wso2 ESB：不安全后端服务的安全代理出错

Question

我正在使用 WSO2 ESB_4.8.1 我为默认后端服务“echo”创建了一个代理，它可以工作。但是，当我使用用户名令牌身份验证（默认方案 1）激活代理的安全性时，它不再起作用。 当我使用“试用”工具进行尝试时，会生成以下错误：

Unexpected error during sending message out  
TID[-1234] [ESB] [2014-05-28 17:02:40,425] ERROR {org.apache.synapse.core.axis2.Axis2Sender} - Unexpected error during sending message out 
org.apache.rampart.handler.RampartSender.invoke(RampartSender.java:76) 
org.apache.axis2.engine.Phase.invokeHandler(Phase.java:340) 
org.apache.axis2.engine.Phase.invoke(Phase.java:313) 
org.apache.axis2.engine.AxisEngine.invoke(AxisEngine.java:261) 
org.apache.axis2.engine.AxisEngine.send(AxisEngine.java:426) 
org.apache.synapse.core.axis2.DynamicAxisOperation$DynamicOperationClient.send(DynamicAxisOperation.java:185) 
org.apache.synapse.core.axis2.DynamicAxisOperation$DynamicOperationClient.executeImpl(DynamicAxisOperation.java:167) 
org.apache.axis2.client.OperationClient.execute(OperationClient.java:149) 
org.apache.synapse.core.axis2.Axis2FlexibleMEPClient.send(Axis2FlexibleMEPClient.java:482) 
org.apache.synapse.core.axis2.Axis2Sender.sendOn(Axis2Sender.java:59) 
org.apache.synapse.core.axis2.Axis2SynapseEnvironment.send(Axis2SynapseEnvironment.java:338) 
org.apache.synapse.endpoints.AbstractEndpoint.send(AbstractEndpoint.java:333) 
org.apache.synapse.endpoints.AddressEndpoint.send(AddressEndpoint.java:59) 
org.apache.synapse.core.axis2.ProxyServiceMessageReceiver.receive(ProxyServiceMessageReceiver.java:177) 
org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180) 
org.apache.synapse.transport.passthru.ServerWorker.processEntityEnclosingRequest(ServerWorker.java:411) 
org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:183) 
org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172) java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110) java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603) java.lang.Thread.run(Thread.java:722) 

Answer 1

这里是我们使用安全策略的一段代码。您必须在 "" 标记之后包含此代码。

</wsp:ExactlyOne>
<rampart:RampartConfig xmlns:rampart="http://ws.apache.org/rampart/policy">
    <rampart:user>XXXXXXXXXXXXXXXX</rampart:user>
    <rampart:encryptionUser>XXXXXXXXXXXXXXXX</rampart:encryptionUser>
    <rampart:timestampPrecisionInMilliseconds>true</rampart:timestampPrecisionInMilliseconds>
    <rampart:timestampTTL>300</rampart:timestampTTL>
    <rampart:timestampMaxSkew>300</rampart:timestampMaxSkew>
    <rampart:timestampStrict>false</rampart:timestampStrict>
    <rampart:passwordCallbackClass>XX.XXXX.XX.XXXX.XXXXX.PWCBHandler</rampart:passwordCallbackClass>
     <rampart:tokenStoreClass>org.wso2.carbon.security.util.SecurityTokenStore</rampart:tokenStoreClass>
        <rampart:nonceLifeTime>300</rampart:nonceLifeTime>
        <rampart:encryptionCrypto>
            <rampart:crypto
                cryptoKey="org.wso2.carbon.security.crypto.privatestore" provider="org.wso2.carbon.security.util.ServerCrypto">
                <rampart:property name="org.wso2.carbon.security.crypto.alias">XXXXXXXXXXXXXXXX</rampart:property>
                <rampart:property name="org.wso2.carbon.security.crypto.privatestore">XXXXXXXX.jks</rampart:property>
                <rampart:property name="org.wso2.stratos.tenant.id">-1234</rampart:property>
                <rampart:property name="org.wso2.carbon.security.crypto.truststores">XXXXXXXX.jks</rampart:property>
                <rampart:property name="rampart.config.user">XXXXXXXXXXXXXX</rampart:property>
            </rampart:crypto>
        </rampart:encryptionCrypto>
        <rampart:signatureCrypto>
            <rampart:crypto
                cryptoKey="org.wso2.carbon.security.crypto.privatestore" provider="org.wso2.carbon.security.util.ServerCrypto">
                <rampart:property name="org.wso2.carbon.security.crypto.alias">XXXXXXXXXXXXXXXX</rampart:property>
                <rampart:property name="org.wso2.carbon.security.crypto.privatestore">XXXXXXXX.jks</rampart:property>
                <rampart:property name="org.wso2.stratos.tenant.id">-1234</rampart:property>
                <rampart:property name="org.wso2.carbon.security.crypto.truststores">XXXXXXXX.jks</rampart:property>
                <rampart:property name="rampart.config.user">XXXXXXXXXXXXXXXX</rampart:property>
            </rampart:crypto>
        </rampart:signatureCrypto>
    </rampart:RampartConfig>

</wsp:Policy>

然后你必须将你的 PWCBHandler 放在 %HOME_WSO2/repository/components/lib 中，然后使用 wso2 网络界面将你的 keystore.jks 上传到 WSO2。

最后重启wso2。