WebService：Axis客户端调用需要身份验证的CXF服务

CXF服务端代码：

1、web.xml配置

 

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
	http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
	<!-- Spring Config Location -->
	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>/WEB-INF/beans.xml</param-value>
	</context-param>
	<!-- Spring ContextLoaderListener -->
	<listener>
		<listener-class>
			org.springframework.web.context.ContextLoaderListener
		</listener-class>
	</listener>
	<!-- Apache CXFServlet -->
	<servlet>
		<servlet-name>CXFServlet</servlet-name>
		<servlet-class>
			org.apache.cxf.transport.servlet.CXFServlet
		</servlet-class>
		<load-on-startup>1</load-on-startup>
	</servlet>
	<!-- CXFServlet Mapping -->
	<servlet-mapping>
		<servlet-name>CXFServlet</servlet-name>
		<url-pattern>/service/*</url-pattern>
	</servlet-mapping>
</web-app>

 

 2、beans.xml配置， 在beans.xml中配置服务端的拦截器interceptor.AuthenticationInterceptor，拦截器需要

继承AbstractPhaseInterceptor

 

<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:jaxws="http://cxf.apache.org/jaxws"
	xsi:schemaLocation="
        http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
        http://cxf.apache.org/jaxws 
        http://cxf.apache.org/schemas/jaxws.xsd">
	<!-- Import Apache CXF Bean Definition -->
	<import resource="classpath:META-INF/cxf/cxf.xml" />
	<import resource="classpath:META-INF/cxf/cxf-extension-soap.xml" />
	<import resource="classpath:META-INF/cxf/cxf-servlet.xml" />
			
	<!-- serviceClass指定接口 -->
	<jaxws:server id="hello"
				  serviceClass="service.SampleWebService" 
				  address="/HelloWorld">
		<jaxws:serviceBean>
			<bean class="service.SampleWebService" />
		</jaxws:serviceBean>
						
		<jaxws:inInterceptors>  
            <bean class="interceptor.AuthenticationInterceptor">
            	<property name="username" value="admin" />
            	<property name="password" value="admin" />
            </bean>
        </jaxws:inInterceptors>		
        
	</jaxws:server>

</beans>

3、在拦截器中对用户身份进行验证

 

package interceptor;

import java.util.List;

import javax.xml.soap.SOAPException;

import org.apache.cxf.binding.soap.SoapMessage;
import org.apache.cxf.headers.Header;
import org.apache.cxf.interceptor.Fault;
import org.apache.cxf.phase.AbstractPhaseInterceptor;
import org.apache.cxf.phase.Phase;
import org.w3c.dom.Node;

public class AuthenticationInterceptor extends AbstractPhaseInterceptor<SoapMessage> {
	private String username;
	private String password;

	public AuthenticationInterceptor() {
		// 指定该拦截器在哪个阶段被激发
		super(Phase.PRE_INVOKE);
	}

	public void handleMessage(SoapMessage msg) throws Fault {
		List<Header> headers = msg.getHeaders();
		if (null == headers || headers.size() < 1) {
			throw new Fault(new SOAPException("SOAPHeader格式错误"));
		}
		for (Header header : headers) {
			Node root = (Node) header.getObject();
			if("Authentication".equals(root.getNodeName())){
				Node userNode = root.getFirstChild();
				Node passwordNode = root.getLastChild();
				if(userNode == null || passwordNode == null){
					throw new Fault(new SOAPException("SOAPHeader需要包含Username和Password节点"));
				}
				if(!userNode.getNodeName().equals("Username") || !passwordNode.getNodeName().equals("Password")){
					throw new Fault(new SOAPException("SOAPHeader需要包含Username和Password节点"));
				}
				if(username.equals(userNode.getTextContent()) && password.equals(passwordNode.getTextContent())){
					System.out.println("认证通过");
				}
				else{
					throw new Fault(new SOAPException("用户名或密码错误"));
				}
			}
			else{
				throw new Fault(new SOAPException("SOAPHeader需要包含Authentication节点"));
			}
		}
	}

	public String getUsername() {
		return username;
	}

	public void setUsername(String username) {
		this.username = username;
	}

	public String getPassword() {
		return password;
	}

	public void setPassword(String password) {
		this.password = password;
	}

}

4、服务接口，CXF可以直接发布JavaBean，只需要一个@WebService注解

 

package service;

import javax.jws.WebService;
@WebService
public class SampleWebService{

	public String sayHello(String name) {		
		return "Hello, "+name;
	}

	public String sayHi(String name) {	
		return "Hi, "+name;
	}
}

 5、Axis客户端：

 

/**
 * <soapenv:Header>
 *     <Authentication 
 *              soapenv:actor="http://schemas.xmlsoap.org/soap/actor/next" 
 *              soapenv:mustUnderstand="0" 
 *              xmlns="">
 *         <Username>admin</Username>
 *         <Password>admin</Password>
 *     </Authentication>
 * </soapenv:Header>
 * @param user
 * @param password
 */
public static void authentication(String user, String password){
	try {
		Call call = (Call)new Service().createCall();
		call.setTargetEndpointAddress("http://localhost:8080/ws/service/HelloWorld");
		String namespace = "";//命名空间
		SOAPHeaderElement header = new SOAPHeaderElement(namespace,"Authentication");
		header.setPrefix("");//前缀
		header.addChildElement("Username").addTextNode(user);  
        header.addChildElement("Password").addTextNode(password);  
        call.addHeader(header);  
		Object obj = call.invoke("sayHi", new String[]{"sam"});
		System.out.println(obj);
	} catch (Exception e) {
		e.printStackTrace();
	} 
}

 在axis的jar包中还提供了一个tcp_moniter，可以用来拦截soap消息，便于debug。

可以使用java -Djava.ext.dirs=lib org.apache.axis.utils.tcpmon来启动，启动前要先将axis的jar包都放在lib目录下，然后在lib的同级目录中建一个bat脚本，脚本中写：java -Djava.ext.dirs=lib org.apache.axis.utils.tcpmon。

这样双击bat脚本就可以启动tcp_moniter了。

tcp_moniter界面：

 

cxf_server端和axis_client端的工程源码见附件。

 

评论

2 楼 lizhenzhendebishe 2017-08-07  

提示An error was discovered processing the <wsse:Security> header

1 楼 CoderDream 2014-09-28  

感谢分享，运行通过，:D
Axis客户端的Client.java的第17行需要修改为（项目名称由ws改为cxf_server）： call.setTargetEndpointAddress("http://localhost:8080/cxf_server/service/HelloWorld");