap.interceptor.CheckFaultInterceptor.handleMessage(CheckFaultInterceptor.java:34)
at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)
at org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:798)
at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:1638)
at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponse(HTTPConduit.java:1527)
at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1330)
at org.apache.cxf.io.CacheAndWriteOutputStream.postClose(CacheAndWriteOutputStream.java:56)
at org.apache.cxf.io.CachedOutputStream.close(CachedOutputStream.java:215)
at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)
at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:638)
at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62)
at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307)
at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:514)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:423)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:326)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:279)
at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:96)
at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:138)
... 2 more

任何帮助将不胜感激！自 2 天以来，我一直被这个问题困扰。

Answer 1

将 BinarySecurityToken 用作不带安全绑定的 SupportingToken 不适用于 CXF。您还需要指定安全绑定才能对请求进行签名。