WebService CXF学习——高级篇(二)

WebService CXF学习——高级篇（二）

2010年12月13日星期一下午10:25WebService接口发布：

Java代码

1.

2.

3. xmlns:xsi="https://www.360docs.net/doc/518336969.html,/2001/XMLSchema-instance"

4. xmlns:jaxws="https://www.360docs.net/doc/518336969.html,/jaxws"

5. xsi:schemaLocation="

6. https://www.360docs.net/doc/518336969.html,/schema/beans

7. https://www.360docs.net/doc/518336969.html,/schema/beans/spring-beans-2.0.xsd

8. https://www.360docs.net/doc/518336969.html,/jaxws

9. https://www.360docs.net/doc/518336969.html,/schemas/jaxws.xsd">

10.

11.

12.

13.

14.

15.

16. implementor="com.itdcl.service.HelloWorldImpl" address="/HelloWorld" />

17.

18.

19. implementor="com.itdcl.service.MyTestImpl" address="/MyTest" />

20.

21.

22. implementor="com.itdcl.service.ServiceImpl" address="/Service">

23.

26.

27.

28.

29. class="org.apache.cxf.jaxws.support.JaxWsServiceFactoryBean">

30.

31.

32.

33.

34.

35. class="org.apache.cxf.aegis.databinding.AegisDatabinding" />

36.

第三步：服务端程序编写了，打包部署

客户端开发

第一步：WebService客户端生成，可以手工编写。这里我就通过配置Ant文件来生成WebService客户端:

Java代码

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

11.

12.

13.

14. message="java2wsdl -->java文件生成wsdl文件，java2wsdl -Ddir=com/starit/cxf/java2wsdl -Dsrc=com.starit.cxf.java2wsdl.Hello" />

15.

16. message="wsdl2javaClient -->java文件生成client，java2wsdl -Ddir=com/starit/cxf/java2wsdl -Dwsdl=hello.wsdl" />

17.

18.

19.

20.

21.

22.

23.

24.

25.

26.

27.

28.

29.

30.

31.

32.

33.

34.

35.

36.

37.

38.

39.

40.

41.

42.

43.

第二步：WebService接口注册配置

Java代码

1.

2.

3. xmlns:xsi="https://www.360docs.net/doc/518336969.html,/2001/XMLSchema-instance"

4. xmlns:jaxws="https://www.360docs.net/doc/518336969.html,/jaxws"

5. xsi:schemaLocation="

6. https://www.360docs.net/doc/518336969.html,/schema/beans

7. https://www.360docs.net/doc/518336969.html,/schema/beans/spring-beans-2.0.xsd

8. https://www.360docs.net/doc/518336969.html,/jaxws

9. https://www.360docs.net/doc/518336969.html,/schemas/jaxws.xsd">

10.

11.

14.

15.

18.

19.

20. address="http://localhost:9999/cxf/Service"

21. serviceClass="com.itdcl.service.IService" />

22.

剩下的事就测试我们整合是否成功了，编写一个JUnit测试类或写一个Main函数测试一下。

Java代码

1. public class JaxbSampleClient {

2. private final static String MODEL = "com.itdcl.model";

3. public static void main(String[] args) throws FileNotFoundException, JAXBException, ParserConfigurationException, TransformerException {

4. ApplicationContext context = new ClassPathXmlApplicationContext(

5. "beans.xml");

6. IService service = (IService) context.getBean("service");

7.

8.

9. ObjectFactory factory = new ObjectFactory();

10. Customer customer = factory.createCustomer();

11. customer.setId(1);

12. customer.setAge("26");

13. customer.setName("Josen");

14. customer.setAddress(100);

15.

16. Customers customers = factory.createCustomers();

17. customers.setCustomer(customer);

18.

19. DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();

20. dbf.setNamespaceAware(true);

21. DocumentBuilder db = dbf.newDocumentBuilder();

22. Document doc = db.newDocument();

23.

24. // 转换

25. JAXBContext jaxbContext = JAXBContext.newInstance(MODEL);

26. Marshaller marshaller = jaxbContext.createMarshaller();

27. //将customers数据与doc绑定

28. marshaller.marshal(customers, doc);

29.

30. DOMSource domSource = new DOMSource(doc);

31. StringWriter writer = new StringWriter();

32. StreamResult result = new StreamResult(writer);

33. TransformerFactory tf = TransformerFactory.newInstance();

34. Transformer transformer = tf.newTransformer();

35. transformer.transform(domSource, result);

36. String xmlString = writer.toString();

37. //System.out.println(xmlString);

38.

39. service.update(xmlString);

40. }

41.

42. }

运行一下，看插入数据库没有。

高级篇3——WS-Security

这一节我们来探讨一下WebService安全问题，如果所有系统都运行在一个封闭的局域网

内，那么可以不考虑网络攻击，拒绝服务，消息篡改，窃取等问题。但通常情况都接入互联网，那么我就得考虑信息安全问题，像前面那样直接将消息裸传，肯定不行。那么，我们就得给消息加密。CXF可以结合WSS4J来对消息安全进行管理，可以使用令牌，X.509认证对消息头或内容进行加密。这节我只对令牌加密做一个简单的描述，我们还以Demo的形式来讲解一下。

这个Demo是在CXF+Spring+Hibernate的基础修改而成。在这里我只针对修改的东西进行讲解。

Java代码

1.

2.

3. xmlns:xsi="https://www.360docs.net/doc/518336969.html,/2001/XMLSchema-instance"

4. xmlns:jaxws="https://www.360docs.net/doc/518336969.html,/jaxws"

5. xsi:schemaLocation="

6. https://www.360docs.net/doc/518336969.html,/schema/beans

7. https://www.360docs.net/doc/518336969.html,/schema/beans/spring-beans-2.0.xsd

8. https://www.360docs.net/doc/518336969.html,/jaxws

9. https://www.360docs.net/doc/518336969.html,/schemas/jaxws.xsd">

10.

11.

12.

13.

14.

15.

16. implementor="com.itdcl.service.ServiceImpl" address="/Service">

17.

18.

19. class="org.apache.cxf.interceptor.LoggingInInterceptor" />

20.

21. class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor" />

22.

23. class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">

24.

25.

26.

27.

28. value="PasswordText" />

29.

30.

31.

32.

33.

34.

35.

36.

37.

38.

39.

40. class="com.itdcl.ws.ServerPasswordCallback" />

41.

42.

action:UsernameToken指使用用户令牌

passwordType:PasswordText指密码加密策略，这里直接文本

user:cxfServer指别名

passwordCallBackRef:serverPasswordCallback指消息验证

消息验证类：

Java代码

1. package com.itdcl.ws;

2.

3. import java.io.IOException;

4.

5. import javax.security.auth.callback.Callback;

6. import javax.security.auth.callback.CallbackHandler;

7. import javax.security.auth.callback.UnsupportedCallbackException;

8.

9. import org.apache.ws.security.WSPasswordCallback;

10.

11. public class ServerPasswordCallback implements CallbackHandler {

12.

13. public void handle(Callback[] callbacks) throws IOException,

14. UnsupportedCallbackException {

15. WSPasswordCallback pc = (WSPasswordCallback) callbacks[0];

16. String pw = pc.getPassword();

17. String idf = pc.getIdentifier();

18. System.out.println("password:"+pw);

19. System.out.println("identifier:"+idf);

20. if (pw.equals("josen") && idf.equals("admin")) {

21. // 验证通过

22. } else {

23. throw new SecurityException("验证失败");

24. }

25. }

26.

27. }

消息验证类通过实现CallbackHandler接口，实现handle方法来进行用户认证。

那么，客户端又怎样来验证消息是否确呢。

Java代码

1.

2.

3. xmlns:xsi="https://www.360docs.net/doc/518336969.html,/2001/XMLSchema-instance"

4. xmlns:jaxws="https://www.360docs.net/doc/518336969.html,/jaxws"

5. xsi:schemaLocation="

6. https://www.360docs.net/doc/518336969.html,/schema/beans

7. https://www.360docs.net/doc/518336969.html,/schema/beans/spring-beans-2.0.xsd

8. https://www.360docs.net/doc/518336969.html,/jaxws

9. https://www.360docs.net/doc/518336969.html,/schemas/jaxws.xsd">

10.

11.

12. address="http://localhost:9999/cxf/Service"

13. serviceClass="com.itdcl.service.IService">

14.

15.

16. class="org.apache.cxf.interceptor.LoggingOutInterceptor" />

17.

18. class="org.apache.cxf.binding.soap.saaj.SAAJOutInterceptor" />

19.

20. class="org.apache.cxf.ws.security.wss4j.WSS4JOutInterceptor">

21.

22.

23.

24.

25. value="PasswordText" />

26.

27.

28.

29.

30.

31.

32.

33.

34.

35.

36.

37. class="com.itdcl.ws.ClientPasswordCallback" />

38.

客户端在发送SOAP时对消息对认证，策略跟服务端一样。但是认证类有所区别：Java代码

1. package com.itdcl.ws;

2.

3. import java.io.IOException;

4.

5. import javax.security.auth.callback.Callback;

6. import javax.security.auth.callback.CallbackHandler;

7. import javax.security.auth.callback.UnsupportedCallbackException;

8.

9. import org.apache.ws.security.WSPasswordCallback;

10.

11. public class ClientPasswordCallback implements CallbackHandler {

12.

13. public void handle(Callback[] callbacks) throws IOException,

14. UnsupportedCallbackException {

15. for(int i=0;i

16. {

17. WSPasswordCallback pc = (WSPasswordCallback)callbacks[i];

18. pc.setPassword("josen");

19. pc.setIdentifier("admin");

20. }

21. }

22.

23. }

客户端在发送消息，设置好用户名和密码。服务端用相应的用户名和密码进行验证。

令牌验证就如此简单。