如何在WebSphere Liberty中启用UsernameToken WS-Security

Question

我想知道如何在WebSphere Liberty中启用WS-Security

我在Liberty个人资料的server.xml中创建了一个用户（soa_user）和用户组（soa_group）。下面提到的所有功能都已成功安装。

server.xml

<server description="new server">
  <!-- Enable features -->
  <featureManager>
    <feature>javaee-7.0</feature>
    <feature>jdbc-4.1</feature>
    <feature>localConnector-1.0</feature>
    <feature>ssl-1.0</feature>
    <feature>servlet-3.1</feature>
    <feature>wsSecurity-1.1</feature>
    <feature>appSecurity-2.0</feature>
    <feature>jaxws-2.2</feature>
  </featureManager>
  <keyStore id="defaultKeyStore" password="yourPassword" />
  <basicRegistry id="basic" realm="Authentication">
    <user name="soa_user" password="testUserPassword" />
     <group name="soa_group">
         <member name="soa_user" />
     </group>
  </basicRegistry>
  <httpEndpoint host="*" httpPort="8080" httpsPort="9443" id="defaultHttpEndpoint" />
  .....
</server>

我有两个模块，一个用于生成EAR（ABCServiceEAR）文件，另一个是SOAPService（ABCSOAPService）

在src \ main \ WEB app \ we b-INF \ WEB . XML下的ABCSOAPService中，我创建了一个用户角色，如下所示

  <security-role id="security_role_1">
    <role-name>authenticated-user</role-name>
  </security-role> 

在 ABC 服务EAR 中的“资源\元-INF\ibm-application-bnd.xml我已将上述用户角色分配给我在自由服务器中创建的组.xml

<security-role name="authenticated-user">
        <group name="soa_group" />
    </security-role>

我的目标是检查这个用户是否通过了服务endpoint实现类的认证，如下所示

@javax.jws.WebService (endpointInterface="...",
        targetNamespace="...",
        serviceName="ABCService_1_0", portName="ABCServicePort_1_0",
        wsdlLocation="WEB-INF/wsdl/ABCSOAPService.wsdl")
@HandlerChain(file = "/handlers.xml")
@DeclareRoles({ "authenticated-user" })
public class ABCSOAPServiceImpl implements ABCSOAPService {

    @Resource
    private WebServiceContext wsContext; 

public void myMethod() {
        if (!wsContext.isUserInRole("authenticated-user")) {
            //do something
        }
    }

我的SOAP头如下

   <soapenv:Header>
      <wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
         <wsse:UsernameToken wsu:Id="UsernameToken-1314D8CB1A76EFB5F614902572284093">
            <wsse:Username>soa_user</wsse:Username>
            <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">testUserPassword</wsse:Password>
            <wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">cCdfT/hAg3p4vNwRHP/BMA==</wsse:Nonce>
            <wsu:Created>2017-03-23T08:20:28.409Z</wsu:Created>
         </wsse:UsernameToken>
      </wsse:Security>
   </soapenv:Header>

我得到的回应如下

<faultcode>soap:MustUnderstand</faultcode>
         <faultstring>MustUnderstand headers: [{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Security] are not understood.</faultstring>

即使我将soapenv：畅所欲言设置为“0”，应用程序也无法识别服务endpoint类中的用户（wsContext.getUserPrincipal（）为null）。

我是WS Security新手，< br >有人能告诉我如何实现这一点吗？< br >我应该给我的WSDL添加什么？< br >或者有没有办法在不改变WSDL的情况下全局配置安全性(可能在Liberty配置文件中)

更新

我已经在{ project location } \ src \ main \ WEB app \ we b-INF \ policy-attachments-server . XML中提供了ws-security策略(策略附件)，如下所示。

<attachments
        xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
        xmlns:wsp="http://www.w3.org/ns/ws-policy"
        xmlns:wsa="http://www.w3.org/2005/08/addressing"
        xmlns:sp13="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200802"
        xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
    <wsp:PolicyAttachment wsdlNamespace="com.my-service.sales.servs.MyService">
        <wsp:AppliesTo>
            <wsa:EndpointReference>
                <wsa:Address>http://localhost:9080/sales/servs/MyService_1_0</wsa:Address>
            </wsa:EndpointReference>
        </wsp:AppliesTo>
        <wsp:Policy wsu:Id="UsernameTokenwithPasswordHashoverSSL">
            <wsp:ExactlyOne>
                <wsp:All>
                    <sp:SupportingTokens>
                        <wsp:Policy>
                            <sp:UsernameToken
                                    sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
                                <wsp:Policy>
                                    <sp:WssUsernameToken10 />
                                </wsp:Policy>
                            </sp:UsernameToken>
                        </wsp:Policy>
                    </sp:SupportingTokens>
                </wsp:All>
            </wsp:ExactlyOne>
        </wsp:Policy>
    </wsp:PolicyAttachment>
</attachments>

我仍然有同样的问题。

Answer 1

在policy-attachments-server.xml中，使用wsp： URI，而不是wsa： Endpoint参考

Answer 2

您需要在服务中附加ws-security策略。您可以在WSDL中添加ws-security策略，也可以在web-inf目录中创建策略附件文件(http://www.ibm.com/support/knowledgecenter/en/SSEQTP_liberty/com.ibm.websphere.wlp.zseries.doc/ae/twlp_dep_policyattach.html).

我们为您的场景提供了策略示例和配置选项，请参阅https://www . IBM . com/support/knowledge center/SSEQTP _ liberty/com . IBM . WebSphere . WLP . nd . multi platform . doc/AE/cwlp _ ws sec _ ut oken . html。