CXF-如何使用CXF 3.2.6正确配置Spnego

Question

我正在尝试创建一个CXF肥皂Web服务客户端，以便使用经过Kerberos身份验证的SharePoint实例进行肥皂调用。

我导入以下内容：

• 组织。阿帕奇。cxf:cxf rt前端jaxws:3.2.6
• 组织。阿帕奇。cxf:cxf rt传输http:3.2.6
• 组织。阿帕奇。cxf:cxf rt传输http hc:3.2.6
• 组织。阿帕奇。cxf:cxf rt ws-security:3.2.6

这是我的java程序。

import crawler.common.sharepoint.stubs.lists.Lists;
import crawler.common.sharepoint.stubs.lists.ListsSoap;
import org.apache.cxf.configuration.jsse.TLSClientParameters;
import org.apache.cxf.configuration.security.AuthorizationPolicy;
import org.apache.cxf.endpoint.Client;
import org.apache.cxf.frontend.ClientProxy;
import org.apache.cxf.transport.http.HTTPConduit;
import org.apache.cxf.transport.http.asyncclient.AsyncHTTPConduit;
import org.apache.cxf.transport.http.auth.HttpAuthHeader;
import org.apache.cxf.transports.http.configuration.HTTPClientPolicy;
import org.apache.cxf.ws.security.wss4j.KerberosTokenInterceptor;

import javax.xml.ws.BindingProvider;
import javax.xml.ws.Service;

public class SharepointKerberosTesterClient {

  public static void main(String[] args) {
    System.setProperty("java.security.krb5.conf", "/home/ndipiazza/xxxx/spnego-http-client/krb5.conf");
    System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
    System.setProperty("java.security.auth.login.config", "/home/ndipiazza/xxxx/spnego-http-client/login.conf");

    String endpoint = "http://win-qbfsb933r5p/_vti_bin/Lists.asmx";
    Service service = Service.create(Lists.SERVICE);
    ListsSoap soap = service.getPort(ListsSoap.class);
    BindingProvider bindingProvider = (BindingProvider) soap;

    bindingProvider.getRequestContext().put(AsyncHTTPConduit.USE_ASYNC,
        Boolean.TRUE);
    bindingProvider.getRequestContext().put(
        BindingProvider.ENDPOINT_ADDRESS_PROPERTY, endpoint);

    Client client = ClientProxy.getClient(bindingProvider);
    client.getEndpoint().put("org.apache.cxf.stax.maxChildElements", System.getProperty("org.apache.cxf.stax.maxChildElements") != null
        ? System.getProperty("org.apache.cxf.stax.maxChildElements") : "5000000");
    HTTPConduit http = (HTTPConduit) client.getConduit();

    AuthorizationPolicy authorization = new AuthorizationPolicy();
    authorization.setAuthorization("SharePoint");
    authorization.setAuthorizationType(HttpAuthHeader.AUTH_TYPE_NEGOTIATE);
    http.setAuthorization(authorization);

    HTTPClientPolicy httpClientPolicy = new HTTPClientPolicy();
    httpClientPolicy.setAllowChunking(false);
    httpClientPolicy.setAutoRedirect(true);

    TLSClientParameters tlsClientParameters = new TLSClientParameters();
    tlsClientParameters.setDisableCNCheck(true);

    http.setTlsClientParameters(tlsClientParameters);

    http.setClient(httpClientPolicy);

    System.out.println("Size of lists: " + soap.getListCollection().getContent().size());

  }
}

如果你看看这个例子，http://cxf.apache.org/docs/jaxrs-kerberos.html#JAXRSKerberos-授权策略有一个特殊的类KerberosAuthOutInterceptor，可以根据需要添加协商授权头。

但在3.1中。x和3.2。似乎不存在的x个CXF版本。

相反，有一个https://github.com/apache/cxf/blob/master/rt/ws/security/src/main/java/org/apache/cxf/ws/security/policy/interceptors/SpnegoTokenInterceptorProvider.java我想我应该用的。

但是我不知道如何使用拦截器提供程序。有人知道如何将其与CXF的编程（非xml）声明一起使用吗？

Answer 1

SharePoint部署在IIS上，IIS肯定可以执行Kerberos身份验证。因此，我怀疑这是SharePoint的问题-您能分享一下您的见解吗？我调试它的方法是使用标志Dsun启动您的客户端。安全krb5。debug=true（不适用于您使用的类）。但是，如果尝试嗅探标头，服务器应该发送WWW身份验证。客户端提供的响应（您可以在SharePoint服务器上的调试日志中查看）对于Kerberos应为YII，对于NTLM应为TIRM。因此，如果Kerberos配置以TIRM开头，则会出现问题。您可能必须通过IIS启用连接调试才能查看此信息。